1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Too much dhcp (port 67) traffic after wake up

Discussion in 'Networking (Hardware & Software)' started by nexxer, 2009/10/29.

  1. 2009/10/29
    nexxer

    nexxer Inactive Thread Starter

    Joined:
    2008/11/27
    Messages:
    8
    Likes Received:
    0
    Hi,

    I wasn't sure if I should post this on the Windows 7 forum or here, but I think I've never noticed it on Windows XP.

    After waking up from hibernation my Windows 7 (RC1) machine will start doing alot of broadcast udp traffic, 255.255.255.255:67. I can only assume this is because it's looking for a DHCP server, but it's not even connected to a network.

    I'd expect some dhcp traffic since I have 2 openvpn connections setup, but a traffic monitor such as DUMeter shows about 700kbps incoming and 750kbps outgoing traffic, for over 30 minutes.

    I used Netlimiter to find out the exact process that's doing all the traffic:

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    This doesn't stop even after I connect to a network (using a 3g modem at the moment)

    I have checked for viruses with Avira and have none.

    Does anyone have any idea what causes this? Is it normal?

    Thanks in advance,
    Fanis
     
    nexxer,
    #1
  2. 2009/10/29
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    The following Windows services use
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted.
    It's also possible that 3rd party apps are coded to utilize svchost.exe, such as av updating, antispyware updating, media players, etc.

    Windows Audio Service
    .NET Web services
    DHCP Client Service
    Wired AutoConfig Service
    ReadyBoost Service
    Event Logging Service
    HID Service
    PnP-X IP Bus Enumerator
    TCPIP NetBios Transport Services
    Network Connections Manager
    Peer-to-Peer Services
    Program Compatibility Assistant
    Policy Storage
    Superfetch Service Host
    Microsoft Tablet PC Input
    Distributed Link Tracking Client
    Terminal Server Device Redirector
    Desktop Window Manager
    Windows Diagnostic Infrastructure
    Windows WLAN AutoConfig Service
    WPC Filtering (outlook spam blocker)
    Portable Device Enumerator
    Windows Security Center
    Windows Driver Foundation
     
    TonyT,
    #2


  3. to hide this advert.

  4. 2009/10/29
    nexxer

    nexxer Inactive Thread Starter

    Joined:
    2008/11/27
    Messages:
    8
    Likes Received:
    0
    Thanks for the reply.

    The problem here isn't some antivirus update. I found the process pid (pid) doing all the traffic via Netlimiter and then looked at the connections per pid via TcpView. All this svchost was doing was udp to 255.255.255.255:67.
     
    nexxer,
    #3
  5. 2009/10/29
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    If don't want the traffic then disable the DHCP Client service.
     
    TonyT,
    #4
  6. 2009/10/30
    nexxer

    nexxer Inactive Thread Starter

    Joined:
    2008/11/27
    Messages:
    8
    Likes Received:
    0
    But I am using DHCP when I actually connect to a network. Is this a misconfiguration of some sorts? I don't remember it happening on XP, but I've yet to test it.

    I realize DHCP client tries to contact the DHCP server to get ip configuration, but doing dhcp broadcasts worth 700kbps in and 750kbps out for 30 minutes sounds over the top.

    Edit: I think I have pinpointed the problem to openvpn. If I resume from hibernation with its service running it generates that traffic trying to contact the dhcp server for my 2 vpns. If openvn is stopped, no traffic.

    This doesn't happen if I simply start the service manually.
    It must be some bug in openvpn, and I'll take it to them.

    Thanks
     
    Last edited: 2009/10/30
    nexxer,
    #5
  7. 2009/10/30
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Doesn't sound like a bug in the vpn software. It the service is running then it needs an ip address. Set that service to "manual" so it doesn't load at boot, but when the client is executed by you the service will start.
     
    TonyT,
    #6
  8. 2009/10/30
    nexxer

    nexxer Inactive Thread Starter

    Joined:
    2008/11/27
    Messages:
    8
    Likes Received:
    0
    The idea behind having it run as a service is to have it always on. When the machine is connected to a network openvpn should also connect to its server.

    This has been working fine on XP. Openvpn will retry connecting to its server every X seconds as specified in the configuration files.

    This looks like a flood of broadcast dhcp traffic.
     
    nexxer,
    #7

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...