Heavy Data Usage

[#1]

Thanks Harry. As you can see there are a number of connections to addresses 88.221.84.72 and 88.221.84.17 on port 80 and so whilst we can assume that these are likely HTTP (web) connections unfortunately the addresses don't give much away themselves because they belong to Akamai who are a global content delivery network and effectively act as mirrors for other (usually large) sites.
If you're feeling up to it I think a network capture using Wireshark would be helpful as we would then be able to peek inside the packets to see what the actual traffic is, in particular what sites are being requested via Akamai. Happy to walk you through doing this if you like.
Mathew

[#2]

It appears that Akamai have started using P2P
Have a read here http://stream-recorder.com/forum/akamai-netsession-interface-and-disalbe-t7217.html

[#3]

As I said in my reply earlier...

Quote

Some of the dos based tools can tell you what is using the network. Try netstat -ano which shows open / waiting ports. The -o also shows the PID which you can find the process in question in process explorer.

With the PID you can find what process is using each of the network connections

[#4]

Ah, yes, that does make eminently more sense!
Mathew

[#5]

You do not seem to be able to send Wireshark files in their native format, so I have created a PDF of the file; it has a lot of pages, hopefully it makes sense to you. I was trying to get a PDF with the expanded information, but it is proving difficult to get the file size down to under 4096Kb, but if you need it in that form, I will do a shorter scan.
I have checked for the presence of Akamai on the computer using the information obtained by following the link from oldjim, but it does not seem to be on the computer.

[#6]

Quote from: HarryR

You do not seem to be able to send Wireshark files in their native format

You can save the dump in a libpcap file; a standard file format that can be read by most packet analysers.
However, Peter's suggestion of finding the PID's, and presumably identifying the named processes with task manager (I don't use Windows much not sure if there's a CLI equivalent), would likely cut to the chase.
From a quick glance at the PDF there seems to be a regular sequence of local UPnP traffic but the native libpcap dump will give a better indication of how much a proportion this represents.
Mathew

[#7]

I hope that Wireshark capture tells somebody something because I (without the benefit of Wireshark experience) cannot make out anything more than ongoing communication with Akamai.
Have you tried closing the Windows sidebar?  Many of the gadgets update themselves by communication with an internet server so a faulty gadget might conceivably run amok and start demanding huge quantities of data. 

[#8]

If you search the PDF file for "HTTP GET", you see this:
No.      Time              Source              Destination      Protocol      Info
26      0.089999      192.168.0.2      88.221.84.72      HTTP GET /defs/dm/symcdefsi3264.exe HTTP/1.1
183      1.278020      192.168.0.2      88.221.84.72      HTTP GET /defs/dm/symcdefsi3264.exe HTTP/1.1
339      2.466048      192.168.0.2      88.221.84.72      HTTP GET /defs/dm/symcdefsi3264.exe HTTP/1.1
It repeats at regular intervals. My guess is that Norton (Symantec) has got stuck in a loop and is downloading updated definitions over and over and over again, but never manages to install them correctly.

[#9]

If it's Norton, I recommend using the Norton removal tool http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN&ln=en_US to completely uninstall it then download and install the latest version.  This is usually a remarkably painless process.  However I would have thought it is perfectly normal for security software to check for updated definitions at regular intervals.

[#10]

Quote from: ReedRichards

However I would have thought it is perfectly normal for security software to check for updated definitions at regular intervals.

This is every second though, at least for the 20s snapshot window that we've been given.
Mathew

[#11]

Here is the netstat –ano capture how do you decode the PIDs?

[#12]

You could use TCPView instead from sysinternals: http://technet.microsoft.com/en-gb/sysinternals/bb897437

[#13]

I have managed to get a workaround of the problem. By creating a new user profile, there is not any heavy data traffic so far, but the heavy data traffic remains on the old profile. Does this eliminate any of the suggested problems? Should I continue to try to solve the original problem or just delete the problem profile?

[#14]

Peer-to-peer applications like Limewire usually run on a per user basis, as does the Windows sidebar but Norton does not.  So I would say this could support my theory of an errant sidebar gadget but not ejs' theory of Norton malfunctioning. 

[#15]

I suggest comparing the running processes on the two profiles as shown by Task Manager  - that should point to the problem