Re: xp pulling heavy traffic

[email protected] wrote on 12/03/2008 10:09:55 AM:

> I noticed a really heavy LAN traffic on a windoze XP system;
> looking with showtraffic it was port 80 between XP and, in succession, 
at
> least the following three ips:
> 
> # host 65.54.87.34
> 34.87.54.65.in-addr.arpa domain name pointer cds31.sjc9.llnw.net.
> # host 65.54.87.96
> 96.87.54.65.in-addr.arpa domain name pointer cds93.sjc9.llnw.net.
> # host 208.111.148.174
> 174.148.111.208.in-addr.arpa domain name pointer cds534.sjc.llnw.net.
> 
> now it's stopped
> 
> any thoughts ?
> how to investigate this further ?
> NAV scan shows nothing
If you can't look at the traffic retrospectively, the only thing I can 
think of is whois the ip.
It suggests the first two are owned by Microsoft (windows update, or 
hotmail perhaps?), and the last one is owned by limelight, which afaik is 
similar to akami. (which is a web accelleration - mirror service for web 
hosters).

Cheers,

Scott

-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html