8kbs heartbeat

[dverdier]

Does anyone else have a steady instream of 8kbs? It may skip a beat and do 16 or sometimes it'll skip a couple and jump higher. For the most part it's pretty steady. I can't rem where but I found where someone else had this problem except outbound. No resolve posted. Task man has the network column zeroed out. Any ideas what this small amount of data is and where it is going on my pc?

[Eigenvektor]

What tool are you using to see this incoming stream of data? Which port is it coming in on? What about Resource Manager, does it show anything in the network tab?

[dverdier]

I assume you mean resource monitor. I haven't the faintest how to read that. I found it in the task man. Now I know my pc will do some random talking even if you're not doing anything. I've never seen it do this though. Also in task man, the process tab, network is all 0 when this 8 comes up. I guess it's too small. The only thing I have running in the foreground is edge. I let that calm down then took a photo.

[dverdier]

1 hour ago, Eigenvektor said:

What tool are you using to see this incoming stream of data? Which port is it coming in on? What about Resource Manager, does it show anything in the network tab?

If you click on the photo it will be more legible. Let me know if you see anything in that monitor that doesn't look right. Pls and thx. I should add that I've closed as many tasks as windows will let me and still run and it was still doing this.

Edited July 2, 2023 by dverdier

[Lurick]

It's completely normal, just network chatter which can include anything from various windows processes reaching out to multicast/broadcast traffic on the network, to other programs chatting back and forth. Millions of possibilities but in most cases nothing of note.

[Eigenvektor]

23 minutes ago, dverdier said:

Let me know if you see anything in that monitor that doesn't look right.

…the fønŧ

 

Yeah, I meant Resource Monitor, not Manager. At the very top of it, you can see "Processes with network activity". You can see that e.g. Edge (MSEDGE.EXE) is both sending and receiving data as well as some services (hosted inside svchost.exe). It's likely very mundane stuff like Windows checking whether it is online, programs searching for updates and so on.

 

For example the network icon of Windows can tell you when you have network, but no internet. It most likely does this by periodically checking whether it can reach a specific service on the internet or resolve a host name.

[Falcon1986]

1 hour ago, dverdier said:

 

That font hurts my eyes.

 

I, too, agree that it's likely nothing of concern. Microsoft Update is always doing something. Check your browser extensions.

 

You can run your AV and anti-malware software just to be sure.

[dverdier]

1 hour ago, Eigenvektor said:

What tool are you using to see this incoming stream of data? Which port is it coming in on? What about Resource Manager, does it show anything in the network tab?

Well now I can't close edge. I did it 5 times and it and that fuckin search bar kept coming back. The 6th time it stayed out of task man but still came back in the resource mon. It's just acting weird. I figured it wasn't anything nefarious. It's just doing things it didn't use to. I'll just have to get over it I suppose.

[dverdier]

19 minutes ago, Lurick said:

It's completely normal, just network chatter which can include anything from various windows processes reaching out to multicast/broadcast traffic on the network, to other programs chatting back and forth. Millions of possibilities but in most cases nothing of note.

I saw this nertwork show off thing a little bit ago while looking around before I made this post. The first one on that thread had lines going to dns1.1, 1.2, 2.1...As that to me is an internal thing, do you mind describing to me why all those lines go to more than just external devices. I clearly don't know how to read that map. Since I saw it pop up under your comment, I thought I'd ask.

[Lurick]

33 minutes ago, dverdier said:

I saw this nertwork show off thing a little bit ago while looking around before I made this post. The first one on that thread had lines going to dns1.1, 1.2, 2.1...As that to me is an internal thing, do you mind describing to me why all those lines go to more than just external devices. I clearly don't know how to read that map. Since I saw it pop up under your comment, I thought I'd ask.

Ah, the diagram in my signature?

That's just a high level layout, done in Visio, of my internal home network

[dverdier]

9 hours ago, Lurick said:

Ah, the diagram in my signature?

That's just a high level layout, done in Visio, of my internal home network

It's the first one that shows when you click the link in your signature. After looking at it again, It wasn't you that first posted that map. Sorry. I shouldv'e went there and asked the guy that posted it.

[dverdier]

I didn't see it before. I just realized something is steady writing to my c drive. It seems to be a fraction of a second behind the wifi activity. I never did run a virus scan. I guess I'm going to do that. I don't do any torrenting on this pc tho. Only dl drivers, games and other reputable software.

