2

When using a packet sniffer, I notice a lot of packets being sent to a bunch of ISPs (such as axion.ca, wanadoo.fr/orange?, bresnan.net, zebra.lt) usually all at the same time. Here's a screenshot of the hosts in SmartSniff. I happen to live in none of these hosts' countries, so this is very strange.

Is this a normal thing, or maybe a side-effect of an infection?

  • what network processes do you have running? – schroeder Aug 22 '15 at 19:55
  • I'm assuming that the 44947 number in the screenshot is a process number? What is that process? – schroeder Aug 22 '15 at 19:57
  • 44947 is the local port, not a process – Quentin Aug 22 '15 at 20:03
  • 1
    then using netstat, what process is accessing that port? – schroeder Aug 22 '15 at 20:16
  • 1
    @schroeder It seems to be Skype, thanks for the help! – Quentin Aug 22 '15 at 20:34
2

Given the uncommon high ports and that the hostnames look like IP addresses from normal consumers I would suggest that this is peer-to-peer traffic. There are several legal or mostly legal programs which are doing peer-to-peer like Skype, Bittorrent and other file exchange programs. But peer-to-peer techniques are also used by malware like Zeus.

Since it is not known what you deliberitly run on your system one can not decide if these connections are caused by software which you run intentionally or by software which you run unknowingly, i.e. malware.

  • Thanks for the information! I'm on Windows 10, is it possible that this could be something to do with the peer-to-peer updating system? – Quentin Aug 22 '15 at 20:05
  • From the few technical information I've found I would say that it is not related to the updates, but I don't know. Just switch off P2P updates and then you might know. – Steffen Ullrich Aug 22 '15 at 20:07
  • Skype seems to be the culprit, thanks again for the information! – Quentin Aug 22 '15 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.