how to know if I'm getting hammered ?

[minoukat]

OK, this is really strange. I've got 3 computers networked, all three accessing the internet through my Linksys router. The problem is, lately, the connection's been slowing down to almost a stop (like, 5 minutes to load Google.com ...). This isn't right, as I have 1.5Mbps down and 320Kbps up ... So, I should really be getting some better speeds than this. The only fix I've found up to now was to go into the setup utility for the router, and disconnect it from the internet, wait a few seconds and reconnect, to flush the IP address and get me a new one (ADSL ) Anyways, does anyone know what could be causing these slow-mo spikes ?

Also, I just installed ZoneAlarm, thinking it might be someone trying to get into my stuff (why, I don't know ... lol), but there hasN,t been anyhting out of the ordinary in the firewall log, so now, I'm out of ideas.

 

[eaglescouter]

Have you checked your system for spyware? You could have loads of (junk) using up your bandwidth.

Consider running spybot search and destroy to clean it all out and see if you see a difference.

I did this on my brothers machine at Thanksgiving and the difference was amazing. Kind of surprising what 500 pieces of spyware will do to slow down a system.

Link to free spybot download

 

[minoukat]

My system's clean, I did an Ad-aware 6 and SB S&D raid and killed all the junk running not even a week ago. (I only had some cookies and some crap, no hundreds of spy programs checking my stuff)

 

[XWRed1]

Run a sniffer between the computers and the router, see if any of them are spewing junk.

It'd be nice if the router was a real computer, then you could run a sniffer on that and see if is getting hammered or not. I have comcast at home, when I run my sniffer there I'm seeing tons of arp spam, but it doesn't affect my speed.

 

[minoukat]

Run a sniffer between the computers and the router, see if any of them are spewing junk.

It'd be nice if the router was a real computer, then you could run a sniffer on that and see if is getting hammered or not. I have comcast at home, when I run my sniffer there I'm seeing tons of arp spam, but it doesn't affect my speed.

How do I do that ? Which programs would I need ?

 

[XWRed1]

Tcpdump is what I'd use.

http://www.tcpdump.org/

 

[jajmon]

sounds like this to me,,,,,,,,,,,,

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html


reeks havec on the lan with icmp packet traffic, and will slow the lan to a crawl. I know from experience.

 

[SniperXX]

sounds like this to me,,,,,,,,,,,,

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html


reeks havec on the lan with icmp packet traffic, and will slow the lan to a crawl. I know from experience.

I know too from a lanparty. Someone brought it and only infected once comp out of 30, most guys stay updated for that reason. But that one pc hammered our DSL line soo much using the net was pointless, even aim couldnt stay connected.

 

[mbentley]

i would run one of the free online virus scan programs. i would suggest microtrend's online scan. check it out:

http://housecall.trendmicro.com/housecall/start_corp.asp

 

[dagamore]

your system may not have any spy ware(from compaines) but it might have one of the many worms on it spamming the network (or worse two of them do, and they are spamming eachother) things to try.

make sure windows is up to date with all the Service Packs and security fixes.

install and update a good anti-virus, you can find Norton anti virus at most computer stores for like 20 bucks, look for 2k1 or 2k2

 

[XWRed1]

I know too from a lanparty. Someone brought it and only infected once comp out of 30, most guys stay updated for that reason. But that one pc hammered our DSL line soo much using the net was pointless, even aim couldnt stay connected.

This has been happening lately at the lan parties I help run, but I catch the guys pretty quick at the nat/firewall box and drop their traffic, then have them get virus scanned and then patched.

At any rate... putting a sniffer on the network somewhere should reveal the traffic abuse.

 

[cf79]

sounds like this to me,,,,,,,,,,,,

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html


reeks havec on the lan with icmp packet traffic, and will slow the lan to a crawl. I know from experience.

Had that one a couple weeks ago (found it in Norton). Made a big diffrence in my upload speed (considering that it was using 100% bandwidth). Discovered it after I noticed unusual ICMP traffic (normally upload 64k. This work was upping 1.3 meg/sec )

Run a virus check. A detailed one.

 

[amazon10x]

Yes, definitely sounds like a worm, to check if it is the Welchia worm, open Task Manager and go to the Proccesses (sp?) tab, if a file called DLLHOST.EXE is running or just DLLHOST then you have the Welchia worm. You can get the free removal tool from Symantec at there site.

 

[bk94si]

I had a similar problem last week. My wife had plugged in another phone with no dsl filter. All is well now...