Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Why does Win7 frequently try to access Akamai servers through svchost?

23 Jan 2017   #11
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Okay solved on my machine at least. Split those services into own process. Ran CrowdInspect to show full path of process.

C:\Program Files (x86)\** *******\*******.exe|2388|--|OK|??|??|TCP|Established|192.168.1.64|1089|23.204.149.152|80|a23-204-149-152.deploy.static.akamaitechnologies.com


Program with obscured name (due to forum rules) is connecting. Nothing to do with Microsoft. Some softwares use Akamai servers to distribute load rather than using their own servers.


My System SpecsSystem Spec
.
24 Jan 2017   #12
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

Might that just be some other program which happens to connect Akamai servers?
I know I have at least one other program (Firefox) that attemps to connect to an Akamai server.

Anyway, I have four services listed for the svchost instance that's accessing Akamai servers (see attached image).
I tried splitting the services out into their own processes using the following commands:

Code:
SC Config CryptSvc Type= own
SC Config Dnscache Type= own
SC Config LanmanWorkstation Type= own
SC Config NlaSvc Type= own
CrowdInspect still showed that it was svchost trying to connect to an Akamai server (for the full path it just showed the usual path to svchost.exe).
Did you use a different method to split them into their own processes?


Attached Thumbnails
Why does Win7 frequently try to access Akamai servers through svchost?-svchostanalyzer.png  
My System SpecsSystem Spec
24 Jan 2017   #13
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

No I used the same method. About the only difference i can see is that on my machine DNS Client Service is actually disabled due to the use of a large HOSTS file.
My System SpecsSystem Spec
.

24 Jan 2017   #14
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

Thanks Callender for the excellent tool recommendations. They're going to be very useful in future troubleshooting.
It looks like your idea to split the services out into their own processes may have been the final key to tracking down the culprit.
After splitting the services out, CrowdInspect wasn't able to give me the info I needed (that I could see), but it looks like ProcessExplorer was.
ProcessExplorer appears to be showing that CryptSvc is what's trying to access the Akamai servers via svchost.
So, for now, I'll move onto researching and monitoring CryptSvc. I'll post any interesting findings.


Attached Thumbnails
Why does Win7 frequently try to access Akamai servers through svchost?-nettools.png  
Attached Images
Why does Win7 frequently try to access Akamai servers through svchost?-processexplorer.png 
My System SpecsSystem Spec
24 Jan 2017   #15
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Let me know if you track it down please!
My System SpecsSystem Spec
24 Jan 2017   #16
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

I see your screenshot shows the port used. See if OpView displays the process using the port (other than svchost)

Opera 12.17 suddenly not working with SOME https sites
My System SpecsSystem Spec
24 Jan 2017   #17
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Some FAQ's about port numbers and types of traffic here: End-User FAQ | Customer Support | Akamai
My System SpecsSystem Spec
24 Jan 2017   #18
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

Quote:
I see your screenshot shows the port used. See if OpView displays the process using the port (other than svchost)
It just shows svchost

Quote:
Some FAQ's about port numbers and types of traffic here: End-User FAQ | Customer Support | Akamai
The connection is TCP IPv6 from a dynamic local port (always in the 40000 & 50000 range so far) to port 80 on the Akamai server.
My System SpecsSystem Spec
28 Jan 2017   #19
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

There were apparently two different services frequently attempting to contact Akamai servers via svchost.
Cryptographic Service (CryptSvc) and the Network Location Awareness Service (NlaSvc).

It appears CryptSvc was doing so as part of Certificate Revocation List (CRL) checking activities.
More info on CRL here and here.

And it appears NlaSvc was doing so as part of Network Connection Status Indicator (NCSI) activities.
More info on NCSI here.

I monitored the Akamai contact attempts of both services using Microsoft Message Analyzer.
Below I'll post the results of that monitoring.

To put an end to the attempts, I disabled the CRL checking of CryptSvc and the Active Probing of NlaSvc.
You may or may not experience issues from disabling these things. You can simply re-enable them if you do. Personally, I've experience no issues.

