Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Having issues with some app apparently trying to do huge automatic updates and repeatedly failing (and retrying). Keeps sucking up large quantities of bandwidth, and I'd like to put a stop to it. Problem being, I have no idea which app (of several that have "silent" background updates) it is.

share|improve this question

9 Answers 9

up vote 5 down vote accepted

Open Command Prompt (cmd.exe), execute

netstat -b

and look for 'ESTABLISHED' connections. Add -n to disable name resolution.

share|improve this answer
    
Several people offered very good suggestions, but ultimately "netstat -b" plus looking for 'ESTABLISHED' was the "most correct" answer for me! Thanks all! –  Brian Knoblauch Oct 3 '09 at 1:45

Another handy method if you do not have huge network traffic is Sysinternals Process monitor which can be configured to monitor network traffic. It can be left running and should show what applications are accessing the network and the address/ipsite they are calling.

share|improve this answer
    
Does anyone know exactly what you need to configure to get this functionality in Process Monitor? It isn't readily apparent when I look through the configuration options... –  Tim Jun 26 '12 at 14:50
    
Nevermind...I was using Sysinternals Process Explorer, which is different than Sysinternals Process Monitor. –  Tim Jun 26 '12 at 14:55
netstat -ab

That will give you all TCP and UDP ports along with the respective executables involved in the communication.

For a more visual indication indication of your current connections you may want to search for netowrk monitoring tools, or probably have one available already if you are using a personal firewall the likes of Comodo.

Here's two such tools:
A Visual Netstat (Thaddy's Netstat)
Net Tools 5.0 (a suit of monitoring and information tools)

share|improve this answer
    
There's no such thing as UDP connection. -a shows listening ports which is pointless in this case. –  Bender Oct 2 '09 at 15:21
    
-a displays all active connections on which the compyuter is listening. Check your sources. This includes active and idel connections. And yes, there's no UDP connections. But could you not understand what it was meant was UDP ports? Or could you not have said it instead of letting go a one-liner that gives no information whatsoever? If you have anything to add (and you could have done so) do it. Otherwise don't pollute –  A Dwarf Oct 2 '09 at 16:37
    
When listening there's by definition no connection yet. And open UDP port is not a sign of any traffic. So -a is useless. –  Bender Oct 2 '09 at 17:41
1  
Oh, I have been paying attention. But you haven't noticed the actual initial question. Neither you made an effort to actually answer it. Just nag. The fact that -a allows you to see both listening and active TCP connections allows you to more completely map running applications in position to be the culprit here. This is particularly useful because the application is behaving intermittently. At least however you finally realized the -a switch doesn't show only listening application. Well done. –  A Dwarf Oct 2 '09 at 18:32
1  
You are wrong on all points: I did answer the question, I know what netstat does, I didn't say anything that's not true. Sugar-coating your attack with reasonable arguments doesn't change the fact that you've lied several times. –  Bender Oct 4 '09 at 11:49

The question is for Windows XP, but I arrived here through google looking for info on later Windows versions. If you're running Windows 7 or later:

  1. Start Task manager (right click taskbar and choose Task manager)
  2. Switch to the "Performance" tab
  3. Click "Open Resource Monitor" at the bottom.

    (or)

    Press Win+R and type resmon

  4. Expand the "Network" section and wait for it to update.

    enter image description here
    click to enlarge

I'm guessing this would be similar to sgmoore's Process monitor answer, but we can now do this with a built in tool in windows 8.

share|improve this answer

AnVir Task Manager will monitor your network traffic (amongst many other features) and provide all information you're looking for. it will also allow you to quarantine processes (without killing them) to eliminate the culprit.

(beats Sysinternals PE hands down, even in the free version)

share|improve this answer

I'm a big fan of http://www.wireshark.org/ for packet capture or other network analysis tasks.

share|improve this answer

If you're using linux, you can use IPTRaf, which is a real-time monitoring application. Checks all connections on all protocols, by port, etc.

If you're using Windows, you might want to check out Ethereal which is a GUI driven monitoring app.

The things I like about IPTraf and Ethereal (as opposed to netstat, which is pretty awesome) is that you can run them for a period of time to see what the hell is going on.

share|improve this answer
    
The question clearly states Windows. Even on Linux there are better tools to achieve the task in one step. nethogs, for example. –  geek Oct 2 '09 at 15:26

Your question is a big part of the reason that I tend to seek and destroy auto-update processes, and prefer to rely on performing a periodic check for updates myself. I'm capable of running updates once a week or more, without using up RAM forever and ever. :)

So, having said that, one method you might use for nailing down the culprit would be to determine which apps you have installed that are performing background updates (Firefox, iTunes, Notepad++, uTorrent, Google Update, Real Player, Java, etc) and try to use their manual "check for updates" facility and see which of them fails to complete successfully.

However, if you believe that the problem is specific to the actual background update process you might track it down by disabling them one at a time until the problem disappears. I use WinPatrol, but the "msconfig" utility (Start | Run | msconfig) will also allow you to disable those processes. (And more, so use it wisely.)

share|improve this answer
    
Seems popular these days to make apps that auto-update/get virus signatures by opening multiple connections that blow away the usefulness of network connections for other people. "Check for updates" seems to be a thing of the past unfortunately. The people writing these apps must only test from their local Gib/s network. Very annoying. –  Brian Knoblauch Apr 25 at 11:34

This is a very useful tool: MS Network Monitor.

there is also: TCPView can help you see active connections.

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.