Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 6 down vote favorite
5

Having issues with some app apparently trying to do huge automatic updates and repeatedly failing (and retrying). Keeps sucking up large quantities of bandwidth, and I'd like to put a stop to it. Problem being, I have no idea which app (of several that have "silent" background updates) it is.

share|improve this question

7 Answers

up vote 3 down vote accepted

Open Command Prompt (cmd.exe), execute

netstat -b

and look for 'ESTABLISHED' connections. Add -n to disable name resolution.

share|improve this answer
Several people offered very good suggestions, but ultimately "netstat -b" plus looking for 'ESTABLISHED' was the "most correct" answer for me! Thanks all! – Brian Knoblauch Oct 3 '09 at 1:45
up vote 2 down vote 
netstat -ab

That will give you all TCP and UDP ports along with the respective executables involved in the communication.

For a more visual indication indication of your current connections you may want to search for netowrk monitoring tools, or probably have one available already if you are using a personal firewall the likes of Comodo.

Here's two such tools:
A Visual Netstat (Thaddy's Netstat)
Net Tools 5.0 (a suit of monitoring and information tools)

share|improve this answer
There's no such thing as UDP connection. -a shows listening ports which is pointless in this case. – Bender Oct 2 '09 at 15:21
-a displays all active connections on which the compyuter is listening. Check your sources. This includes active and idel connections. And yes, there's no UDP connections. But could you not understand what it was meant was UDP ports? Or could you not have said it instead of letting go a one-liner that gives no information whatsoever? If you have anything to add (and you could have done so) do it. Otherwise don't pollute – A Dwarf Oct 2 '09 at 16:37
When listening there's by definition no connection yet. And open UDP port is not a sign of any traffic. So -a is useless. – Bender Oct 2 '09 at 17:41
have you actually ever used netstat -a? please stop saying things aren't true. type "netstat -a" in your command prompt. – A Dwarf Oct 2 '09 at 17:48
1  
Oh, I have been paying attention. But you haven't noticed the actual initial question. Neither you made an effort to actually answer it. Just nag. The fact that -a allows you to see both listening and active TCP connections allows you to more completely map running applications in position to be the culprit here. This is particularly useful because the application is behaving intermittently. At least however you finally realized the -a switch doesn't show only listening application. Well done. – A Dwarf Oct 2 '09 at 18:32
show 3 more comments
up vote 1 down vote

AnVir Task Manager will monitor your network traffic (amongst many other features) and provide all information you're looking for. it will also allow you to quarantine processes (without killing them) to eliminate the culprit.

(beats Sysinternals PE hands down, even in the free version)

share|improve this answer
up vote 0 down vote

If you're using linux, you can use IPTRaf, which is a real-time monitoring application. Checks all connections on all protocols, by port, etc.

If you're using Windows, you might want to check out Ethereal which is a GUI driven monitoring app.

The things I like about IPTraf and Ethereal (as opposed to netstat, which is pretty awesome) is that you can run them for a period of time to see what the hell is going on.

share|improve this answer
The question clearly states Windows. Even on Linux there are better tools to achieve the task in one step. nethogs, for example. – geek Oct 2 '09 at 15:26
up vote 0 down vote

I'm a big fan of http://www.wireshark.org/ for packet capture or other network analysis tasks.

share|improve this answer
up vote 0 down vote

Another handy method if you do not have huge network traffic is Sysinternals Process monitor which can be configured to monitor network traffic. It can be left running and should show what applications are accessing the network and the address/ipsite they are calling.

share|improve this answer
Does anyone know exactly what you need to configure to get this functionality in Process Monitor? It isn't readily apparent when I look through the configuration options... – Tim Jun 26 '12 at 14:50
Nevermind...I was using Sysinternals Process Explorer, which is different than Sysinternals Process Monitor. – Tim Jun 26 '12 at 14:55
up vote 0 down vote

Your question is a big part of the reason that I tend to seek and destroy auto-update processes, and prefer to rely on performing a periodic check for updates myself. I'm capable of running updates once a week or more, without using up RAM forever and ever. :)

So, having said that, one method you might use for nailing down the culprit would be to determine which apps you have installed that are performing background updates (Firefox, iTunes, Notepad++, uTorrent, Google Update, Real Player, Java, etc) and try to use their manual "check for updates" facility and see which of them fails to complete successfully.

However, if you believe that the problem is specific to the actual background update process you might track it down by disabling them one at a time until the problem disappears. I use WinPatrol, but the "msconfig" utility (Start | Run | msconfig) will also allow you to disable those processes. (And more, so use it wisely.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.