Something is accessing my network

**nukes** · May 20th, 2003, 01:12 PM

My machine is constantly trying to access the internet. I can see this both on my router downstairs and on gkrellm. It is affecting other people on my network and I don't know what's causing it. Just typing this, or being connected to the internet at all, causes between 7.5 and 10k to show up on my gkrellm network meter.
Here's the output of "ps ax -H" Are there any here that might cause this? (besides mozilla and everybuddy, which aren't the culprits as it starts before I load them)

Code:

  PID TTY      STAT   TIME COMMAND
    1 ?        S      0:05 init
    2 ?        SW     0:00   [keventd]
    3 ?        SWN    0:00   [ksoftirqd_CPU0]
    4 ?        SW     0:00   [kswapd]
    5 ?        SW     0:00   [bdflush]
    6 ?        SW     0:00   [kupdated]
    7 ?        SW     0:00   [pagebufd]
    8 ?        SW     0:00   [xfslogd/0]
    9 ?        SW     0:00   [xfsdatad/0]
  147 ?        S      0:00   /sbin/devfsd /dev
  264 ?        SW     0:00   [kreiserfsd]
  267 ?        SW     0:00   [kjournald]
  270 ?        SW     0:00   [khubd]
  700 ?        S      0:00   metalog [MASTER]                                   
  706 ?        S      0:00     metalog [KERNEL]                                 
  784 ?        S      0:00   ./server -auto
  785 ?        SN   115:29   ./think
  817 ?        S      0:00   [login]
  893 vc/1     S      0:00     -bash
 4974 vc/1     S      0:00       /bin/sh /usr/X11R6/bin/startx
 4985 vc/1     S      0:00         xinit /home/richard/.xinitrc --
 4986 ?        S      0:04           [X]
 4990 vc/1     S      0:00           /bin/sh /home/richard/.xinitrc
 4994 vc/1     S      0:00             gkrellm2
 4999 vc/1     S      0:00               gkrellm2
 4995 vc/1     S      0:00             fluxbox
 5023 ?        S      0:00               [aterm]
 5037 pts/0    S      0:00                 bash
 5132 ?        S      0:08               /usr/lib/mozilla/mozilla-bin
 5154 ?        S      0:00                 /usr/lib/mozilla/mozilla-bin
 5155 ?        S      0:00                   /usr/lib/mozilla/mozilla-bin
 5156 ?        S      0:00                   /usr/lib/mozilla/mozilla-bin
 5158 ?        S      0:00                   /usr/lib/mozilla/mozilla-bin
 5171 ?        S      0:00                   /usr/lib/mozilla/mozilla-bin
 5157 ?        S      0:00               vncviewer 192.168.0.1 -passwd /home/ric
 5167 ?        S      0:00               everybuddy
 5181 ?        S      0:00               [aterm]
 5195 pts/1    S      0:00                 bash
 5219 pts/1    S      0:00                   [su]
 5222 pts/1    S      0:00                     bash
 5304 pts/1    R      0:00                       ps ax -H
  818 vc/2     S      0:00   /sbin/agetty 38400 tty2 linux
  819 vc/3     S      0:00   /sbin/agetty 38400 tty3 linux
  820 vc/4     S      0:00   /sbin/agetty 38400 tty4 linux
  821 vc/5     S      0:00   /sbin/agetty 38400 tty5 linux
  822 vc/6     S      0:00   /sbin/agetty 38400 tty6 linux
 4992 ?        S      0:00   imwheel -k -b 67

**nukes** · May 20th, 2003, 02:11 PM

Doesn't matter, solved it. I started killing things at random and it turned out to be server (for find-a-drug) it was trying to download the new version, as I'm in the beta test. I upgraded it by hand and now it works ok.
Thanks to anyone who considered replying and trying to help anyway.

**SpookyEddy** · May 20th, 2003, 02:12 PM

I would suggest that you fire up the packet sniffer of your choice (etheral, tcpdump, ngrep - whatever floats your boat) and see what kind of traffic is being generated. Should atleast give you some pointers on what to look for.

<edit>too slow

</edit>

Regards

eddy

**nukes** · May 20th, 2003, 04:15 PM

Thanks for the reply anyway. I had already done that, it kept sending SYN packets to some IP address, which turned out to be the download server of fad. It couldn't get through today as the router was not set up (having double glazing in) but once I connected it started off again. Anyway - its sorted now.