Member Avatar for Ritesh_4

Hello
For the past few days am having an unexplained problem with my network connection when I connect on another pc on my lan to copy files from there to my pc. Once I click paste on my pc, my network's sent packets gets accelerated to such an extent that it goes like 12,000,000,000 and am unable to complete the paste operation as I get disconnected and need to restart my pc to be able to use the internet or access other lan pcs again. Also this occurs time and again when copying files from other pcs.
Anyone can help me on how to solve this problem?

  • 4 Contributors
  • 8 Replies
  • 206 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by Ritesh_4

Dani AI

Generated

Brief summary and likely faults (based on the thread): mapped a share and observed the Local Area Connection "sent" counter jump to ~12,000,000,000 when pasting files. , and suggested checking the connection and for malware; later reports Malwarebytes found items and the problem reduced. That pattern points to three classes of cause to test in order: (A) software on the host reacting to file I/O (malware, cloud/backup/AV), (B) a NIC/driver or OS counter bug, and (C) a network-level flood (duplicate IP/loop/broadcast storm). The steps below show how to isolate which one it is.

Quick, concrete checks to run on the Windows machine that sees the spike:

netstat -ano | findstr ESTABLISHED
netstat -b -o            (run elevated; shows executables)
tasklist /FI "PID eq 1234"
arp -a
nbtstat -n
ipconfig /all

Use Resource Monitor (Network tab) or netstat -b -o to map heavy sockets to a process. That immediately tells whether a local program is driving the traffic.

Network and hardware isolation steps

  • Disconnect the host from the rest of the LAN/Internet and do the same copy between two machines only. If the flood stops, Internet/cloud/remote services are implicated.
  • Run the same transfer with a different NIC (USB-Ethernet) or different switch port/cable to rule out a faulty NIC or switch.
  • Check for duplicate IPs and ARP floods (arp -a) and watch switch LEDs; if using an unmanaged switch, unplug cables one by one to isolate a loop.
  • In Device Manager, update the NIC driver and temporarily force 100Mbps full duplex and disable offload features (Large Send Offload / checksum offload) to test for driver counter/segmentation bugs.

If malware or a background service is suspected (and cleanup reduced it), finish with an offline rescue scan or clean image if you cannot fully validate the system is clean. If the problem persists after software cleanup and NIC/switch swap, capture traffic (look for repeated ARP, broadcast storms, or many small ACKs/SYNs) and post a capture or the standout patterns — those will point to a loop, a misbehaving device, or persistent compromise.

Recommended Answers

All 8 Replies

Member Avatar for ryan461

Can you explain this in more detail, when you say 12 billion packets, do you mean the number show on the connection in windows?

Also re-explain this: "I connect on another pc on my lan to copy files from there to my pc." , i dont quite get what you're trying to say there.

Member Avatar for Temmu

have you scanned for malware on the offending pc?

Member Avatar for Ritesh_4

: yes this shows in my Local area connection window.
Concerning "I connect on another pc on my lan to copy files from there to my pc." I mean that I map a network drive to access a shared folder on another computer on my lan network, and from there on I copy the files I need to my own computer for use.

: did a scan with panda but it did not return any viruses/threats in the results

Member Avatar for ryan461

Sounds like a Denial of service attack to be honest. Make sure you scan the machine your copying from. Try malwarebytes as well.

Member Avatar for Temmu

yes, malwarebytes.
it's scan engine is different (and imho better) than others.

Member Avatar for TheOgre

Try running Wireshark on the new computer to see the details about the traffic. You'll be able to determine if the machine is trying to send out spam once it has an Internet connection, and you can see where that traffic is destined, as well as any other outbound connections the system is attempting to initiate.

Member Avatar for Temmu

ooo wireshark! yummy!

it's got a bit of a learning curve, but google youtube for tutorials

Member Avatar for Ritesh_4

thanks for the inputs guys, could not really got to the bottom of this, but did get some malware when scanned with malwarebytes and now flooding occurs less frequently compared to past

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.