mystery traffic

john coley · 23-04-2011, 11:58

Hi everybody, I'd like if I may to pick the brains of VM techs on here. A mystery has

recently come to my attention that, try as I might I can't fathom. VM, including the guys at

Albert Dock haven't been able to give me an answer. Could I have your thoughts.
I am a blind person. I live alone, and nobody else has access to my computer. I have the

50 meg service. I'm not a heavy user. For example, this week I've downloaded four files,

totaling about 70 megs. Both computer and modem are switched off for most of the day. I

don't use a router. I'm not wireless, I'm just plugged directly into my modem. I switched

over from the 20 meg service two years ago owing to lousy service, which VM put down to

heavy demand on the UBR.
Everything's been fine since switching in that respect.
That's the background. Now to the mystery. At the beginning of last week there was an

outage. Luckily service came back on within the day. There was a second outage on Wednesday.
When talking to one of the techs two days later on Friday he happened, in passing, to

refer to me as a heavy user. I said I wasn't. He said that I'd downloaded so far this month

748 gigs, which is a massive amount by any standard, especially since I'm not a gamer, I

don't stream, other for the occasional audio podcast. I was, and still am concerned about

it. Ok, it doesn't seem to bother VM, as there isn't a cap on 50 meg, but it concerns me as

I'm not responsible for it, and there's something wrong somewhere.
I'm scrupulous when it comes to computer security and housekeeping, so I know I haven't

got a nasty.
I asked the guy how long it had been going on, and he said it had been the same last month

as well. It's not just the downstream that's through the roof, it's upstream as well.
I asked if they could investigate, and identify the traffic, what websites were involved

and whatever, and he said they didn't have that information.
Could you let me have your thoughts on it. I'm completely foxed.
Incidentally, it's ages since I posted on here. I hope I've done it right.
Thanks,
John.

scrooge · 23-04-2011, 12:12

You have an outgoing firewall to show connections/traffic when online?

john coley · 23-04-2011, 12:40

Hi Scrooge, my only firewall is the windows XP firewall. I don't know if it's possible to get a report of traffic.
thanks for the quick reply,
John.

jb66 · 23-04-2011, 12:42

Change your wireless password

Toto · 23-04-2011, 12:45

Quote:

Originally Posted by john coley

Hi everybody, I'd like if I may to pick the brains of VM techs on here. A mystery has

recently come to my attention that, try as I might I can't fathom. VM, including the guys at

Albert Dock haven't been able to give me an answer. Could I have your thoughts.
I am a blind person. I live alone, and nobody else has access to my computer. I have the

50 meg service. I'm not a heavy user. For example, this week I've downloaded four files,

totaling about 70 megs. Both computer and modem are switched off for most of the day. I

don't use a router. I'm not wireless, I'm just plugged directly into my modem. I switched

over from the 20 meg service two years ago owing to lousy service, which VM put down to

heavy demand on the UBR.
Everything's been fine since switching in that respect.
That's the background. Now to the mystery. At the beginning of last week there was an

outage. Luckily service came back on within the day. There was a second outage on Wednesday.
When talking to one of the techs two days later on Friday he happened, in passing, to

refer to me as a heavy user. I said I wasn't. He said that I'd downloaded so far this month

748 gigs, which is a massive amount by any standard, especially since I'm not a gamer, I

don't stream, other for the occasional audio podcast. I was, and still am concerned about

it. Ok, it doesn't seem to bother VM, as there isn't a cap on 50 meg, but it concerns me as

I'm not responsible for it, and there's something wrong somewhere.
I'm scrupulous when it comes to computer security and housekeeping, so I know I haven't

got a nasty.
I asked the guy how long it had been going on, and he said it had been the same last month

as well. It's not just the downstream that's through the roof, it's upstream as well.
I asked if they could investigate, and identify the traffic, what websites were involved

and whatever, and he said they didn't have that information.
Could you let me have your thoughts on it. I'm completely foxed.
Incidentally, it's ages since I posted on here. I hope I've done it right.
Thanks,
John.

Hi John.

It's entirely possible that the agent in Albert Dock got it wrong. 748 Gig is a considerable amount, and if that was going on I think you should have noticed it sooner.

I'd get back to them and ask them to double check their figures.

---------- Post added at 13:45 ---------- Previous post was at 13:43 ----------

Quote:

Originally Posted by jb66

Change your wireless password

He doesn't have a router. It's in his post.

john coley · 23-04-2011, 13:23

Quote:

Originally Posted by jb66

Change your wireless password

Hi jb66, I'm not wireless. I'm plugged directly into my modem.
Thanks,
John.

---------- Post added at 01:23 ---------- Previous post was at 01:09 ----------

Quote:

Originally Posted by Toto

Hi John.

It's entirely possible that the agent in Albert Dock got it wrong. 748 Gig is a considerable amount, and if that was going on I think you should have noticed it sooner.

I'd get back to them and ask them to double check their figures.

---------- Post added at 13:45 ---------- Previous post was at 13:43 ----------

He doesn't have a router. It's in his post.

