Ethernet Busy - No reason for that

Win 10 Pro version 2004 (with all updates). For at least 2 days now my ethernet connection is quite busy - send around 2 Mbps, receive around 4 Mbps. Can't find any program doing the work. It continues even after stopping my applications (primarily Chrome, LibreOffice, KeePass and iDrive (for backups)). Restarting the PC doesn't help. Power cycling the modem and router didn't help. This ethernet activity is not a performance issue. I do not use wi-fi on this PC, only an ethernet connection.

I'm pretty much at a loss as to what to do next.

-- Larry

thomaseg1 - turning off sync didn't help. Can't see that programs or hardware are looking for updates - and why would that go on for such a long time - 3 days now.

Jacee - I disconnected the modem and router from power (pulled their power cables) for several minutes. No help.

-- Larry

- - - Updated - - -

I shut down the PC for a couple hours and then started it up again. After a few minutes the ethernet connection got real busy again. I keep wondering what is being sent and received and where all the received data is going. Once started the transfers continue as long as the PC is powered up. That adds up to a lot of data over several days of activity.

Hoping someone can come up with more suggestions.

-- Larry

Try Nir Sofer's small, free, portable LiveTcpUdpWatch. It's a very simple/easy way of seeing all network/internet activity - including process names and filepaths - using your ethernet adapter. You can sort the columns to show what's using most bandwidth.

Note that there are 2 versions - one for 64-bit Windows and the other for 32-bit - so make sure you download the version that matches your Windows system.

Unzip the download then right-click on the LiveTcpUdpWatch.exe file and choose Run as administrator.

Read the tool's article and/or helpfile for valuable info about how to use it - for example, how to show country/city information for remote IP addresses.

Scroll across the GUI to see the wealth of information provided by each column. You can drag the columns to whatever order you find most helpful and click on column headers to sort results.

Hope this helps...

RickC, I'm running the app now. What's amazing is that today I'm not seeing the high ethernet activity but I'm running LiveTcpUpdateWatch anyway. There is some ethernet activity but it's quite small compared to what I was seeing the previous several days. Little bursts every few seconds then nothing in between bursts.

I'll keep monitoring.

Cheers,
Larry

Unexplained network activity that stops when a network monitoring tool is used and returns after the network monitoring tool is ended is sometimes/often an indication of malware (which 'watches' for well-known processes of monitoring tools and temporarily pauses itself to avoid detection).

Are you confident the device is clean?

Hope this helps...

I stopped running LiveTcpUdpWatch a couple days ago. Network activity went down when I stopped that app. There is always some activity - a short send of about 10Kbps and a short receive of about 20-30Kbps every 10 seconds or so. Maybe this is normal. I just looked at the network traffic on my other PC (using same router but WiFi connection) and it has similar activity.

Not sure what "normal" network activity should be when no apps are doing anything other than sitting there.

-- Larry

larrymcg said:

Maybe this is normal. I just looked at the network traffic on my other PC (using same router but WiFi connection) and it has similar activity

IMO Windows 10 is noticeably 'chattier' than previous Windows versions. To get an idea of what is causing the short sends and receives every 10 seconds you could use Sysinternals/TechNet's Process Monitor (ProcMon) and filter just on Network activity. It's a marvellous utility but does have a bit of a learning curve.

Alternatively, you could use Nir Sofer's CurrPorts. It's very easy to use and - very usefully - can be set to save activity to a log file. I used it to monitor a clean install of Windows 10 with NO apps installed or running and was very surprised at Windows 10's 'heartbeat' of network connections to internet endpoints with no intervention from me.

So... yes, Windows 10 is a real 'chatterbox'. Gone are the days when Windows sat there and did nothing when you weren't working on it. ProcMon will show you in seconds the massive amount of activiity going on every minute of a system that apparently is doing nothing.

Hope this helps...

RickC,

Thanks for you help. I've used ProcMon from time to time over the years. Since the activity has settled down Procmon didn't really show much of interest.

I'm declaring this topic done! Thanks for the help understanding what's going on with Windows.

-- Larry