To disable CRL checking:
1. Control Panel > Internet Options > Advanced
2. scroll down to the security section and uncheck "Check for publisher's certificate revocation"
note: I also unchecked "Check for server certificate revocation" and "Check for signatures on downloaded programs" but that may not be necessary
3. restart the computer

To disable Active Probing:
1. open regedit
2. HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NlaSvc > Parameters > Internet
3. change the value of EnableActiveProbing to 0
4. restart the computer
My System SpecsSystem Spec
28 Jan 2017   #20
VeganCaramel

Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64
 
 

Results of Microsoft Message Analyzer monitoring CryptSvc attempting to contact Akamai servers via svchost
Code:
MessageNumber          Timestamp			    TimeElapsed 	 Source 				    Destination 			       Module   		Summary 																		   ProcessId          Message

74      	       2017-01-24T18:07:17.1650888          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ......S., SrcPort: 50660, DstPort: HTTP(80), Length: 0, Seq Range: 1434632888 - 1434632889, Ack: 0, Win: 8192(negotiating scale factor: 2)          1512 	      .PU.¸...... .Q.............
74      	       2017-01-24T18:07:17.1650888          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19090, Total Length: 52  												   1512 	      E..4J.@..........PU.¸...... .Q.............
74      	       2017-01-24T18:07:17.1650888          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   1512 	      T*P .0gv3..E..4J.@..........PU.¸...... .Q.............
74      	       2017-01-24T18:07:17.1650888          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 66    												   1512 	      ........B...T*P .0gv3..E..4J.@..........PU.¸...... .Q.............
74      	       2017-01-24T18:07:17.1650888          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1512, ThreadID: 3916, Size: 158       						   1512 	      .... ...L......Hv..[...|F.G0.v............................................N.........B...T*P .0gv3..E..4J.@..........PU.¸...... .Q.............

77      	       2017-01-24T18:07:17.3608429          0.2012986   	 192.168.0.123  			    crl.microsoft.com   		       HTTP     		Operation, Status: Not Modified (304), GET /pki/crl/products/microsoftrootcert.crl, Version: HTTP/1.1   						   1512 	      --
77      	       2017-01-24T18:07:17.3608429          0.1988145   	 192.168.0.123  			    crl.microsoft.com   		       HTTP     		Request, GET /pki/crl/products/microsoftrootcert.crl, Version: HTTP/1.1 										   1512 	      GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
77      	       2017-01-24T18:07:17.3608429          0.0000093   	 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ...AP..., SrcPort: 50660, DstPort: HTTP(80), Length: 271, Seq Range: 1434632889 - 1434633160, Ack: 3671030482, Win: 66248(scale factor: 2)          1512 	      .PU.¹zP.@T..GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
77      	       2017-01-24T18:07:17.3608429          0.0000093   	 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19092, Total Length: 311 												   1512 	      E..7J.@..........PU.¹zP.@T..GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
77      	       2017-01-24T18:07:17.3608429          0.0000093   	 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   1512 	      T*P .0gv3..E..7J.@..........PU.¹zP.@T..GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
77      	       2017-01-24T18:07:17.3608429          0.0000093   	 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 325   												   1512 	      ........E...T*P .0gv3..E..7J.@..........PU.¹zP.@T..GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
77      	       2017-01-24T18:07:17.3608429          0.0000093   	 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1512, ThreadID: 1236, Size: 361       						   1512 	      ditto
77      	       2017-01-24T18:07:17.3608429          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712398040, Length: 12  													   1512 	      .諡............E...
77      	       2017-01-24T18:07:17.3608429          --  		 --     				    --  				       Etw      		[Fragment: Start] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 1236, Size: 102     				   1512 	      f... ..........v..[...|F.G0.v..........@.....................................諡............E...
78      	       2017-01-24T18:07:17.3608473          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712398040, Length: 54  													   1512 	      .諡6...T*P .0gv3..E..7J.@..........PU.¹zP.@T..
78      	       2017-01-24T18:07:17.3608473          --  		 --     				    --  				       Etw      		[Fragment: Middle] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 1236, Size: 144    				   1512 	      .... ...........v..[...|F.G0.v.............................................@..諡6...T*P .0gv3..E..7J.@..........PU.¹zP.@T..
79      	       2017-01-24T18:07:17.3608522          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712398040, Length: 271 													   1512 	      .諡....GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
79      	       2017-01-24T18:07:17.3608522          --  		 --     				    --  				       Etw      		[Fragment: End] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 1236, Size: 361       				   1512 	      i... .........J.v..[...|F.G0.v................................................諡....GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 21 Nov 2016 06:01:26 GMT..If-None-Match: "ea9ee7b1bc43d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....

