2

When using a packet sniffer, I notice a lot of packets being sent to a bunch of ISPs (such as axion.ca, wanadoo.fr/orange?, bresnan.net, zebra.lt) usually all at the same time. Here's a screenshot of the hosts in SmartSniff. I happen to live in none of these hosts' countries, so this is very strange.

Is this a normal thing, or maybe a side-effect of an infection?

6
  • what network processes do you have running?
    – schroeder
    Commented Aug 22, 2015 at 19:55
  • I'm assuming that the 44947 number in the screenshot is a process number? What is that process?
    – schroeder
    Commented Aug 22, 2015 at 19:57
  • 44947 is the local port, not a process
    – Quentin
    Commented Aug 22, 2015 at 20:03
  • 1
    then using netstat, what process is accessing that port?
    – schroeder
    Commented Aug 22, 2015 at 20:16
  • 1
    @schroeder It seems to be Skype, thanks for the help!
    – Quentin
    Commented Aug 22, 2015 at 20:34

1 Answer 1

2

Given the uncommon high ports and that the hostnames look like IP addresses from normal consumers I would suggest that this is peer-to-peer traffic. There are several legal or mostly legal programs which are doing peer-to-peer like Skype, Bittorrent and other file exchange programs. But peer-to-peer techniques are also used by malware like Zeus.

Since it is not known what you deliberitly run on your system one can not decide if these connections are caused by software which you run intentionally or by software which you run unknowingly, i.e. malware.

3
  • Thanks for the information! I'm on Windows 10, is it possible that this could be something to do with the peer-to-peer updating system?
    – Quentin
    Commented Aug 22, 2015 at 20:05
  • From the few technical information I've found I would say that it is not related to the updates, but I don't know. Just switch off P2P updates and then you might know. Commented Aug 22, 2015 at 20:07
  • Skype seems to be the culprit, thanks again for the information!
    – Quentin
    Commented Aug 22, 2015 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .