Traffic overload even after uninstall/reformat

[imatechguy]

I'm rather new at this and after a polite but not so nice email from my ISP, unfortunately, I won't be getting any additional experience and removed all torrent associated files and programs.

I was concerned when uTorrent was installed because my PC was significantly slower performing task than it had been before I installed it. It would start out fine upon boot-up or waking from stand-by but after a few minutes it would slow significantly when trying to open/use any other program. After using the pause and stop buttons in the GUI for all torrent downloading and seeding, with no effect; I began browsing the FAQ, the guides and the forums for solutions. None of these sources provided a solution unfortunately. So this reduced usability coupled with the email from my ISP prompted me to cease my torrent activity.

So I wiped the drives, did a fresh install of XP and almost immediately after reconnecting to the internet with just the OS and security programs installed I experienced severe slow downs again. Checking the firewall it seems there is a connection attempt every couple of seconds on the previous port I had set up for uTorrent to use. With less than 18 hours of run time on this reformat my firewall has logged well over 66,000 connection attempts. Since I'd already deleted the torrent files, and then reformated my system I'm left wondering why there are so many connection attempts repeatedly being made. I'd understand if it was occasional attempts by the tracker sites (is that even how trackers work?) to "see" if I was seeding but this seems to be the end user traffic and each one comes through multiple times.

Since I don't even have uTorrent installed anymore I realize there probably isn't much that can be done to help. I just hope this might be of benefit to the dev's since there seem to be a lot of posts on the forums about system slow downs. I'll keep an eye out here in case there are some follow-up questions I can answer that can help out the community.

Thanks.

[thelittlefire]

If your computer can't handle the connection attempts... you may need to block that port completely. Are you behind a router?

[Switeck]

As far as I know, trackers don't contact peers or seeds. Peers and seeds are supposed to contact trackers instead.

If the incoming traffic is UDP, that's probably from having the DHT network enabled in uTorrent which generates UDP traffic from many "nodes" (other ips) on the network. They may persist in retrying your ip for potentially weeks, though the rate SHOULD decrease noticeably by then.

If you were running extremely busy torrents with 1000's of seeds+peers on them, they may still be retrying your ip for a few days...but that rate should die down rapidly over a few days to just a trickle of <10 ips per minute.

[Ultima]

Indeed, that'd just be peer caching taking effect in other clients. If your network is dying from a high volume of connection attempts (not even established connections), I'd be suspicious of the modem and/or router. What modem/router are you using?

[imatechguy]

Thanks for the responses all.

Not only was my connection excessively slow (cable broadband) but my HDD programs/documents were just as slow to respond as well. My system is a pretty good one: E6750 OC'd to 3.2Ghz, 2G DDR2-800 RAM on an Abit IP-35 MoBo. This only affected my PC as another PC's on the router functioned normally, even internet usage was normal or very close to it.

Currently I'm running a Trendnet 633GR wireless router and yes I've got it locked down tight with long and complex passwords, complex SSID name and every stealth option I can enable so I can confirm it isn't somebody pirating my connection. As well I've looked at both the current connections and the logs and there have been no suspicious connections or logged attempts.

I rebuilt all the port forwarding rules to block instead of allow/forward everything on the ports I'd opened/forwarded when I set uTorrent up. The log even shows that the router firewall is blocking connection attempts on the ports I've now set up to be blocked. Most of the attempts do seem to be TCP in nature though I vaguely recall UDP showing up occassionally. Just to reiterate the connection attempts I'm referring to are all directed at the port I'd previously set up as the forwarded port in my router.

I recently updated the Software firewall from ZA to PC Tools (both free versions) and have further gone in and locked down everything I can in the new firewall program. If I look at the activity page (I think it's called History) it shows a continuous string of connection attempts.

The fact that they were slipping through the router but the router was catching a boatload of them itself is what really caught my attention. As of last night I played around a bit and looked at recurring IPs and blocked about 15 or so of them in both the router and software firewalls. It seemed to slow things down a bit but I was still getting at least one blocked connection attempt every 3-4 seconds on the software firewall. I can also say that my program response time, though slow was closer to what I expected after doing all that.

I am hopeful this is just a peer or tracker cache issue and will eventually slow to nothing but I felt it might be of benefit in solving at least some of the issues for those who are experiencing slow downs with uTorrent running/installed.

Again thanks for any and all input/assistance.

EDIT: Oh, and none of the torrents were very busy ones that I remember.

[Switeck]

TCP View (3rd party app) may show what program/s are making these connections...IF your computer is the cause of them!

[imatechguy]

Thanks Switeck but that's not going to help me. Looking at the logs on from my router and my firewall the overload was coming due to Inbound attempts to connect with my PC. At this point it seems that traffic is lessening by the day and my PC is now what I would deem usable. It just seemed odd to me that with no torrent application running, and the program actually having been uninstalled, I was still getting "bombarded" with connection attempts. *Shrug* Oh well, I was just hoping that my issue might shed some light on the why others seem to be having similar problems when the uTorrent is still installed. Thanks again everyone for the help, advice and input. I'll still pop in every now and again to see if further questions arise.

Thanks.

[Firon]

Uninstall the PC Tools software and see if your performance improves. Don't bother trying to firewall specific IPs in your router either, it's just going to crash the router eventually. Routers are weak devices and really aren't very good firewalls, save for their NAT functions.

[gesingle]

I've noticed the same thing - connections continuing after uTorrent is uninstalled. As a newbie to torrent, I'm trying to understand what is going on. After uninstalling uTorrent, the Online Armor firewall began blocking connections, at about 1 a second, with the log showing "ICMP-> Destination unreachable 192.168.1.91 58.241.236.196, Blocked" (different IP each time). The reply about peer caching above helps explain these connections, but there's more. I did a system restore to a date before the installation, and this apparently stopped the activity and the block messages. So, was there a residual service left behind after uTorrent was uninstalled that was being blocked? If not, why would the system restore make a difference? A scan by NOD32 antivirus showed no malware.

[Firon]

You should allow ICMP in your firewall. That ICMP message basically tells the other side that there's nothing listening and to go away.

Your firewall is basically being way too paranoid.

[Switeck]

Simplest fix: change ports in uTorrent and UNFORWARD the previous port on your router.

Your computer won't overload from packets it never gets.

[gesingle]

Makes sense. Online Armor was, by default, set to not allow ICMP destination unreachable. Closing the port in the router stopped the traffic. Here's how I think it worked--when uTorrent was installed, the firewall was set to allow the connections, so nothing was blocked. When I uninstalled uTorrent, the peer caching connection attempts continued, but were no longer associated with an allowed program in the firewall. When the system handled the connection attempt with a "nothing here" ICMP reply, the firewall blocked the reply.

Imatechguy's report of 66,000 connection attempts in 18 hours is similar to the rate I was seeing after two torrents, so this may be typical.

Thanks for the help.