PC has 10 times more LAN traffic than all the rest 1

[dougdemick]

In my office network of Win2K computers, one PC sends and receives 10 times more network traffic than its closest competitor. How can I find out what is causing this traffic? I have researched all the processes that are running and found nothing unusual. Norton Antivirus and Spybot both come up clean.

To determine network traffic since last reboot, I click start/settings/network & dialup conn/local area connection.

My switch is a Dell Powerconnect 2024. Router to internet is a Linksys BEFSR41. I have not found a way to get traffic statistics out of either one.

Thanks for any help you can give.

 

[Auger282]

how do you know its sending more traffic? .. whats your measuring device?


you can use programs like ethereal (free packet sniffing program) to find out whats going on perpacket...

google it

 

[bcastner]

One thing to be careful of in using perfmon statistics on packets sent/received is that these are reported by the device driver for the network adapter, not by Windows. The problem is that some device drivers reports packets, some report bytes, and some even report bits. This makes comparison on other than identical network adapters with identical drivers nearly impossible. (I have a Sony VAIO notebook that reported bits before I updated the driver.) A great deal of network administrator time has been wasted on this issue. See:

http://support.microsoft.com/default.aspx?scid=kb;en-us;296669

 

[dougdemick]

Thanks, bcastner, for the great info. Follow-up question: when Windows' "Local Area Connection Status" reports traffic in bits or bytes, does it label the numbers accurately, or does it still call them "packets" even though they're really bits or bytes?

 

[bcastner]

It always uses packets, hence the confusion.

 

[chriseubank]

I would check netstat -an and see if there is a large number of strange connections happening there..

Aside from that, hooking up a promiscuous network sniffer on the same network might tell you where the traffic is at least coming from/to (assuming you can read it)

C

 

[dougdemick]

Thanks, everyone, the problem is solved! Bcastner solved it for me. On this PC, the NIC device driver was giving stats in BYTES instead of packets like the rest of the PC's in the office. Therefore the numbers were really big, but the actual traffic is not out of line.