Netstat Findings

[EMPshockwave82]

I have been seeing some weird activity of the upload / download sort. Using DUMeter the color RED is me downloading information packets from other sources and green is other people accessing my computer to download information packets.

I have been seeing fairly large numbers in the green (upload) area recently. A constant 30kB/sec as a matter of fact.

running a netstat I contine to find that *.level3.mail.yahoo.com and 216.239.41.99 seem to be the culprits in my little problem

My question then is this:
Does anyone know about these addresses?

mta-v5.level3.mail.yahoo.com:smtp
216.239.41.99:http
mta-v4.level3.mail.yahoo.com:smtp

 

[PTCvette]

Well, doing a whois on from ARIN on 216.239.41.99 gives me this:

Search results for: 216.239.41.99

OrgName: Google Inc.
OrgID: GOGL
Address: 2400 E. Bayshore Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US

NetRange: 216.239.32.0 - 216.239.63.255
CIDR: 216.239.32.0/19
NetName: GOOGLE
NetHandle: NET-216-239-32-0-1
Parent: NET-216-0-0-0-0

So I don't think google is causing all this traffic... THIS is where I did the search on that IP address... The other 2 look legit enough as just regular old yahoo, but I am at work, and don't have time to look them up.

Jeff

 

[PTCvette]

Actually I pinged that yahoo one and got this IP: 67.28.113.11... It looks like it is in Yahoo's range according to ARIN:

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Avenue
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 67.28.112.0 - 67.28.115.255


Are you running any kind of firewall on the computer? If not, either turn on the windows firewall and see if that slows anything down, or grab the free zone alarm and see what it gives you as far as info on your traffic goes. Windows firewall can keep a log of blocked stuff, so that would tell you what's trying to get in and out.

Jeff

 

[DJanish]

i was having a similar problem as well.

 

[fractilian]

Are you running the yahoo or google toolbar in your browser? What about yahoo instant messenger?

 

[PTCvette]

Yeah that's kind of what I was thinking too. Maybe one of the toolbars or yahoo messenger? Seems like neither one of those would generate the kinds of traffic you are seeing though.......

 

[spidey07]

Also I thought the Nagle worm's hit google and opened mail servers?

Make sure your AV is up to date and run a full scan.

 

[EMPshockwave82]

Originally posted by: spidey07
Also I thought the Nagle worm's hit google and opened mail servers?

Make sure your AV is up to date and run a full scan.

been there... done that x 4

updated norton and then ran virus scan in safe mode with no findings

 

[PTCvette]

Running any firewall stuff on there? The logs should show you something...

Jeff