82      	       2017-01-24T18:07:17.5596574          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       TCP      		Flags: ...A...., SrcPort: HTTP(80), DstPort: 50660, Length: 0, Seq Range: 3671030482 - 3671030482, Ack: 1434633160, Win: 30272(scale factor: 5) 	   0    	      .PzU.P..*..
82      	       2017-01-24T18:07:17.5596574          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       IPv4     		Next Protocol: TCP, Packet ID: 17868, Total Length: 40  												   0    	      E..(E@.:.1.....PzU.P..*.....[
82      	       2017-01-24T18:07:17.5596574          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		Type: Internet IP (IPv4)																   0    	      .0gv3T*P ..E..(E@.:.1.....PzU.P..*.....[
82      	       2017-01-24T18:07:17.5596574          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 60    												   0    	      ........<....0gv3T*P ..E..(E@.:.1.....PzU.P..*.....[
82      	       2017-01-24T18:07:17.5596574          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 152     							   0    	      .... ............v..[...|F.G0.v..............*.............................H.........<....0gv3T*P ..E..(E@.:.1.....PzU.P..*.....[

83      	       2017-01-24T18:07:17.5621415          0.1992838   	 crl.microsoft.com      		    192.168.0.123       		       HTTP     		Response, Status: Not Modified (304), Version: HTTP/1.1 												   0    	      HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....
83      	       2017-01-24T18:07:17.5621415          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       TCP      		Flags: ...AP..., SrcPort: HTTP(80), DstPort: 50660, Length: 227, Seq Range: 3671030482 - 3671030709, Ack: 1434633160, Win: 30272(scale factor: 5)          0    	      .PzU.P..,...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....
83      	       2017-01-24T18:07:17.5621415          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       IPv4     		Next Protocol: TCP, Packet ID: 17869, Total Length: 267 												   0    	      E...E@.:.0.....PzU.P..,...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....
83      	       2017-01-24T18:07:17.5621415          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		Type: Internet IP (IPv4)																   0    	      .0gv3T*P ..E...E@.:.0.....PzU.P..,...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....
83      	       2017-01-24T18:07:17.5621415          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 281   												   0    	      .............0gv3T*P ..E...E@.:.0.....PzU.P..,...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....
83      	       2017-01-24T18:07:17.5621415          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 373     							   0    	      u... ...........'?v..[...|F.G0.v..............*.............................%..............0gv3T*P ..E...E@.:.0.....PzU.P..,...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 21 Nov 2016 06:01:26 GMT..ETag: "ea9ee7b1bc43d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:07:19 GMT..Connection: keep-alive....

84      	       2017-01-24T18:07:17.7614253          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ...A...., SrcPort: 50660, DstPort: HTTP(80), Length: 0, Seq Range: 1434633160 - 1434633160, Ack: 3671030709, Win: 66020(scale factor: 2) 	   3520 	      .PU.{P.@yE..
84      	       2017-01-24T18:07:17.7614253          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19094, Total Length: 40  												   3520 	      E..(J.@..........PU.{P.@yE..
84      	       2017-01-24T18:07:17.7614253          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   3520 	      T*P .0gv3..E..(J.@..........PU.{P.@yE..
84      	       2017-01-24T18:07:17.7614253          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 5     												   3520 	      ........6...T*P .0gv3..E..(J.@..........PU.{P.@yE..
84      	       2017-01-24T18:07:17.7614253          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 3520, ThreadID: 1788, Size: 146       						   3520 	      .... .........*.v..[...|F.G0.v..............H...I.........................B.........6...T*P .0gv3..E..(J.@..........PU.{P.@yE..

