cable modem constantly receiving packets

[Bursar 0]

I wasn't sure if I should post this here or in the Networking forum. I'm sure someone will move it if it's in the wrong place.

 

I have a Motorola SurfBoard 3100 cable modem hooked up to a 3c905b-tx NIC on my PC running XP Pro with all patches installed. I use NTL as my provider.

 

Recently I've noticed that the cable modem is receiving data almost constantly. If I watch the stats for the NIC, I can see the data going up. The size of the increase varies. Sometimes it's just a few bytes, and other times it's 500 or so bytes.

 

The modem also seems to be receiving data when the PC is off, so I don't suspect it's a Windows process that is grabbing data from somewhere. It's not any other machine on my home LAN, as they are currently switched off and the data is still coming in.

 

What I really need to be able to do is monitor the data as it's coming into the cable modem so I can see where it's coming from and what it is.

 

I've tried a couple of utilities and they don't really seem to have the right functionality.

 

Can you guys suggest any free utilities (or ones that are available as fully functioning demos) that I could use?

 

Or failing that, do you have any ideas what could be happening? I don't want to call NTL just yet as I suspect their tech support will be more or less useless on this matter unless I have a few facts and figures of my own.

 

Any advice would be appreciated, as this is really starting to hack me off as it's affecting my ability to surf the web.

 

Cheers.

[Jerry Atrik 0]

i have the same modem

does the same thing

mostly it's the cox network keeping tabs.

[adamvjackson 0]

Same modem here, always have activity on the RJ-45 LED, regardless of whats currently connected or powered on.

[CyberGenX 0]

Have gone thru that modem and 2 other brands, they all do it. Cox told me that it is the "code red" virus and other variants. Also it is broadcast signals from the network devices and dhcp renewals. And lastly if you have any spyware installed on your computer then you are sending data as well. :x

[Bursar 0]

I'm not sending data. Only receiving. I can see basically what's going on just by looking at the stats for the network card.

 

I'm having real trouble browsing at times, and I just have a feeling that it's partly related to the constantly incoming data stream.

[tweaked 0]

With Road Runner they assign you a semi-static IP depending on your NIC's MAC address. The only way to change to a diffierent IP address is to change your MAC address.

 

 

So I change the MAC address on my linksys firewall (thereby changing my IP address) on a fairly regular basis to combat this. i have found that different IP's have different amounts of incoming port scan traffic. usually the longer i have an IP directly reflects the amount of unwanted traffic.

[clutch 1]

Odd, with my RR in Wisconsin I get different IPs without the need to swap NICs. Where's yours at? Mine doesn't change too often, but it does change enough to mandate the use of a dynip client.

 

Bursar, have you tried a sniffer to see what's coming in? There are several out there that are free, but here's one that I have tinkered with on occasion:

 

http://www.objectplanet.com/

 

You *might* be able to pick up on the traffic even if it's directed soley at your modem.

[tweaked 0]

Heya Clutch,

 

I'm in kansas, just outside of Kansas City. For the first month i had RR my IP changed a couple times. Then for about 6 months straight my IP remained constant and i started to notice the same problem Bursar is having. After i figured out that an IP address change was the easiest fix, i started to change my IP about once a month. I don't think it ever changes any other time because i run a game server and must send out an email to my clan mates with the new address for our server. If my IP changed with out me changing it, i would hear about it very quickly (and loudly!)

 

I do know that KC is a product testbed for TimeWarner, we get all their new stuff first (HD cable & video on demand rox!), and that KC is not typical of TimeWarner's service.

 

i Run a smallish 10 person BF1942 server on my rr...(with pings around 30) with only 384kbps up that is supposed to be impossible on cable. (bf1942 is a major bandwidth hog). i know guys with a dedicated t1 who can only do 12 people on a good day, so something is definately UNUSUAL about my Cable modem service.

 

Of course, the fact that my computer is about 10 feet away from the fiber to coaxial junction box outside <might> have something to do with that.

 

Bursar?

have you used Kazaa or any other file sharing program?

I have found that even weeks after i have used Kazaa i still have ALOT of incoming traffic.

[clutch 1]

Sweet. When I moved from my apt to my house my d/l speeds went up from around 160KB/s to around 240KB/s to many sites. I usually get a steady 260KB/s for Debian updates (one of my servers is at uchicago.edu, and the other is a debian.org box). News server transfers in PAN are pretty quick too (around 240KB/s). This calculates to roughly 1.9-2.0Mbps, which isn't bad for a 1.5M/384K connection. I also get 45KB/s uploads, which is pretty close to my rated 384K (48KB/s).

[tweaked 0]

With RR your modem is capped at 2.0 mbps, but you are guarenteed at least 1.5 mbps...

 

Sounds like you are exactly where you should be.

 

i have noticed, that of all the Cable modem services, RR seems to have the best upload speed (if not best all around speed)...

 

i know people just 10 miles away stuck with Cox Cable (the names say it all) and they would kill to get anything over 10kBps uploads...

 

On an even more side-tracked subject:

 

I remember back in the 90's when Cable and DSL where not widespread at all, everyone was writing about how DSL would be better for gaming than cable as it was supposed to have less latency...

 

But that has been proved to be very very wrong, everyone i know with DSL is happy if they get pings anywhere close to 100 (if they can even connect! HA!)... I am pissed if i ping anywhere above 50. Nobody called that one.

 

:x

[Bursar 0]

I think I more or less sorted it.

 

I had used Kazaa Lite about a week or so before noticing the problem. I had noticed with a different version of Kazaa that I was getting lots of incoming traffic.

 

I flushed my IE cache and my DNS cache, updated my hosts file with a huge list of ad sites (all pointing to 127.0.0.1) and that seems to have done the trick.

 

It also gives me the benefit of almost completely ad-free browsing now

[clutch 1]

All of my friends that have had DSL have been unhappy in general, and the only service that's performed worse has been wireless contention-based setups (like Sprint Broadband). Although SBB users have mentioned getting huge download speeds (5-8Mbps!), the performance swings wildly under load, latency is bad enough to make many apps like VPNs and PCAnywhere fizzle out, and they are prone to outages. I really wanted DSL because I remember how it was supposed to be a lot better than cable, but when I was finally able to get it I just haven't wanted to switch.