Constant network activity data being sent at 8-16 Kbps, what is it?!

Ok so this will obviously remain a mystery to me! Last night I decided to turn on Windows Defender Firewall as I always had it disabled since it was annoying to have to add my new games to exception list.

As soon as I turned the Windows Firewall back on the Bolivian IP address vanished from TCP view and this behaviour of constantly sending network activity data of 8-16 Kbps also immediately stopped!

I restarted the computer and it was no longer appearing in the TCP View and the Ethernet is now 0 Kbps.

Anyway this morning no issues as of yet. I decided to make the experiment and Turn off Windows Defender Firewall and it hasn't returned back yet!

I restarted the computer and it's still normal, no signs of it returning back. Last 2 hours I haven't seen any such IP address appearing next to System and Ethernet so far it is showing 0 Kbps.

Yet, yesterday when I was restarting the PC this IP address would not go away. I'm going to have to observe for longer to see what happens or if it will return. I haven't scanned my computer yet for any viruses, the computer looks clean to me. Nothing suspicious running in Task Manager.

- - - Updated - - -

Ok so while this issue has disappeared and no longer shows data being sent for now.

While I stare at the TCPView for 5-20 minutes without any open web browser, I still see on occasions some instances of random IP addresses but these remain for only half a second.

It is so difficult to check Whois... IP because by the time I right click on it, the actually IP address quickly disappears.
I managed to caught this IP address by simply making an immediate print screen 203.195.181.236 - IPInfo
Tencent Cloud Computing (Beijing) Co. Ltd

Then it might take another 5-20 minutes to see the next IP address but that also disappears after half a second.

Is this normal or something to worry about?

When you turn off Windows Firewall all network connection don't need permission from Firewall to communicate with the network its a open gateway where any program can make network connection.

FreeBooter said:

When you turn off Windows Firewall all network connection don't need permission from Firewall to communicate with the network its a open gateway where any program can make network connection.

Right it seems that is indeed the case.

I've also opened all the ports in my router settings using.
DMZ
Placing a host in DMZ has significant implications for its security.
ALL unsolicited traffic not rejected by the firewall will be sent to this device, increasing its vulnerability to attack.

DMZ Enable: Yes

Perhaps that's also the reason why this was happening. Are there any serious security implications from having all ports open and firewall disabled?
I became fed-up of having to port forward for each multiplayer game/application manually, so I decided to have all the ports opened all at once. This is perhaps the reason why I ended up with some random IP addresses trying to connect to my PC.

But I wasn't aware that they are able to connect even with a closed web browser! Maybe I'm making a mistake to disable firewall/or open all ports at once.

After joining new ISP I was frustrated that I had to port forward again in the new router and so I decided to place my IP under DMZ and open all ports at once. And then I turned off firewall.

Unless this doesn't actually directly harm my computer like for example infect me with a virus or able to steal personal information, then of-course maybe this is not a big issue? But of-course I don't know.

Scan your network to see how secure your network is.

GRC | ShieldsUP! — Internet Vulnerability Profiling

FreeBooter said:

Scan your network to see how secure your network is.

GRC | ShieldsUP! — Internet Vulnerability Profiling

I get this..

Greetings! Without your knowledge or explicit permission, the Windows networking technology which connects your computer to the Internet may be offering some or all of your computer's data to the entire world at this very moment!

Regardless of whether my firewall is turned on or off.

On the second test it is, again whether firewall off or on.

THE EQUIPMENT AT THE TARGET IP ADDRESSDID NOT RESPOND TO OUR UPnP PROBES!

(That's good news!)

Did you make sure to scan all service ports?

Did you ever get this figured out? I have the exact opposite. It's on the receive side instead of send. 8-16. Can't find a reason.

dverdier said:

Did you ever get this figured out? I have the exact opposite. It's on the receive side instead of send. 8-16. Can't find a reason.

Hello, sorry for the delay in responding, I was busy with an online course.

Yes, I have figured out the solution for this problem as well. If you have viewed my thread. Constant network activity received at 8Kbps once every 1-3 weeks!?
I figured out that in my case Store Experience Host was responsible for this. When I uninstalled that on January the 9th using O&O AppBuster I didn't have problems ever since.

However, on 5th of May when I initially bought Corsair K55 Pro XT from Amazon UK I noticed this behaviour again! This time it looked like the Microsoft Store is trying to look for an update. This happened every 3-4 days and I knew it wasn't a coincidence because prior that for 4 months never had a single instant.

But I actually returned back the keyboard due to the Alt Gr key having slight cosmetic paint damage. It was peeled off and although I could contact Corsair support for a keycap replacement, I thought that would be a big hassle. I uninstalled the keyboard and returned it back to Amazon for a full refund. I then returned back to my old Microsoft Digital Media Keyboard 3000 and the problem with network activity at startup stopped again last 2 months.

So this suggests that Windows 10 is looking for an update from the Store App causing this trigger! I have not tried diagnosing a solution for the Corsair K55 Pro XT as I wanted to return the keyboard anyway. Though, I'm pretty sure it was looking for some update causing this behaviour. A Store update that is independent from the main device drivers.

Often Windows 10 looks for a Store app and not just the device driver. I think only the Windows 10/11 LTSC version doesn't trigger those behaviours as the Store app is absent from that version.

Delayed is fine as I used an email that doesn't go to my phone, I'm only just now seeing it. When I set up my pc I disabled as many automatic services as I could, and the store was on that list. I don't think that's what it is for me. I'm not sure when it changed but I'm now rec the 8k about every3-4 seconds instead of like a heartbeat. It may go double that time and then pop up with 16. I'm going to look for the tcp thing you used and see if I can figure it out. I still think it's strange you had send and I have receive.