Network traffic to a PC, but PC Off.

I am no network expert.

Using LanView Packet Capture, I noticed recently that even if a PC (on a
LAN) is off, internet traffic was still directed at this PC (the destination
IP identifies the PC).

Is this normal ?

Thanks.

sl@exabyte pisze:
> I am no network expert.
>
> Using LanView Packet Capture, I noticed recently that even if a PC (on a
> LAN) is off, internet traffic was still directed at this PC (the destination
> IP identifies the PC).
>
> Is this normal ?
>
> Thanks.
>
>

Yes it's normal.
For example if one host (A) sends packet to host (B), the packet is sent
even if host B is down and packets with destination ip of host B appears
in network.

The question is how long yours PC is down. There may be some active
connections on your NAT router.
Also if there are some ports redirected to that PC the packets will appear.

--
Regards
Dariusz Malec

Dariusz Malec wrote:
>
> Yes it's normal.
> For example if one host (A) sends packet to host (B), the packet is
> sent even if host B is down and packets with destination ip of host B
> appears in network.
>
> The question is how long yours PC is down. There may be some active
> connections on your NAT router.
> Also if there are some ports redirected to that PC the packets will
> appear.

If the destination PC is off, say at least 45minutes, is this normal ?
Thanks.

On 2010-05-14, sl@exabyte <(E-Mail Removed)> wrote:
> I am no network expert.
>
> Using LanView Packet Capture, I noticed recently that even if a PC (on a
> LAN) is off, internet traffic was still directed at this PC (the destination
> IP identifies the PC).

How is the rest of the net to know that the PC is off?
It is of course possible that there is another computer on the network
who is using the same IP address (Is it static or dhcp?)

>
> Is this normal ?
>
> Thanks.
>
>

On Fri, 2010-05-14 at 16:24 +0800, sl@exabyte wrote:
> I am no network expert.
>
> Using LanView Packet Capture, I noticed recently that even if a PC (on a
> LAN) is off, internet traffic was still directed at this PC (the destination
> IP identifies the PC).
>
> Is this normal ?

Yes (probably).

Newer devices can be probed for inventory/asset purposes even when off (for example, Intel AMT).

There can be other reasons as well. Good time to get to know your hardware.

sl@exabyte pisze:
> I am no network expert.
>
> Using LanView Packet Capture, I noticed recently that even if a PC (on a
> LAN) is off, internet traffic was still directed at this PC (the destination
> IP identifies the PC).
>
> Is this normal ?
>
> Thanks.
>
>
How much traffic have you noticed? And what protocols?

--
Regards
Dariusz Malec

Dariusz Malec wrote:
> sl@exabyte pisze:
>> I am no network expert.
>>
>> Using LanView Packet Capture, I noticed recently that even if a PC
>> (on a LAN) is off, internet traffic was still directed at this PC
>> (the destination IP identifies the PC).
>>
>> Is this normal ?
>>
>> Thanks.
>>
>>
> How much traffic have you noticed? And what protocols?

Sorry, never at PC yesterday.

As to how much traffic, I am not sure how to describe; but I see packet size
of 60-80 (I think, not sure it is unit K) coming from a bunch of IPs. As I
see the switch (a mini-switch in front of me) it continually blinks, and the
LanView shows the packet info.

It just keeps blinking, till I decide that something may be wrong that I
switch off the boradband modem for 5 minutes or so. I know the other PC is
not on and it is using a static IP.

Dariusz Malec wrote:
> sl@exabyte pisze:
>> I am no network expert.
>>
>> Using LanView Packet Capture, I noticed recently that even if a PC
>> (on a LAN) is off, internet traffic was still directed at this PC
>> (the destination IP identifies the PC).
>>
>> Is this normal ?
>>
>> Thanks.
>>
>>
> How much traffic have you noticed? And what protocols?

Sorry, it is UDP.

On 2010-05-16, sl@exabyte <(E-Mail Removed)> wrote:
> Dariusz Malec wrote:
>> sl@exabyte pisze:
>>> I am no network expert.
>>>
>>> Using LanView Packet Capture, I noticed recently that even if a PC
>>> (on a LAN) is off, internet traffic was still directed at this PC
>>> (the destination IP identifies the PC).
>>>
>>> Is this normal ?
>>>
>>> Thanks.
>>>
>>>
>> How much traffic have you noticed? And what protocols?
>
> Sorry, never at PC yesterday.
>
> As to how much traffic, I am not sure how to describe; but I see packet size
> of 60-80 (I think, not sure it is unit K) coming from a bunch of IPs. As I
> see the switch (a mini-switch in front of me) it continually blinks, and the
> LanView shows the packet info.
>
> It just keeps blinking, till I decide that something may be wrong that I
> switch off the boradband modem for 5 minutes or so. I know the other PC is
> not on and it is using a static IP.

What kind of broad band modem? ADSL. cable?
It might be that your machine is comprimized and the traffic is someone
trying to use your machine. It could be that this is just broadcast
traffic, or arp requests (the small packets would indicate that).
Are you getting one packet a minute, a second, a millisecond?

>
>
>

>> Sorry, never at PC yesterday.
>>
>> As to how much traffic, I am not sure how to describe; but I see
>> packet size of 60-80 (I think, not sure it is unit K) coming from a
>> bunch of IPs. As I see the switch (a mini-switch in front of me) it
>> continually blinks, and the LanView shows the packet info.
>>
>> It just keeps blinking, till I decide that something may be wrong
>> that I switch off the boradband modem for 5 minutes or so. I know
>> the other PC is not on and it is using a static IP.
>
> What kind of broad band modem? ADSL. cable?
> It might be that your machine is comprimized and the traffic is
> someone trying to use your machine. It could be that this is just
> broadcast traffic, or arp requests (the small packets would indicate
> that).
> Are you getting one packet a minute, a second, a millisecond?

It is an ADSL modem.

Roughly 8 to 15 packets in one second to a single IP (computer off), and it
repeats until I decide to turn off the modem.

Sometimes turning the modem off one time does not work, ie it repeats after
turning on after a while (even though the PC is still off).

I believe (I did not notice) it only stops when the modem gets a different
WAN IP address.

Sorry for asking so much, just trying to learn to detect any mischief.
Thanks.