Abnormally large sessions (Draytek 2830)

[renren]

I have my pc shown in a data flow monitor and it says my sessions is about 600-2000 at times.

Why is it so high? and what can i do to reduce these sessions as it seems to cause internet issues with other PCs in the network.

 

[Shadowjk]

Are you able to provide a screenshot of such information? Also what units is this 600-2000 mystery number working in? (Seconds? Minutes?)

Also what sort of traffic is currently in session? If you do not know then what protocol is being used to initiate the session? (TCP? UDP? ESP?)

As for other issues on the PC, what sort of issues are you experiencing? Connection drop outs, slow connection? It could be possible that this session is eating up available bandwidth

Josh

 

[renren]

Suddenly its low.. but when i say 600-2000 is the number of concurrent sessions to my pc. I do get drop outs, just once today, ping would go haywire at times. its not too bad at the momment but its a lot higher then other pc's

 

[Shadowjk]

What websites are you currently viewing? Are you streaming any content?

A website such as MSN is essentially a framework of elements that are stored on other servers. Upon request of its home page your computer is forced to create sessions with other servers in order to display ads or multimedia elements.

Open a command prompt and type the following after you have closed any internet browser and streaming services:

netstat

This should show all open sessions on your NIC.

Upload a screenshot of your results

   Note

It can take some time for the command to finish depending on the amount of sessions open because your machine is trying to resolve IP addresses to hostnames

Josh

 

[renren]

The session hit about 500 just not to olong ago.

 

[Shadowjk]

Almost all your traffic is using port 80 which is used for internet traffic. What websites did you have open when you ran that command? Also do you have any other applications which require interaction with the internet? For example desktop gadgets and possibly other applications such as Google Drive or Steam.. etc

It would also appear that a lot of your sessions are duplicated. This could be due to your monitoring software which I am assuming is coming from your router since a lot of sessions are pointing towards it howver it is a possibility it is caused by malware.

Can you run a full scan with your A/V and Malwarebytes and remove any identified malware - Malwarebytes : Free anti-malware download.

Once done restart your computer and then upload a new netstat information

Josh

 

[renren]

all mallware deleted. No change in session number.

I started to block some of ports and such from my old minecraft server and it seemed to do the trick (for now).

Here is another netstat for your anaylsis

Edit: it hit 700 just then guess it didnt work..

 

[Shadowjk]

My apologies if you missed the question from the previous thread, what websites are you currently viewing? If none then can you start the machine in Safe mode with Networking and then report the netstat information - Follow this tutorial (OPTION ONE ONLY) - http://www.sevenforums.com/tutorials/69585-safe-mode.html

Please replace all references of Safe mode with Safe Mode with Networking.

Also where is this session monitoring service located?

Based on the netstat information you only have 84 currently established sessions (Excluding localhost mapping to 127.0.0.1). I think your session monitoring software is picking up closing sessions which are not active.

The rest are either closing or waiting to be closed. TCP works by leaving the session open for a couple of minutes since packets sent can sometimes be belated. Once one side is closing the session it takes a couple of minutes before it is completely terminated.

Many Thanks,
Josh!