Uploaded 180mb in 3 days? How come

[marc777]

Running a small network with 8 PC's off a server. 1MB Broadband, watchguard Firewall.

Every 40 minutes we have to re-boot the BT router/modem thing as its buffer appears to be full.

Router's been changed. Firewall Box been changed.

No effect.

BT did a radius Log check today and in 3 days the network downloaded 30MB data, but uploaded 180MB. We send the odd e-mail, rarely with attachments.

Anyone any ideas whats happening?

Virus software is Sophos and bang up to date.
Run ad-aware on all machines and apart from some low risk data mining Cookies no real threats.

Help please..........!

Marc

 

[craigyb]

Is someone using your server as a repository, it does happen.

Craig

 

[frog1520]

The question here mate is are you REALLY uploading 180Mb of data, and if so, what is it? The best way to tell is to monitor the network (i.e. the local side of your router) for a period, to see what data is flying off to the internet.

On Linux, you could use 'etherreal' (or tcpdump or others..); if you use Billy's OS there must be some equivalents available, but I don't know their names.

Hope this helps!
Cheers!

 

[Sanj]

do u have logging enabled on your firewall ?

check to see what outbound traffic is passing through.

it should give you information ..like source ip , dest ip , source port and dest port.

Sanj

 

[Maff]

Any of those machines running MS SQL server and not patched? Slammer won't show up on virus scans but can cause unknown outgoing traffic.

Just a though...

 

[Will]

Sorry, OT - congratulations Maff on 1,000 posts!

Cheers,

Will

 

[scotth_uk]

Also fair to say that not all firewalls are configured to stop outbound traffic originating from your machine by default. Commonly checked through a "leak test". Most traffic originating from your network is default = trusted.

 

[Satch]

Do you have a wireless network? If so make sure your security is up to scratch or somebody may be hitching a free ride!

Anybody on your network (or maybe your parasite users) got Peer-to-Peer file sharing applications such as KaZaa, Morpheus, Grokster or Gnutella? As my company found out these programs can operate as file servers by default and offer files from network users hard drives to other Internet users, possibly causing your account to use excessive upload bandwidth.

You can get capped by your provider for using excessive upload bandwidth. Does that suck or what? That exhaust my info on the topic, but thanks to our IT guru, here are some possible, maybe fixes:

Aimster
Please note: The Windows version of Aimster will continue running in the background even when all windows have been closed. It should be evident that Aimster is still running by the icon that resides in task tray. To fully exit Aimster, you must right click on the Aimster icon in the task tray and choose exit.

To disable file-sharing in the Windows version:

Inside the Aimster control panel, click on the settings button

Go to the Transfers tab

In the box next to 'Max Aimster Uploads' enter a value of 0

Click the OK button

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart Aimster and verify sharing is disabled
To disable file-sharing in the Macintosh version:

With the software open, select the shared folders tab

You should not see any folders listed in the Folder Path area. If items are listed, select them and click remove.

Exit the program entirely

Restart Aimster and verify sharing is disabled

Audiogalaxy Satellite

Please note: Audiogalaxy Satellite will not allow you to disable file sharing. It requires that the user specify shared folders. This means that all files that you download will immediately become available to others. There is no way to disable the server functionality and therefore use of this program will place the user in violation of the Cox acceptable use policy.

Bearshare


From within the software, click on the Uploads tab

Remove the check from the 'Share Files' checkbox in the lower left corner of the Bearshare window

Exit the program entirely

Restart Bearshare and verify sharing is disabled

Gnutella

On the main screen, place a 0 in the box next to 'Maximum number of uploads'

Click on the SETUP button along the top of the main screen to open the configuration window.

Inside the configuration window, click the Shared Files tab

Make sure there are no directory names listed in the shared files area. If directories are listed, select each one and click the Remove button

On the same screen, in the portion labeled Extensions, clear the checkbox (no check) next to 'Share all types of files'

The extensions list (just below) should now be empty. If it is not, click each extension type and press the Remove button.

Click Apply

Click Ok

Exit the program entirely

Restart Gnutella and verify sharing is disabled

Gnucleus


With the software open, pull down the edit menu (along the top of the window) and choose preferences. This will open the properties window

Click on the item called Share

You should see no directory names listed in the shared directories area. If directories are listed, click on each one and press remove until the box is empty

Click OK

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart Gnucleus and verify sharing is disabled

Grokster

Please note: Grokster will continue running in the background even when all windows have been closed. It should be evident that Grokster is still running by the icon that resides in task tray. To fully exit Grokster, you must right click on the Grokster icon in the task tray and choose exit.

With the software open, click on tools to bring up a drop down menu and choose options.

Click on the traffic tab

In the bandwidth portion of the screen, enter a 0 in the box next to 'You can define the maximum number of simultaneous uploads here'

Place a check in the box next to 'Disable sharing of files with other Grokster members'

Click Apply (If you are able)

Click OK

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart Grokster and verify sharing is disabled

iMesh

Please note: iMesh will continue running in the background even when all windows have been closed. It should be evident that iMesh is still running by the icon that resides in task tray. To fully exit iMesh, you must right click on the iMesh icon in the task tray and choose exit.

With the software open, choose preferences and click options. This will open the options menu.

In the Category box, choose Share

Clear the checkbox next to 'Allow other users to view all my shared files'

Click OK to close the options window

From the main iMesh window, choose the media manager tab. The area to the left of the screen contains a directory tree with gray boxes. A gray box indicates that there is a
shared subfolder. Click on the plus signs to expand the tree until you locate all shared folder(s) that will be denoted with a check in the box.

