I'm using w2k pro, and I have noticed recently alot of activity in the form of sent/received packets in the network connection status window. I'm running a home lan with a broadband wireless router. I have 2 computers hard wired to the router and I have the wireless part set to only accept connections from approved mac addresses (none).

Since I'm fairly confident nobody is wirelessly hacking into my lan, maybe some background process is creating the network traffic. Even when no programs are open on either computer I'm seeing about 1 packet sent per second and slightly less for packets received.

1. Is there a way to find out what (if any) programs/processes are sending/receiving network traffic? Any freeware or windows utils?

2. Is this possibly normal network traffic being created by the broadband router? (never really checked before now)

Any suggestions?

Drop to a DOS window and type "netstat" which will show you all open connections. Won't tell you which *programs* are doing it, but the ports being used might give you a clue.

Don't have Internet Information Server installed, do you? If you do, Port 80 isn't open on your firewall, is it?

Download a copy of Ethereal from www.ethereal.com and run a packet trace to see what the traffic is. If you don't know how to interpret the packet trace then save it and send it to me (email in my profile). Probably best not to upload the packet trace here, could have password and other sensitive data in it.

theres also a handy little program called ItCan. i use that exclusively to monitor the amount of bandwidth each connection is using.

Well I downloaded TCPView from another suggestion and checked out what's going on. I guess it's normal traffic? Here are the processes that came up:

ALERTSVC.EXE
LSASS.EXE
mstask.exe
POPROXY.EXE
svchost.exe
System

The last one is the only thing that confuses me because it showed up 3 times for TCP and 3 for UDP with local addresses like "microsoft-ds" and "netbios-ssn", "netbios-ns", and "netbios-dgm". Could this have something to do with Windows Update? I have it set to automatically check for new windows patches.

The last one is the only thing that confuses me because it showed up 3 times for TCP and 3 for UDP with local addresses like "microsoft-ds" and "netbios-ssn", "netbios-ns", and "netbios-dgm".

Don't worry, that is just microsoft sending your credit card numbers, bank statements, and mothers maiden name back to their central servers. Nothing to worry about of course.

;-)

Umm if you have all the lastest Micro$oft updates or at least IE6sp1 I believe the system checks back at Micro$oft.com for system updates. There is a way to shut that down I know it's under System Properties then Automatic Updates tab in Win XP but I can't remember if W2K gets that same tab or not.