I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about 200–250MB. This seems to me very suspicious.

I have noticed that a data is constantly sent to Is that OK?

In general, how can identify all processes that are sending some kind of data over Internet on Windows 7?

  • Could it be a key logger with video monitoring ?? Have you tried to scan your Pc for malicious apps ?
    – HSN
    Dec 25, 2012 at 12:17
  • I have tried with "Spybot" (available as a portable app) and scanned my machine with "Avast" anti-virus. There were no any high level threats - only a few tracing cookies. Can you recommend any valuable software tool scanning for such malicious applications?
    – jilt3d
    Dec 25, 2012 at 12:33
  • This question has already been discussed at security.stackexchange.com/questions/20027/…
    – Ali Ahmad
    Dec 25, 2012 at 12:56
  • @AliAhmad: I've used netstat -oa to list all active connection and the PIDs of the services related but I am still not unable to identify the meaning of sending data to In the result list of the command, there is no any entry for the address
    – jilt3d
    Dec 25, 2012 at 13:22
  • 1
    @jilt3d: is a broadcast address and when something is send on this address it is received by all the devices on a same network. Secondly routers are configured to block broadcast traffic.
    – Ali Ahmad
    Dec 25, 2012 at 17:38

3 Answers 3


You could try to use Sysinternal's Portmon to see which process(es) broadcasts on Don't be too alarmed before you see what kind of things are broadcasted.

To see a more precise view of the packets sent/received, use : wireshark.

  • I am not able to use "Portmon" under Windows 7 - I followed the instructions to run it on non-network disk with administrator privileges but capture can not be started.
    – jilt3d
    Dec 26, 2012 at 12:31
  • "wireshark" provides a lot of information - more than I need I guess, and it seems it will be harder for me to extract the valuable one. Think, it will be easier and more reliable solution to re-install my OS to get rid off any potential harmful applications installed on my machine. I will play a bit more with these tools, and if there is any progress I will update the thread.
    – jilt3d
    Dec 26, 2012 at 13:00
  • It is probably wiser indeed. However, you can "filter" things with Wireshark, but you should probably ask your local nerd to have a look at it, or spend quite a lot of time in search engines or reading its documentation... I could help with specific questions. To get you started with wireshark: on top, there is a "filter" you can use to filter down the packets: enter in it "ip.dst==" and you'll see packets sent to this destination (note however that there are more broadcast adresses, the others depending on your local network configuration) (and many legit broadcasts) Dec 26, 2012 at 13:22
  • Well, I did a factory restore to the system from a special partition, just to be on the safe side and get rid of any potential malwares, but now I am getting a strange error at the Windows 7 startup. Here you may want to check the details: security.stackexchange.com/questions/26115/…
    – jilt3d
    Dec 28, 2012 at 15:10

I recommend the built-in Windows 7 functionality.

Bring up your task manager by pressing ctrl + shift + esc then click the Performance tab. From there you will see a Resource Monitor button towards the bottom. Click that and then click the Network tab on the new window that opens.


I think you need to debug some of your installed applications generating broadcast traffic.You can compute your broadcast address by replacing all the host bits with 1s i.e If your network is, then your network address will be and your broadcast address will be is physical layer broadcast address and is a network layer broadcast address. You need to identify application using your network layer broadcast address not physical broadcast address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .