Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about 200–250MB. This seems to me very suspicious.

I have noticed that a data is constantly sent to 255.255.255.255. Is that OK?

In general, how can identify all processes that are sending some kind of data over Internet on Windows 7?

share|improve this question
    
Could it be a key logger with video monitoring ?? Have you tried to scan your Pc for malicious apps ? –  HSN Dec 25 '12 at 12:17
    
I have tried with "Spybot" (available as a portable app) and scanned my machine with "Avast" anti-virus. There were no any high level threats - only a few tracing cookies. Can you recommend any valuable software tool scanning for such malicious applications? –  jilt3d Dec 25 '12 at 12:33
    
This question has already been discussed at security.stackexchange.com/questions/20027/… –  Ali Ahmad Dec 25 '12 at 12:56
    
@AliAhmad: I've used netstat -oa to list all active connection and the PIDs of the services related but I am still not unable to identify the meaning of sending data to 255.255.255.255. In the result list of the command, there is no any entry for the address 255.255.255.255. –  jilt3d Dec 25 '12 at 13:22
1  
@jilt3d: 255.255.255.255 is a broadcast address and when something is send on this address it is received by all the devices on a same network. Secondly routers are configured to block broadcast traffic. –  Ali Ahmad Dec 25 '12 at 17:38

3 Answers 3

I think you need to debug some of your installed applications generating broadcast traffic.You can compute your broadcast address by replacing all the host bits with 1s i.e If your network is 192.168.1.0/24, then your network address will be 192.168.1.0 and your broadcast address will be 192.168.1.255. 255.255.255.255 is physical layer broadcast address and 192.168.1.0/24 is a network layer broadcast address. You need to identify application using your network layer broadcast address not physical broadcast address.

share|improve this answer

You could try to use Sysinternal's Portmon to see which process(es) broadcasts on 255.255.255.255. Don't be too alarmed before you see what kind of things are broadcasted.

To see a more precise view of the packets sent/received, use : wireshark.

share|improve this answer
    
I am not able to use "Portmon" under Windows 7 - I followed the instructions to run it on non-network disk with administrator privileges but capture can not be started. –  jilt3d Dec 26 '12 at 12:31
    
"wireshark" provides a lot of information - more than I need I guess, and it seems it will be harder for me to extract the valuable one. Think, it will be easier and more reliable solution to re-install my OS to get rid off any potential harmful applications installed on my machine. I will play a bit more with these tools, and if there is any progress I will update the thread. –  jilt3d Dec 26 '12 at 13:00
    
It is probably wiser indeed. However, you can "filter" things with Wireshark, but you should probably ask your local nerd to have a look at it, or spend quite a lot of time in search engines or reading its documentation... I could help with specific questions. To get you started with wireshark: on top, there is a "filter" you can use to filter down the packets: enter in it "ip.dst==255.255.255.255" and you'll see packets sent to this destination (note however that there are more broadcast adresses, the others depending on your local network configuration) (and many legit broadcasts) –  Olivier Dulac Dec 26 '12 at 13:22
    
Well, I did a factory restore to the system from a special partition, just to be on the safe side and get rid of any potential malwares, but now I am getting a strange error at the Windows 7 startup. Here you may want to check the details: security.stackexchange.com/questions/26115/… –  jilt3d Dec 28 '12 at 15:10

I recommend the built-in Windows 7 functionality.

Bring up your task manager by pressing ctrl + shift + esc then click the Performance tab. From there you will see a Resource Monitor button towards the bottom. Click that and then click the Network tab on the new window that opens.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.