Network traffic .. what for??

If you are experiencing problems with "Everything", post here for assistance.
Post Reply
klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Network traffic .. what for??

Post by klugschwätzer » Mon Sep 23, 2013 5:33 pm

Hi everybody.

I recently observed that the Everything.exe has two processes in the Windows ressource monitor using network traffic. About 1000 B/s only in all, but this all the time. So this has noting to do with an update check or other.

Unexplained traffic always is suspicious so I would like to know where this traffic comes from. Is it really necessary?

Any thoughts?

Many thanks.

therube
Posts: 2851
Joined: Thu Sep 03, 2009 6:48 pm

Re: Network traffic .. what for??

Post by therube » Mon Sep 23, 2013 6:02 pm

Perhaps communication between the UI & the service?

I'm not seeing anything, at the moment at least, with Process Hacker.

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Mon Sep 23, 2013 6:09 pm

Strange.

I'm on Version 1.3.3.658 (x64) btw.

I restarted the service. Jumped to 5000 B/s then decreased to about 1000 again.

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Sat Sep 28, 2013 7:41 pm

Nobody?

I have deinstalled it as a precaution as this is unacceptable.

Sadly I'm not able to dig deep enough to understand what data are transmitted all the time.

therube
Posts: 2851
Joined: Thu Sep 03, 2009 6:48 pm

Re: Network traffic .. what for??

Post by therube » Sat Sep 28, 2013 8:00 pm

I assume you're running the service?

Disable the service, then run it without (you'll then need to "Run As Administrator") & see if your situation changes?


Maybe one of these small utilities can help point out to you what's going on, http://www.nirsoft.net/network_tools.html ?
(I don't really know such things, but perhaps NetworkTrafficView as a start?)

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Sat Sep 28, 2013 9:00 pm

There is no traffic with the service disabled.

Mhhh.

Strange. What exactly is the traffic good for then?

therube
Posts: 2851
Joined: Thu Sep 03, 2009 6:48 pm

Re: Network traffic .. what for??

Post by therube » Sun Sep 29, 2013 2:42 pm

Wonder if an Antivirus or similar program might be affecting things?

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Sun Sep 29, 2013 4:48 pm

therube wrote:Wonder if an Antivirus or similar program might be affecting things?
How could an antivirus software affect the process Everything.exe in said manner?


Am I really the only one that can reproduce this?

daspud
Posts: 102
Joined: Wed Apr 01, 2009 3:15 am

Re: Network traffic .. what for??

Post by daspud » Tue Oct 01, 2013 4:08 am

What are you using to see the network traffic? I can try to take a look and see if it is happening on my system.

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Tue Oct 01, 2013 6:43 am

With the service running look in the network listing in the Windows ressource monitor. http://en.wikipedia.org/wiki/Resource_Monitor

I turned the service back on again and the traffic is back again. It's on port 15485 which has something to do with the service, but also on port 49162.

daspud
Posts: 102
Joined: Wed Apr 01, 2009 3:15 am

Re: Network traffic .. what for??

Post by daspud » Sun Oct 06, 2013 1:48 am

I see the listening port, but no traffic. Sorry, but I don't know what it is for.

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Sun Oct 06, 2013 7:37 pm

Strange.

Just a picture proof so that no one thinks I'm imagining things.

Image

mooms
Posts: 16
Joined: Sat Feb 02, 2013 11:54 pm

Re: Network traffic .. what for??

Post by mooms » Mon Oct 07, 2013 2:25 pm

I think it is local traffic only.

If you use CurrPorts (from Nirsoft) or TCPView (from Sysinternals/Microsoft), you can see a lot of connections initiated by Everything, but they are on 127.0.0.1 (local machine).
Don't know why there is so much connections though. If you close Everything client, connections are closed.

klugschwätzer
Posts: 8
Joined: Mon Sep 23, 2013 5:29 pm

Re: Network traffic .. what for??

Post by klugschwätzer » Mon Oct 07, 2013 4:20 pm

You are right. Seems local. But why at all?

And why isn't everybody seeing this?

raidsa
Posts: 4
Joined: Fri Apr 26, 2013 10:11 am

Re: Network traffic .. what for??

Post by raidsa » Sat Nov 23, 2013 6:28 am

"Capture the traffic and take a look" would be my first thought,

void
Site Admin
Posts: 6059
Joined: Fri Oct 16, 2009 11:31 pm

Re: Network traffic .. what for??

Post by void » Fri Jul 04, 2014 4:12 am

Everything uses the loopback adapter to communicate between the client and service.

Traffic over the loopback adapter is strictly local only.

You can confirm this by running a command prompt and typing:

Code: Select all

netstat -abn
You should see something like:

Code: Select all

 TCP    127.0.0.1:15485        0.0.0.0:0              LISTENING
[Everything.exe]
 TCP    127.0.0.1:15485        127.0.0.1:49185        ESTABLISHED
[Everything.exe]
 TCP    127.0.0.1:49185        127.0.0.1:15485        ESTABLISHED
[Everything.exe]
127.0.0.1 is the loopback adapter.

If you do not want Everything to use any local network traffic, the service can be disabled from Tools -> Options -> General.
However, you will need to run Everything as administrator if you wish to index NTFS volumes.

Post Reply