Some weeks ago I discovered my PC was haemorrhaging bandwidth at a ferocious rate. My previous 2 to 3 GB/day usage was being surpassed by 10+ GB/day in mystery downstream traffic. I had no idea why, and for the first time in my 4-year tenure with iiNet, I was hitting, then exceeding my monthly allowance of 200 GB.
I did the usual of course: checked that I wasn’t downloading any… ummm… big Linux ISOs; I changed the home WiFi password; ran anti-spyware and anti-malware utilities like Windows Defender, MBAM and Spybot; and even turned off DropBox and CrashPlan on all machines on the home network.
But no matter what I did, as long as my main PC was switched on, my internet bandwidth continued to trickle down at a constant rate of about 1 MB every second. This doesn’t sound like much, but it equates to about 3.5 GB /hour, and leaving my PC switched on while I wasn’t sitting at the console was beginning to have a serious impact on my monthly allowance.
The problem went unsolved for some days. I had a lot going on in IRL, not the least of which involved me moving house AND office space in the same week. After moving house and having to rely on mobile broadband connectivity because of unparalleled incompetence by iiNet (the subject of a pending blog post), the situation had become completely untenable. Mobile bandwidth is expensive and I was paying $70 for a data pack every few days.
I installed a software package called Internet Traffic Agent. This showed me all network traffic in and out of the machine, in an easy-to-understand format. (Unlike WireShark which many suggested and I’d also tried, although I suspect you need a university degree in networking to decipher its analysis results.)
ITA showed me that whenever Microsoft Outlook was running, a process was communicating with ”blogs.typepad.com” at IP address 188.8.131.52, at the rate of about 1 MB /sec. Okay, so I’d isolated the cause of the problem. Typepad is a blogging platform which I’d never used, and nothing in Task Manager or msconfig resembled a process by this name. Looking at Outlook’s plugins, I disabled each individually, then stopped and restarted Outlook, until I found the culprit.
The offending add-in was RSS Popper, an aggregation utility that uses the mscoree.dll. Despite some intensive Googling I was unable to find anyone else reporting similar unwelcome behaviour. My guess is that this add-in was aggregating blog feeds at Typepad – why, I have no idea – and downloading a never-ending stream of crud whenever Outlook was running.
So I disabled and removed the plugin from Outlook. Problem solved. I’m back to under 200 GB /month for home internet; that is, I would be, if I had home internet. Therein lies the next blog post.