BITS eating my quota

rolf

I have a 200 megs daily quota, and it constantly gets exhausted, even if I do nothing!
I thought I had some deep spyware on my computer (system process keeps connecting to weird addresses), so I entered all these addresses in the hosts files and pointed them to some bogus IP (1.1.1.1). I dont know exactly where they come from, but I dont like having my computer do this.
Some look legit, there is even addresses like f-1-118.google.com...
Maybe these are connections to ad servers or something, in any case I dont think its a big loss.
Yet turned out my bandwidth problem came from somewhere else,
The BITS service (Background Intelligent Transfer Service) was doing that, althought it was set to manual, and windows update is off. I set it to disabled, now and it took care of the problem. This service is a bit too "intelligent" for my taste.
I dont care if my software is outdated. If it stops working ill just wipe windows and install OSX with parallels (for visual studio and co.) or Linux.
The major problem with this BITS thing is that it doesnt let you know which applications have requested downloads.

Xsever

Good solution rolf! Nice and clean!

BashLogic

/ me flames ROLF for a half baked cake!
- yes BITS does that.
- concept is correct, but the implementation is wrong! what im trying to say, do not point to 1.1.1.1 as that will only get directed to the internet and waste resources on your external IP connection. use 127.0.0.1 instead as that would use the localhost loop! actually anything under 127.0.0.x (not really but in general) should work!!

rolf

BashLogic wrote/ me flames ROLF for a half baked cake!
- yes BITS does that.
- concept is correct, but the implementation is wrong! what im trying to say, do not point to 1.1.1.1 as that will only get directed to the internet and waste resources on your external IP connection. use 127.0.0.1 instead as that would use the localhost loop! actually anything under 127.0.0.x (not really but in general) should work!!

I thought about that, but I thought back then that it would be preferrable to send it to a dead internet address, so that the response is not immediate. The idea is that it will send a packet and then wait for like 3 minutes for an answer that will never come (evil grin).
I didnt even try to ping 1.1.1.1, I assumed that it was dead, and indeed it is.

rolf

seriously, who owns that IP? :D

rolf

inetnum:      1.1.1.0 - 1.1.1.255
netname:      test
descr:        test................
descr:        ............
country:      CN
admin-c:      DY1-CN
tech-c:       DY1-CN
mnt-by:       MAINT-CNNIC-AP
status:       ALLOCATED PORTABLE
changed:      ipas@cnnic.net.cn 20051212
source:       CNNIC

Somewhere in China....

Xsever

Hey rolf,

I am just wondering which software you used to monitor where the bandwidth is going.

Please let me know.

Thanks,

rolf

After this thing happened, I found NetLimiter. It is free and monitors the bandwidth usage of every process (application) and saves them for monthly/weekly/daily statistics.

Xsever

I got the pro version. If you want it, let me know.

TheIlluminative

you can use netmeter also :D it's Free

rolf

What about linux?

TheIlluminative

Linux ? shu Fedora 11 or ubuntu

Try nvStat : http://humdi.net/vnstat/

rolf

Thanks. ubuntu...
In the aspects that interst me, NetLimiter is superior to these. I havent found anything that shows you bandwidth usage per process, and most are command line which is kinda ugly.

EDIT.. Oh well I found something called nethogs which gives bandwidth usage per application. Crazy how u can find almost everything on linux, but its seldom a complete product... this is good i just wish it would also save this data for statistics. Still cool though.

crazy

On windows :)

Right click on your taskbar ---> Taskmanager ---> Performance ---> Resource Monitor (down to the right) Then click on the Network button. Tadaaaa you can see what is running on your network/internet connection.

teodorgeorgiev

rolf wroteWhat about linux?

iptraf for realtime monitoring is the best thing ever :)

when you see ports, then you can check with netstat -anp or fsock which "program" is using that particular port.

hussam

teodorgeorgiev wrotewhen you see ports, then you can check with netstat -anp or fsock which "program" is using that particular port.

Everything is so much easier under Linux :)

beezer

I actually noticed that Windows 7 ran slower when I was in Lebanon, it was very dependant on internet speed. I think cause of all the feedback crap that it keeps sending though.

rolf

teodorgeorgiev wrote
rolf wroteWhat about linux?
iptraf for realtime monitoring is the best thing ever :)

when you see ports, then you can check with netstat -anp or fsock which "program" is using that particular port.

Thanks. Iptraf is good.
But for desktop monitoring, with what I had under windows (netlimiter) you could leave the computer on all day, then if you come
at night and see that it downloaded 300 megs on its own, then you can see in netlimiter which program did all this downloading. It keeps usage statistic for every process.
On the other hand, Linux doesnt normally do such things (download stuff without asking). Still, it would be nice to have that control.
I had written a curl console script for linux that read squid internal counters and printed in realtime how much bandwidth every IP was using through the squid proxy, if you happen to need that. Ill have to find it though...

hj88

does any of you know what is BITS downloading if you have windows update off ?

and is it possible that part of the traffic is just local network

rolf

hj88 wrotedoes any of you know what is BITS downloading if you have windows update off ?

no
It is really hard to monitor because that thing apparently starts working when the computer is idle...

hj88 wroteand is it possible that part of the traffic is just local network

yes

I think that BITS can be used by programs. Such as MSN maybe...