[Smith6612]

On 7/2/2023 at 10:56 AM, dverdier said:

I assume you mean resource monitor. I haven't the faintest how to read that. I found it in the task man. Now I know my pc will do some random talking even if you're not doing anything. I've never seen it do this though. Also in task man, the process tab, network is all 0 when this 8 comes up. I guess it's too small. The only thing I have running in the foreground is edge. I let that calm down then took a photo.

You need Wireshark or tcpdump to see what is going on. Most likely you're seeing discovery traffic from other clients on your network, or Windows is regularly probing for devices. For example, Bonjour discovery, DLNA Discovery, Printer discovery, ARP traffic (especially if offload is disabled), etc.

 

Either way, it's generally normal.

[Alex Atkin UK]

21 hours ago, Smith6612 said:

You need Wireshark or tcpdump to see what is going on. Most likely you're seeing discovery traffic from other clients on your network, or Windows is regularly probing for devices. For example, Bonjour discovery, DLNA Discovery, Printer discovery, ARP traffic (especially if offload is disabled), etc.

 

Either way, it's generally normal.

Agreed, I have smart managed switches and so can see there is ALWAYS at least 2KB of broadcast traffic going to every client.  That is a 5 second average though, given its likely happening in bursts and Windows may average over a different period.

[dverdier]

6 minutes ago, Alex Atkin UK said:

Agreed, I have smart managed switches and so can see there is ALWAYS at least 2KB of broadcast traffic going to every client.

Oh really. I only just noticed this the other day but that doesn't mean it hasn't been doing it. I have a satellite Wi-Fi system and a switch in my network. I wouldn't call it smart. It's just a normal switch I think. Could one of these cause it too. I haven't had time to dl the think the last guy mentioned. When I do I prob won't be able to read it. I looked this problem up and everyone else has had this exact problem with data going out. Mine comes in and had concurrent drive activity. I can't find where it's going yet either.

[Alex Atkin UK]

2 minutes ago, dverdier said:

Oh really. I only just noticed this the other day but that doesn't mean it hasn't been doing it. I have a satellite Wi-Fi system and a switch in my network. I wouldn't call it smart. It's just a normal switch I think. Could one of these cause it too. I haven't had time to dl the think the last guy mentioned. When I do I prob won't be able to read it. I looked this problem up and everyone else has had this exact problem with data going out. Mine comes in and had concurrent drive activity. I can't find where it's going yet either.

What causes it is as mentioned above, uPNP, Bonjour, DLNA Discover, ARP, Windows File Sharing, IPv6 Router Advertisements, any other kind of broadcast that is intended to make your life easier by not needing to configure things manually.

[dverdier]

3 minutes ago, Alex Atkin UK said:

What causes it is as mentioned above, uPNP, Bonjour, DLNA Discover, ARP, Windows File Sharing, IPv6 Router Advertisements, any other kind of broadcast that is intended to make your life easier by not needing to configure things manually.

I lost ipv6 for some reason when I added a third party modem instead of Xfinity. The only connection I have is ipv4. Maybe that's what it is. Constantly searching for the ipv6 connection. I'll get around to the software that was mentioned. I've got to get my neighbors electric back up first. Thx guys

[Smith6612]

14 hours ago, dverdier said:

I lost ipv6 for some reason when I added a third party modem instead of Xfinity. The only connection I have is ipv4. Maybe that's what it is. Constantly searching for the ipv6 connection. I'll get around to the software that was mentioned. I've got to get my neighbors electric back up first. Thx guys

This could be because your router needs to use IPv6 Prefix Delegation and isn't set up correctly. Or the modem hasn't been IPv6 certified by Comcast and they've shut off IPv6 support in the modem's configuration until they do. Make sure your router is set to Prefix Delegation mode with DHCPv6, and request a /56 subnet.

[dverdier]

5 hours ago, Smith6612 said:

This could be because your router needs to use IPv6 Prefix Delegation and isn't set up correctly. Or the modem hasn't been IPv6 certified by Comcast and they've shut off IPv6 support in the modem's configuration until they do. Make sure your router is set to Prefix Delegation mode with DHCPv6, and request a /56 subnet.

Thx I'll look for that. It said Comcast on the box or Xfinity rather. It was on their list of excepted too. They did have trouble getting it connected tho. Maybe that's something they had to sacrifice

[Smith6612]

17 hours ago, dverdier said:

Thx I'll look for that. It said Comcast on the box or Xfinity rather. It was on their list of excepted too. They did have trouble getting it connected tho. Maybe that's something they had to sacrifice

The configurations are pre-made. They just need to know the model and HFC MAC. Could've pushed a config for the wrong modem to it. Or used a generic template when there was activation problems. Have them try to re-provision it.

