LAN packets sent when computer in hibernate or standby

Question

Whenever I bring my computer out of hibernate or standby, my LAN status monitor shows 4,294,967,299 or more packets sent and only a few received. My system uses NAT at both the DSL modem and the Linksys router which also has rudimentary SPI. I am running XP Pro SP2 on a Dell Dimension 8250 with an Intel Pro 10/100M LOM, and Norton Internet Security 2004. All patches, drivers, and antivirus up to date. I ran hijack this and nothing seemed out of the ordinary. I did a port scan at GRC and all seemed ok. I ran AdAware, SpyBot S&D, and Microsoft's Anti Spyware with no threats detected. I did online scans with Symantec, Bitdefender, eTrust, TrendMicro, Sygate Online Services, and PestPatrol. No threats detected. Couldn't get Panda's online scan to run after downloading the active x control and defs. I reinstalled NIS 2004. No difference. Services for remote access are disabled. The router and modem logs don't show any inbound or outbound connections when this happens but I don't think they log anything that is not a www connection. In the event viewer the security log shows an anonymous network logon (type 3). I suspect an unknown trojan that is tied into the system account but don't really know. The Intel Pro LOM is set to Wake on All. Is there some vulnerability when using hibernate or standby and the nic is set to wake? Would QOS constantly ping the router? It would seem unlikely a trojan could run with the computer in hibernate but I'm not sure. The event viewer does show the Telephony service as starting when the computer hibernates but that may be tied into Windows ICF which isn't enabled for my Lan connection but seems to have some functionality before NIS starts.

jmwills · Answer

How about some punctuation next time? The post is awfully difficult to read.

Yes, your machine will send out packets as a way of asking, "is there anything for me on the LAN?"

My guess is that you may have a trojan e-mail system send mail thur your ISP from your machine. These have become a big threat within the last six months or so.

9Hoku · Answer

Thanks for the reply. I'm sorry the post was hard to read. I ran two trojan specific scanners. Both TrojanHunter and TDS-3, from DiamondCS, reported no trojans found. I ran an online scan from f-secure and it didn't find anything either. Just to be safe I am using the classic logon in XP with Ctrl+Alt+Del required to access the logon screen. I think if I had a trojan sending mail thru my ISP, a connection would show up in the outgoing logs of my router and modem. I can't think of any way to monitor port activity with the computer in hibernate or standby. So, I just won't use hibernate or standby. It seems strange that my LAN status would show over 4 billion packets being sent in 1 hr. and 12 min. elapsed time while the system is in hibernate.

ostell · Answer

If you look in Network Connections in Control Panel have you got an item labeled something like "Intenet gateway Device"? I found this after changing to a modem/switch after running an ADSL modem and ICS. This device was sending out packets around the network, though not apparently into the internet, even though there should have not been any activity.

This is a "Feature" of windows XP trying to be clever. Removed by removing it from Network Services in add/remove system components.

Details in page support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B821980&Product=winxp

I thought I had a virus or spyware but it turned out to be this crittur.

jmwills · Answer

An 'Internet Gateway Device' is your router.

9Hoku · Answer

Thanks for the replies. In LAN properties, I set wake on settings to disabled. In Contol Panel > Add/Remove Windows Components > Networking, I unchecked Internet Gateway Device discovery and control client. All options are now unchecked in the Networking components. I restarted the computer and let it run a couple of minutes. Checked LAN status and only a few packets sent and recvd. Put the computer in hibernation for one minute. Started back up and the LAN status showed 4,294,967,300 packets sent and 31 rcvd. I watched the router status lights as I did that and the LAN light blinked once. The internet status light on both the router and modem stayed lit and steady. IIS not installed.

Dell Dimension 8250 PIV 2.4 GHz
XP Pro SP2, NIS 2004 all updated, patched
768 MB PC1066 RDRAM
WD 120 GB, WD 80 GB
Intel Pro 10/100 M LOM
Only computer active on LAN
Linksys WRT54G Wireless Broadband router NAT, basic SPI, WPA-PSK
Actiontec GT701 WG, wireless disabled, basic security- NAT only

Networking, Internet, & Bluetooth

LAN packets sent when computer in hibernate or standby

Was this post helpful?