Hi Toto, if only it was so easy. It's even worse sence VM customer services have updated their auto answering system, if that's the name of it. The only way I've found of getting through to anyone in tech support other than the indian call centre is going through to retentions. It was only because the guy there didn't have an answer he put me through to Albert Dock. They don't make it easy. If you know of a way I could get through to them could you let me know? This thing's really getting to me.
Thanks,
John.

Dai · 23-04-2011, 14:29

There are tools such as TCPview that will show all connections in and out from your pc. However I'm not sure if this would be usable if you are blind. Possibly a screen reader might make sense of the display but I've never had occasion to try something like that.

TCPview

http://technet.microsoft.com/en-us/s...rnals/bb897437

vmfriend · 23-04-2011, 14:35

Do you live with anyone ?

john coley · 23-04-2011, 14:44

Hi David, thanks for that. I've downloaded it, and will give it a try, although whether Jaws can see it, or I can understand it we shall see. I'll report back.
Thanks,
John.

---------- Post added at 02:44 ---------- Previous post was at 02:40 ----------

Hi vmfriend, no. I live alone. Neither are there ever unsupervised visitors to my flat.
Thanks,
John.

vmfriend · 23-04-2011, 14:47

Out of interest are you completely blind ?

The reason I ask is if you are how do you know you are plugged directly into the modem ?

john coley · 23-04-2011, 15:32

Hi vmfriend, I know I'm plugged into the modem for the same reason as I know the pc's plugged into the mains. I think you're underestimating blind people. I am registered blind. I have slight guiding vision from one side, but not enough to read, see a screen or do anything that is reliant on seeing. Most of what I do is done by touch.
Thanks,
John.

---------- Post added at 03:32 ---------- Previous post was at 02:58 ----------

Hi David, I've run TCPView, and Jaws can see it, but I can't make head or tail of it. I imagine it's a list of processes. I've pasted what it says here in case you or anyone can enlighten me.
This is what it says:
alg.exe 576 TCP john 1028 john 0 LISTENING
jqs.exe 1652 TCP john 5152 localhost 1081 CLOSE_WAIT
jqs.exe 1652 TCP john 5152 john 0 LISTENING
svchost.exe 784 TCP john epmap john 0 LISTENING
svchost.exe 848 UDP john.cable.virginmedia.net ntp * *
svchost.exe 848 UDP john ntp * *
svchost.exe 956 UDP john.cable.virginmedia.net 1900 * *
svchost.exe 956 UDP john 1900 * *
System 4 TCP john microsoft-ds john 0 LISTENING
System 4 TCP **.**.***.*** netbios-ssn john 0 LISTENING
System 4 UDP john.cable.virginmedia.net netbios-ns * *
System 4 UDP john microsoft-ds * *
System 4 UDP john.cable.virginmedia.net netbios-dgm * * 1 201 1
Thanks,
John.

Skie · 23-04-2011, 15:39

It may be worth posting on the VM community forums here: http://community.virginmedia.com/ and getting them to clarify how much you have used.

I can't think of anything that could be causing that high a usage level though, you would probably notice if your PC was infected and it was consuming that much bandwidth (but for what?).

DABhand · 23-04-2011, 15:45

To be honest and I may be wrong, but it is possible someone cloned your modem's MAC address and is using it on a chipped modem.

If it is indeed the case, normally I would say get a replacement modem put in for yourself. Of course being registered blind it would be nice of them to get a technician to do it for you as the underside print is hard to see. But.. and a big but.. the 50mb modems no longer are available which would mean you would have to go on a superhub.

Most people don't like the superhub, but it also is a router built in, which comes with it's own firewall. Of course this can be turned off so it just acts as a modem (which I am led to believe from other posts from people who have one).

It is certainly worth trying since you're not a heavy user, and bad days for the customer support who told you to go for 50mb when you don't need it.

Skie · 23-04-2011, 15:50

I was going to suggest a cloned modem, but dont know enough about it to know how it would appear. Makes sense though.

I'd avoid the superhub, but as you wouldn't be using wireless and arent really a heavy user you could probably live with it. Could be worth contacting the CEO's office to complain about the customer service and see if they can provide you with a replacement modem and not a SH.

john coley · 23-04-2011, 16:12

Hi Skie, I'll do that. Incidentally, my PC would not only have shown signs of stress, but most probably self destructed. The PC I use for little things like day to day emailing and surfing, in fact the one I'm using now, is an old Dell, which I use because it's very quiet. It's only a 1.66, and it's only got 512 megs of ram. I don't think for a moment it would be capable of that level of throughput.
Thanks,
John.
I can't think of anything that could be causing that high a usage level though, you would probably notice if your PC was infected and it was consuming that much bandwidth (but for what?).[/QUOTE]

---------- Post added at 04:12 ---------- Previous post was at 04:06 ----------

Hi DABhand, That would be scary. I suggested to the guy that either my IP or MAC address had been fished, and he dismissed it pretty much out of hand. It'd certainly explain this nonsense though. IHave you, or in fact has anyone got a number for the CEO's office.
Thanks,
John.