[dverdier]

5 hours ago, Smith6612 said:

The configurations are pre-made. They just need to know the model and HFC MAC. Could've pushed a config for the wrong modem to it. Or used a generic template when there was activation problems. Have them try to re-provision it.

These are new words to me. I can't even manage to get Remote desktop to work on an outside network. That may give you an understanding of my network capabilities. When I was getting this modem set up the people I was on the phone with had less understanding than me I think. Pretty sure they were working from scripted steps. I've tried asking for an actual tech person that really know their s**t and they typically don't like that. So from what I've told you the problem is def with the isp and I shouldn't bother contacting Motorola. I thought it might've had to do with the modems internal setup. I'm going to call Xfinity tom and bring up the things in your post. If they can't fix it, is it worth getting with the manufacturer or is that not a possibility at all? Also, what am I missing not having a ipv6 connection exactly?

[dverdier]

On 7/7/2023 at 10:33 AM, Smith6612 said:

This could be because your router needs to use IPv6 Prefix Delegation and isn't set up correctly. Or the modem hasn't been IPv6 certified by Comcast and they've shut off IPv6 support in the modem's configuration until they do. Make sure your router is set to Prefix Delegation mode with DHCPv6, and request a /56 subnet.

I forgot to put this part in. I got in my router and ipv6 is set to auto config (slaac/dhcpv6.) The other options are static, pppoe, and 6rd. Static is the only one I see I can change the subnet but I haven't a clue what to enter for ip address, gateway, and the dns servers. For ipv4 I use the 1.1.1.1/1.0.0.1 but I don't think 6 works that way. That's just a guess based on how dif the ip's are.

[Smith6612]

31 minutes ago, dverdier said:

These are new words to me. I can't even manage to get Remote desktop to work on an outside network. That may give you an understanding of my network capabilities. When I was getting this modem set up the people I was on the phone with had less understanding than me I think. Pretty sure they were working from scripted steps. I've tried asking for an actual tech person that really know their s**t and they typically don't like that. So from what I've told you the problem is def with the isp and I shouldn't bother contacting Motorola. I thought it might've had to do with the modems internal setup. I'm going to call Xfinity tom and bring up the things in your post. If they can't fix it, is it worth getting with the manufacturer or is that not a possibility at all? Also, what am I missing not having a ipv6 connection exactly?

The modem manufacturer will refer you to the ISP. They don't provide support outside of that. What modem do you have anyways? If it's an all-in-one Gateway/Router combo modem, then it needs to be in Bridge mode if you're using a separate router with it.

 

DHCP/SLAAC Auto Config is the mode you'll want for Xfinity. For IPv6 DNS use 2606:4700:4700::1111 and 2606:4700:4700::1001 if your router provides the option to use IPv6 DNS (RDDNS). You'll need IPv4 DNS entered in at the minimum.

[dverdier]

6 hours ago, Smith6612 said:

The modem manufacturer will refer you to the ISP. They don't provide support outside of that. What modem do you have anyways? If it's an all-in-one Gateway/Router combo modem, then it needs to be in Bridge mode if you're using a separate router with it.

 

DHCP/SLAAC Auto Config is the mode you'll want for Xfinity. For IPv6 DNS use 2606:4700:4700::1111 and 2606:4700:4700::1001 if your router provides the option to use IPv6 DNS (RDDNS). You'll need IPv4 DNS entered in at the minimum.

They are separate. Motorola. Modem docksis 3.1 m#-mb8611. The router was a bundle pack ac2200 tri band mesh m#-Mh7021 with 2 satellites. Not sure what's tri about it as it only has 2.5 and 5ghz. I'm kind of pissed at myself for not spending a little more and getting Wi-Fi 6e but at the time I didn't know I was about to build a pc that would have it. It's supposed to be 2200mbs which is faster than my isp provides anyway so I guess it only effects my local connections. I've looked around in the settings for both and I'm guessing they don't do firmware updates for things like this. Is that the case? I also added the dns to v6 in the router. I don't see anything past PRI and second dns. No accompanying options. I'll be calling xfinity tom about what you previously said. I can't tell you how helpful you've been. Hopefully those keywords will mean something to whoever the Indian or wherever phone lottery I get on the line.

[dverdier]

I also just found in my routers log there is an entry every single min. Could this have some connection to that constant small activity? [sys] moto, decoding config file: /storage/token_new_encode.dat. Pls tell me that's normal and not some kind of malware traffic. The modems log is quite eventful too but with a lot of dif stuff that just looks like code to me. No idea how to read any of it.