Now this issue is truly interesting. For starters, who will actually notice that some Windows service is producing permanent internet traffic? Secondly it was really kinda hard to find out what was causing the download.
I don’t know which Windows versions do have this scenario, but I’m guessing Windows XP and all later versions are “affected”. I’ve experienced it with Windows 7 x64 and Windows 7 x64 with SP1.
It hasn’t been the first time that I had noticed something was causing traffic for which I couldn’t come up with an explanation.
While I’m on holiday my main computer will keep running however pretty much idle – I can connect via VNC and check emails and instant messengers. I also get a daily report email from my router which includes the amount of incoming and outgoing bytes.
So this one time I noticed that the incoming data was round about 1GB – needless to say I was away not using the computer. This amount kept showing up for the following days on which I was still out of town.
What could cause such an amount of traffic? There were no downloads going on, incoming emails were at a minimum, so I was ruling out other programs one by one. Instant messenger clients, IRC clients, browsers (I actually even suspected Facebook, because they had introduced AJAX and other re-loading content techniques – even though 1GB was really a lot). No effect, the data was still coming in.
On the way of finding the culprit I was using NetLimiter, which is a really cool piece of software btw. Primarily the software can be used for limiting network bandwidth for certain programs, processes and threads (hence its name). However it will also show the currently used bandwidth (upload as well as download) for all programs, processes and threads (down to every single socket).
One way of stopping this would be using NetLimiter to limit the connection of the appropriate process. But since I wanted to get to the bottom if it, I kept on digging.
NetLimiter gave me the name of the program and the PID of the process that was causing the traffic: at that time svchost.exe was tanking at a constant rate of 70K/s.
svchost.exe is the “Host Process for Windows Services”, so everything you see running when you look at services.msc is done by svchost.exe. Since this program is essential for Windows and running more than just one service, I can’t just kill it and be done with it. I had to find out, which service was actually the one responsible.
With the help of this post I found a command that lists all services connected to svchost.exe and a special PID:
tasklist /svc /fi "imagename eq svchost.exe"
Among other PIDs I got this result for a PID (of which I deleted the last digits):
|svchost.exe||10**||AeLookupSvc, Appinfo, AppMgmt, BITS, Browser, gpsvc, iphlpsvc, LanmanServer,MMCSS, ProfSvc, Schedule, SENS, ShellHWDetection, Themes, Winmgmt, wuauserv|
So that was already narrowing it down to 16 services. Not great but just another step towards the goal. Another obstacle that made this difficult for me is, that I am using a German Windows. Even though the result list of the tasklist call is the same, services.msc will list the services by their German name. You can actually find the German service by translating the short name from the result list and looking for a similar service (I will paste a translation table later on).
During my search for fellow people with the same problem, I stumbled across the mention post. The dude solved the problem by disabling BITS (Background Intelligent Transfer Service), which sounded promising but didn’t solve it for me. I went through the list one by one (fearing that it might be a combination of services that was causing the traffic) and finally got lucky with iphlpsvc. The IP Helper Service service is doing stuff for IPv6 connections and tunneling, which I’m not using anyway.
So after disabling the IP Helper this horror story was finally over and I could save 1GB of download per day ;).
As promised, here’s a list with the equivalent German names.
The titles of the result list provided by the tasklist command are:
Abbildname PID Dienste
And the full service names are (I’m only listing those that are run by that PID):
|Service shortname||English name||German name|
|BITS||Background Intelligent Transfer Service||Intelligenter Hintergrundübertragungsdienst|
|gpsvc||Group Policy Client||Gruppenrichtlinienclient|
|iphlpsvc||IP Helper Service||IP-Hilfsdienst|
|MMCSS||Multimedia Class Scheduler||Multimediaklassenplaner|
|ProfSvc||User Profile Service||Benutzerprofildienst|
|SENS||System Event Notification Service||Benachrichtigungsdienst für Systemereignisse|
|ShellHWDetection||Shell Hardware Detection||Shellhardwareerkennung|
|Winmgmt||Windows Management Instrumentation||Windows-Verwaltungsinstrumentation|
|wuauserv||Windows Update||Windows Update|
So yeah, whatever the IP Helper service is doing, it is bugging me no more. I hope this post is useful to anyone else out there :).