Remove the check mark from all shared folders. There should no longer be any gray boxes.

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart iMesh and verify sharing is disabled

KaZaA

Please note: KaZaA will continue running in the background even when all windows have been closed. It should be evident that KaZaA is still running by the icon that resides in task tray. To fully exit KaZaA, you must right click on the KaZaA icon in the task tray and choose exit.

On the Tools menu, click Options. This will open an Options window

Click the Traffic tab

In the box that says 'You can define the maximum number of simultaneous uploads here' change the value to 0.

On the same tab, place a check in the box that says 'Disable sharing of files with other KaZaA members'

Click on the Advanced tab

Place a check in the box next to 'Do not function as a Supernode'

Click Apply (If you able)

Click Ok

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart KaZaA and verify sharing is disabled

LimeWire

Please note: When exiting LimeWire a dialog box will appear that allows you to either send the program to the task tray or exit and abort file transfers. If you choose 'Yes, put LimeWire in the system tray', the program will still be active and sharing files if you have not disabled shared directories.

To disable file-sharing in the Windows and Mac versions:


With the software open, choose Tools and select Options from the drop-down box. This will open the options window.

Choose Sharing

The window to the right called 'shared directories' must be empty. Choose shared directories that exist and click remove until the box is empty.

Just below, in the shared extensions area, clear the box so that it too is empty

Click on Uploads

In the box next to Max Upload slots, enter 0

Move the slider bar for Upload Bandwidth to 0% (fully to the left)

Click Apply (If you are able)

Click OK

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart LimeWire and verify sharing is disabled

Mactella

Please note: You will need to disable the 'enable sharing' checkbox each time you start the Mactella software as this setting is not saved.

Remove the check mark from the box entitled 'Enable Sharing'

From the Edit menu, choose preferences and click Connection. This will open the connection preferences window

In the 'bandwidth use' portion of the window, move the Uploads slider all the way to the left

Click on 'More Settings' to expand the screen to include all options

Under 'Push Packets' choose Routed

Click OK to close the connection preferences window

From the Edit menu, choose preferences and click transfer. This will open the transfer preferences window

Place a check in the box for Queue downloads

Click OK

Exit the program entirely

Restart Mactella and verify sharing is disabled (remember that the 'enable sharing' checkbox will need to be changed each time you start the software)

Morpheus

Please note: Morpheus will continue running in the background even when all windows have been closed. It should be evident that Morpheus is still running by the icon that resides in task tray. To fully exit Morpheus, you must right click on the Morpheus icon in the task tray and choose exit.

With the software open, choose Tools and select Options from the drop-down box. This will open the options window.

Click the Traffic tab

In the bandwidth portion of the screen, enter a 0 in the box next to 'You can define the maximum number of simultaneous uploads here'

Place a check in the box next to 'Disable sharing of files with other Morpheus members'

Choose the Advanced tab

Place a check in the box next to 'Do not function as a SuperNode'

Click Apply (If you are able)

Click OK

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart software and verify sharing is disabled

SwapNut

Please note: SwapNut will continue running in the background even when all windows have been closed. It should be evident that SwapNut is still running by the icon that resides in task tray. To fully exit SwapNut, you must right click on the SwapNut icon in the task tray and choose exit.

With the software open, choose Tools and select Options from the drop-down box. This will open the options window.

Choose Sharing

In the portion of the screen labeled 'file sharing' clear all entries from the extensions box

Choose the Shared tab

There should be no shared directories listed. If there are shared directories, choose each directory and press the remove button.

Click Apply (If you are able)

Click OK

Exit the program entirely by right clicking on the system tray icon and choosing exit

Restart the software and verify sharing is disabled

WinMX


With the software open, choose Shared Files

You should see no directories displayed in the portion of the screen entitled 'File Path. If directories are listed, select each listing and press the Remove Path button until the FilePath box is empty.

From the main window, click on Settings and select Share Settings from the pull down box

Clear all entries from the 'File types to share' box

Click OK

Exit the program entirely

Restart the software and verify sharing is disabled

 

[marc777]

I wanted to thank everyone for their input here.

When I stand back and think about it 180mb uploaded in 3 days is not huge bearing in mind we're on 1MB broadband - and so BT threw me a red herring there!

Thanks for your input Satch. Longest post I ever saw......knew about KaZa but not the others.

I had an IT specialist in on Friday with a sniffer program (etehe....somthing or other) and that determined that over 4 hours (and 5 re-boots of the router) no untoward traffic in or out.

Now over to BT who eventually agreed to come out today to check their bits and pieces. Not off to a good start when all he first suggested was changing the router (we've been there done that twice).

Lets see what the day beholds.

4 weeks of having to re-boot every 40 minutes is getting me down..!

Marc

PS Ordered a CLS 320cdi yesterday (well, letter of intent and £1000 deposit) June 05 delivery. So its not all bad

 

[Alfie]

BT in their infinite wisdom appear to configure their ADSL modems to drop the connection frequently. It is possible that the connection is not coming back up after this has happened. Personally I dont (and wont ever) use BT broadband services. However there are articles on the internet about how to reset this setting so it doesnt hang up. This may fix your problem.

Try going to the http://www.btopenworld/drivers site and updating your drivers.

Alternatively, take a look at EasyNet services. I use a 2MBit synchronous DSL service of theirs which costs £199 per month. Sounds a lot but its 2Mbit both ways, no restrictions on use whatsoever.

Hope this helps.