87      	       2017-01-24T18:07:59.6190330          0.1944199   	 192.168.0.123  			    crl.microsoft.com   		       HTTP     		Operation, Status: Not Modified (304), GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl, Version: HTTP/1.1     					   1512 	      --
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 192.168.0.123  			    crl.microsoft.com   		       HTTP     		Request, GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl, Version: HTTP/1.1   									   1512 	      GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ...AP..., SrcPort: 50660, DstPort: HTTP(80), Length: 276, Seq Range: 1434633160 - 1434633436, Ack: 3671030709, Win: 66020(scale factor: 2)          1512 	      .PU.{P.@yY..GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19095, Total Length: 316 												   1512 	      E..<J.@..........PU.{P.@yY..GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   1512 	      T*P .0gv3..E..<J.@..........PU.{P.@yY..GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 330   												   1512 	      ........J...T*P .0gv3..E..<J.@..........PU.{P.@yY..GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
87      	       2017-01-24T18:07:59.6190330          0.0000063   	 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1512, ThreadID: 4012, Size: 366       						   1512 	      ditto
87      	       2017-01-24T18:07:59.6190330          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712912640, Length: 12  													   1512 	      ..ó............J...
87      	       2017-01-24T18:07:59.6190330          --  		 --     				    --  				       Etw      		[Fragment: Start] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 4012, Size: 102     				   1512 	      f... .........z..گv..[...|F.G0.v..........@......................................ó............J...
88      	       2017-01-24T18:07:59.6190364          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712912640, Length: 54  													   1512 	      ..ó6...T*P .0gv3..E..<J.@..........PU.{P.@yY..
88      	       2017-01-24T18:07:59.6190364          --  		 --     				    --  				       Etw      		[Fragment: Middle] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 4012, Size: 144    				   1512 	      .... ............گv..[...|F.G0.v.............................................@...ó6...T*P .0gv3..E..<J.@..........PU.{P.@yY..
89      	       2017-01-24T18:07:59.6190393          --  		 --     				    --  				       EtwEvent 		EventId: 1001, GroupId: 2712912640, Length: 276 													   1512 	      ..ó....GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....
89      	       2017-01-24T18:07:59.6190393          --  		 --     				    --  				       Etw      		[Fragment: End] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1512, ThreadID: 4012, Size: 366       				   1512 	      n... ...........گv..[...|F.G0.v.................................................ó....GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1..Cache-Control: max-age = 900..Connection: Keep-Alive..Accept: */*..If-Modified-Since: Mon, 12 Dec 2016 06:00:18 GMT..If-None-Match: "7254ef33d54d21:0"..User-Agent: Microsoft-CryptoAPI/6.1..Host: crl.microsoft.com....

90      	       2017-01-24T18:07:59.8134529          0.1994188   	 crl.microsoft.com      		    192.168.0.123       		       HTTP     		Response, Status: Not Modified (304), Version: HTTP/1.1 												   0    	      HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....
90      	       2017-01-24T18:07:59.8134529          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       TCP      		Flags: ...AP..., SrcPort: HTTP(80), DstPort: 50660, Length: 226, Seq Range: 3671030709 - 3671030935, Ack: 1434633436, Win: 31360(scale factor: 5)          0    	      .P{U.P..C...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....
90      	       2017-01-24T18:07:59.8134529          --  		 a1363.dscg.akamai.net  		    192.168.0.123       		       IPv4     		Next Protocol: TCP, Packet ID: 17870, Total Length: 266 												   0    	      E...E@.:.0.....P{U.P..C...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....
90      	       2017-01-24T18:07:59.8134529          --  		 12-34-56-AB-CD-EF (my router MAC)          AB-CD-EF-12-34-56 (my NIC MAC)             Ethernet 		Type: Internet IP (IPv4)																   0    	      .0gv3T*P ..E...E@.:.0.....P{U.P..C...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....
90      	       2017-01-24T18:07:59.8134529          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 280   												   0    	      .............0gv3T*P ..E...E@.:.0.....P{U.P..C...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....
90      	       2017-01-24T18:07:59.8134529          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 372     							   0    	      t... ............I!گv..[...|F.G0.v..............'............................$..............0gv3T*P ..E...E@.:.0.....P{U.P..C...HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Mon, 12 Dec 2016 06:00:18 GMT..ETag: "7254ef33d54d21:0"..Cache-Control: max-age=900..Date: Wed, 25 Jan 2017 02:08:01 GMT..Connection: keep-alive....

