Modem light flashing when I'm not on-line?

Hi I have a Netgear DG834G v3, there are light's on the front that flash when I'm on-line, but I have started to notice that even when I'm not on-line these Flash (they never used to, just when I was on-line), At first I though it was the pc updating summit, But I've checked and nothing seem's to be updating, If I restart the pc then lights stay solid until I again go on-line??.

I have also been monitoring my Broadband usage through BT's own Monitor as I seemed to be using a lot of bandwidth, I had thought It was my brother who is also connected to the modem but have dissconected him from the modem, Yet still even when my PC is off I'm somehow using between 2-5gig a night????. The wirless was passworded at first then disabled.

Cheers for any help

Duffer

It seems like you have covered all the bases there. If you say you turn your PC off what do you have connected to it? Do you believe everything is turned off/disconnected over night? Have you tryed the experiment with all cables physcially up-plugged, just the router nothing more? If you have and are still using bandwidth, there are only 2 options I see remaining, you didn't actually turn the wireless off or you are being used as a DDOS reflector.

You could get your ISP to change your IP address, or if you are on a dynamic address turn your modem off while you are away (For more than 24 hours), that way it will probably lose your IP address. Personally I think you have not disabled the wireless correctly (sorry), are you sure you brother has not enabled it again? Have you change the default admin password on the box.


Edit:

Re-reading what you said... What do you mean by "online", do you mean "when I am using the web/email" or do you mean when my computer is turned on? ADSL/Cable modems are always on, your computer is on, you ARE online, you might not be using it yourself but your system is online. If you mean your computer is using bandwidth while you are not at the keyboard... 5-6 gigs to me would indicated you have a virus/trojan on your machine and someone else is remotely controlling it probably to send email. You could try updaing your anti-virus however this may not work as the bad program is in first so can prevent any anti-virus from working! In which case your need to reinstall the whole system, it is the only way to be sure.

There should be an LED on the front that says whether wireless is enabled or not. (I assume you meant that the wireless cpability was witched off, not that the password/security functions were disabled! If that is the case, then someone is using your wireless connection)

As Oolon says, try leaving he computer switched of and check that there is no useage, and again make sure that the router's system/admin password hasn't been compromised. Once you have done that, reconnect your computer (using a cable interface) and then check useage again. There will be a little bit (very small) but if it is the Gb range, there is definitely something unexplained going on.

make sure your wireless is secure and do a scan with this

http://www.malwarebytes.org/

Take a screenshot of your wireless security page on your router

Quote:

---

Originally Posted by bledd

Take a screenshot of your wireless security page on your router

---

Sounds like your connection is being used.......esp. if your PC is off.

Change your wireless password and maybe the access password to the router.

Thanks for the replys chap's.

What I mean by on-line is that I'm using the web/email.
All the lights on the front of the modem are off except for the power light and the light thats look's like an "i" with a circle below it.
I have run malware, avast, TDSSKiller, spybot Search & Destroy and advanced system care on both machines and nothing.

What's a DDOS reflector???.

Cheers Duffer

DDOS reflector means someone sends a packet of information to your machine with a spoofed address on it so when your machine replies it sends the error to the victim machine. Its a way for attackers to hide, however it isn't very common, as generally they just use a bot net of zombie computers instead. Relection attacks can send 2 or 3 times the amount of information out as used to trigger them so are used by "experts" to increase the payload. However just to repeat I really don't think this is happening to you.

Its quite simple really, if you don't use bandwidth when all your machines are turned "OFF", (that does not mean when your not using the web/email), as I really explained that means nothing as your machines can talk on there own. If you use bandwidth in this case, its a wi-fi attacker.

If your using bandwidth why the machine is turned on, that means you have something bad running on your machine no matter what other programs might think. A root kit can hide from them all if it imbeds correctly. I think you should consider installing an personal firewall like zone-alarm, that will tell you exactly which programs are trying to gain access to the network and allow you to approve/deny them access.

Thanks for the reply oolon, I have disconnected both computer's fron the modem as in I have removed the ethernet cable from both pc's so that no pc is connected, I have checked to make sure the wirless is disconnected and it is, yet still when i plug in my pc in the morning bt's download manager says I've used 1-3gig. yet during the day when I'm at work nothings getting used, it just seems to be at night.

Think its time to change BT, Also going to flatten the pc (though I aint looking forward to that lol :)).

Cheers duffer.

I would get your IP changed first. If you explain the situation to VM they should do it for you, but you can do it yourself by changing the MAC of the adapter facing the modem (usually the router's WAN port). To do this, look for an option called 'clone MAC' or similar on the router, and it usually lets you use your PC's address. You can use this or change it a bit if you like, just keep the digits hex i.e. between 0 and f. It's not really important what you set it as - nothing beyond the modem will rely on it. Then reboot modem+router and you should have a new IP.

Easiest way to see what traffic is flowing on your network is with Wireshark. Install wireshark on your pc and you can see what packets are going in and out. You may have a virus thats eating up bandwidth.

It can be quite daunting looking at a page of packets, but this guide helps you through it:

http://portforward.com/networking/wireshark.htm

Wireshark is very beginner-unfriendly, not sure I'd recommend it in this case.

Does the 1-3 gig usage account for your own use at all? (anything within the past 48 hours let's say) Just in case BT doesn't update the stats in real time and you might be mistaking them for that; you might be using the connection yourself and checking when it hasn't updated and then stopped using the connection and checked to see it has updated.

Here's 2 variations of turning stuff off you can try:
1. Turn off all connected devices for 24 hours and compare usage before/after (take note if wireless is enabled)

2. Turn off your router for 24 hours and compare before/after

If you still get usage with number 1 then it could have something to do with your connection/wifi/router etc
If you still get usage trying number 2 then this tells you it's out of your control and you should ring your ISP.

All this is very difficult because you don't know how often BT updates the usage stats and how up to date the stats are. (The numbers could be from 1+ days ago for all you know)

Umm, might be a dumb idea , coz your already talking about wiresharking.....

but why not
Increase your DHCP lease to 30 days
leave it a week
check your DHCP pool?



COCO

I have that model of router. (Though I don't know the version number).

On mine it is possible to physically unscrew and remove the wireless antenna. You could remove your antenna so as to be absolutely sure that the wireless is disabled, as that would eliminate even the faint possibility of something like hacked firmware on the router that makes it look as if you have turned off the wireless when it is still running.

Also, for the record, the activity light on my router does not flash continuously, only when I do something online like click a link on a webpage or suchlike.

Edit:

Another way of tracking usage is via the Statistics page on the router web interface. If you go into the web interface, on the first page at the bottom there is a button marked "show statistics". If you click that you get a popup with your connection speed and your current and cumulative usage of the WAN (ADSL) LAN and Wireless interfaces. If you monitor the cumulative WAN usage over time then you can build up a picture of the bandwith usage on your connection, without the need to use BT's usage monitor (which might be out of date).

I have written a Perl script that automatically monitors that page and logs statistics to CSV files or database. Please let me know if you would like a copy.

Removing the antenna will not disable the wireless radio in most cases, it will just make the signal much weaker.