91      	       2017-01-24T18:08:00.0128717          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ...A...., SrcPort: 50660, DstPort: HTTP(80), Length: 0, Seq Range: 1434633436 - 1434633436, Ack: 3671030935, Win: 65792(scale factor: 2) 	   0    	      .PU.|.P.@@E..
91      	       2017-01-24T18:08:00.0128717          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19096, Total Length: 40  												   0    	      E..(J.@..........PU.|.P.@@E..
91      	       2017-01-24T18:08:00.0128717          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   0    	      T*P .0gv3..E..(J.@..........PU.|.P.@@E..
91      	       2017-01-24T18:08:00.0128717          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 54    												   0    	      ........6...T*P .0gv3..E..(J.@..........PU.|.P.@@E..
91      	       2017-01-24T18:08:00.0128717          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 146     							   0    	      .... ...........Ͷ?گv..[...|F.G0.v..............m............................B.........6...T*P .0gv3..E..(J.@..........PU.|.P.@@E..

104     	       2017-01-24T18:08:59.8145000          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       TCP      		Flags: ...A.R.., SrcPort: 50660, DstPort: HTTP(80), Length: 0, Seq Range: 1434633436 - 1434633436, Ack: 3671030935, Win: 0(scale factor: 2)     	   1512 	      .PU.|.P...E..
104     	       2017-01-24T18:08:59.8145000          --  		 192.168.0.123  			    a1363.dscg.akamai.net       	       IPv4     		Next Protocol: TCP, Packet ID: 19097, Total Length: 40  												   1512 	      E..(J.@..........PU.|.P...E..
104     	       2017-01-24T18:08:59.8145000          --  		 AB-CD-EF-12-34-56 (my NIC MAC) 	    12-34-56-AB-CD-EF (my router MAC)          Ethernet 		Type: Internet IP (IPv4)																   1512 	      T*P .0gv3..E..(J.@..........PU.|.P...E..
104     	       2017-01-24T18:08:59.8145000          --  		 --     				    --  				       PefNdisProvider  	MiniportIfIndex: 11, LowerIfIndex: 25, FrameSize: 54    												   1512 	      ........6...T*P .0gv3..E..(J.@..........PU.|.P...E..
104     	       2017-01-24T18:08:59.8145000          --  		 --     				    --  				       Etw      		{9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1512, ThreadID: 1596, Size: 146       						   1512 	      .... ...<......v..[...|F.G0.v............................................B.........6...T*P .0gv3..E..(J.@..........PU.|.P...E..
My System SpecsSystem Spec
Reply

 Why does Win7 frequently try to access Akamai servers through svchost?




Thread Tools




Similar help and support threads
Thread Forum
svchost (netsvcs) download from Akamai - What is initiating?
Platform: Windows 7 Home Premium 64 bit, ASUS K52F laptop Note: I have posted this on 2 other forums & did not receive a solution so I am posting it here. Hope that is okay. I have observed extensive downloads (using the NetMeter gadget) averaging 400-600kbps for up to 10 minutes from Akamai....
Network & Sharing
svchost.exe using almost all available random access memory after boot
Hello, I will start by describing the problem: Whenever I start up this laptop, usually after opening Firefox I find that it keeps freezing by even hovering the mouse cursor over links, or UI elements. It turns out that the problem is an "svchost.exe" process that takes up to 800MB of my ram (out...
General Discussion
Digital River Win7 ISO servers taken down again
I heard about this just now in Clean Reinstall Windows 7 thread: As Jann from Heidoc reports in Windows 7 Direct Download Links as of now only English and Spanish are still up, links being replaced by a new MS Recovery Center that provides ISO's for a retail Product Key. I'd also...
General Discussion
Problem - Network Access - Can't map drives, can't see any servers
I've got a ThinkPad x220 here and randomly started having issues accessing the network (mapped drives and printers). The computer can still access our Intranet (Sharepoint) and Exchange Server (Outlook says connected and we can send/receive) I tried disconnecting the drives and reconnecting,...
Network & Sharing
2 COD 4 Servers for those with Win7 64
I have 2 COD4 Server located @ 208.43.15.45:28930(-=IT=-) and the other at 208.43.23.172:28930(ROC-Realm Of Chaos) These are Linux (cent OS) servers, low ping :cool: I modified the pb_sv_Restriction to read like this: pb_sv_Restrictions 0 So that Win7 64 bit users can get on with...
Gaming


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 22:44.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App