Bitten by BITS?

Topic

New Reply

Ok, so my PC is randomly using large chunks of bandwidth (40ish megs and up) for no apparent reason. (I’ve turned off auto-updates as per the Wisdom of Woody.) Using my friendly neighborhood Resource Monitor, I’ve tracked it down to svchost.exe (netsvcs). According to the internet, svchost.exe (netsvcs) is probably being run by Background Intelligent Transfer Service or BITS. So using the slightly less friendly neighborhood Computer Management, I set BITS to manual startup.

BITS was not amused.

After another bandwidth spike, I checked and BITS had reverted to “Automatic (Delayed Start)”. I set it back to manual. I close the preferences. I reopen them. Still manual. Go my merry way. Time passes. Bandwidth spike. Upon checking, BITS is set to “Automatic (Delayed Start)”

Thoughts?

LABS - a family friendly webcomic about scientists, robots and Wisconsin

Reply | Quote

Replies

I’ve not had it revert to automatic settings on my W7 machine.
What spec. is your machine? (i.e. which version of W7, what bitted-ness etc.)

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

My Win 7 SP1 machine has BITS set to Manual start by default. However, there are some pages suggesting the default start type is supposed to be Automatic (Delayed start). From the Windows Development Center’s page dealing with BITS default startup type we have:
“The Startup Type for BITS is delayed auto-start.
Prior to Windows Vista: The Startup Type for BITS is Manual. When a BITS job is created, the Startup Type changes to Automatic. The Startup Type returns to Manual when all jobs are complete or canceled.
You should not set the Startup Type to Disabled. Disabling BITS may break applications, such as Windows Update, that rely on BITS to transfer files.”
However, on a Microsoft Answers forum for Win 7, there is a MSMVP (Microsoft MVP forum moderator, etc.) who claims that the default setting for Win 7 SP1 is Manual startup type. Bear in mind that MS MVP’s are NOT Microsoft employees, but well informed computer professionals helping out with MS’s answers forums.
If you really want to set BITS to manual and have it “stick”, try the following:Go back into the Services window of the Computer management function and get back into the settings for BITS. In the window for BITS’ properties, click on the tab at the top that says “Recovery”. That’s where you’ll find options for what the service is to do if it is unexpectedly stopped or if it fails unexpectedly.

You’ll have four choices from a drop-down menu. You want to select “Take no action” for all three boxes (1st, 2nd, and subsequent failures). Click the “Apply” button at the bottom of the properties box.

NOW, click on the tab labeled “General” at the top of the window and stop the service, as well as setting the startup type to manual as you tried before, clicking “Apply” and “OK” after having changed the startup type.

Let us know here if this works for you.

EDIT html to text

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

Microsoft Answers forum is one of the most misleading forums that exists and unfortunately this is so because it is hosted by Microsoft and many uninformed people tend to trust it for this very reason. There is so much disinformation on Answers Forums that it is too difficult the distinguish from the very little good information which exists there.
BITS is a self-adjusting service which should be left alone. It changes its state according to circumstances. This is the reason why it can be seen either as Manual or Automatic (Delayed).
Its function can be disabled or adjusted according to needs by setting specific Group Policies, but this is beyond what most users require. Regular users who do not understand Group Policies in detail are better advised to leave BITS service alone.

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

Thanks, I think I’m best off following ch100’s advice and leave it alone…

LABS - a family friendly webcomic about scientists, robots and Wisconsin

Reply | Quote

? says:

If you use MSE it installs an idle background file scanning service.

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

Cartoonist Aaron, I think you received Good Info regarding BITS. But I don’t think anyone addressed the original symptom that had you looking for the disease. I have a left-field observation that I did not want to throw in the middle. But first:

Are you still, leaking doesn’t cover it, blasting random bursts over 40MB more than once a day? Specifically, did it only happen during 15JUN2017 (UTC)? Has it now stopped occurring?

I know I would not be content with that condition. In fact, it bothered me very much.

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

Cartoonist Aaron, does your surprise 40+MB bursts still continue today? Or was the behavior observed on one day only?

Again, I agree with advice above, but do not believe it adressed your problem’s root. If it has continued, please disregard all following in this comment, read only for entertainment. It does not apply.

I frequently refer to Wikipedia for a wide variety of useless trivia. I’m the kind of guy that can get lost in a web of cross-references, only to come up for air and wonder where two hours went. My burden. What I mean is, I’m fairly used to how it works in browsing. Front page is almost always a ½MB pageload, most articles are less, some are dense with images and cost more in data. I’m so used to it, I barely give it a thought.

On 15JUN2017, my day’s ration for data use was disappearing fast, so I started to pay attention. Convinced something malevolent had happened, I thought of anything unusual and recreated it. Nothing. I even checked traffic flow on AskWoody. Couldn’t find it. Went to look up a subject in Wikipedia because I also use it as an internet yellow-pages to verify published web addresses. My traffic meter hit 12MB and counting, fast. I shut my browser down. No more leak.

I have concluded it was a featured demonstration on the ‘Mandelbrot zoom sequence’ that appeared on the front page, below the fold, on that day. Unverified, because I have not revisited the article page for that item since it has been replaced on the front page. And, I wouldn’t know if it was only specific to that demonstration. I estimate a lose of around 125MB to that item, on that date, before I noticed it. That is approximately an entire day’s normal use for that machine.

The leak/blast has not returned since, so I am satisfied.

Does this describe your experience? Or did you not visit Wikipedia during your observed issue?

1 user thanked author for this post.

Cartoonist Aaron

Reply | Quote

Cascadian wrote:

Again, I agree with advice above, but do not believe it addressed your problem’s root.

This may be so because 40 MB is not a large amount of data based on current standards and as such is not seen as a problem?

Reply | Quote

Yes, ch100, on your machine that is true. But it had OP concerned enough to lift the hood and start making questionable changes that very likely did not address the leak he wished to plug. I thought I would bring the point back to his problem. I think I’ve agreed with you three times now, on this item alone. I would rather hear from OP, thanks.

Reply | Quote

It may be worth noting, Cartoonist Aaron, despite being a graphics artist/creative type, presents himself on a webpage that loads in around ¼MiB. Shockingly small in your terms. I do not know if this is from necessity, or a conscious choice he has made. But it speaks to his approach in this silicon world.

Reply | Quote

Never realized it was that small. I guess it’s at least partly attributable to learning web design back in the ancient times, when dinosaurs roamed the earth and everyone had dialup.

LABS - a family friendly webcomic about scientists, robots and Wisconsin

1 user thanked author for this post.

ch100

Reply | Quote

Sorry it took so long to reply. But no, I wasn’t on wikipedia, at least not the front page. Closing browsers doesn’t seem to stop it either.

These download bursts have happened before, and they go away after a while. I don’t believe I’ve had any the last couple days. Having not kept track of dates, I have the vague impression they happen shortly after Patch Tuesday. (I’ve had similar experiences when Java wanted to update, but I checked and it’s up to date.)

LABS - a family friendly webcomic about scientists, robots and Wisconsin

Reply | Quote

Yeah, I sloppily posted without signing in, which likely meant no notice was triggered. I reposted to address that failure, not from impatience. Knew it was a longshot possibility, but thought some reason was better than none.

Sorry to hear your phantom remains. More experienced than I feels it is negligible, so there you go. Recognize you know your system best.

Respect on your credentials. Was seriously surprised at the size of your page. Size does matter, inverse here. Don’t see that often. Cheers.

Reply | Quote

Update: I’ve been watching, and until today things seemed better for the most part. An odd thing I had stumbled on: The bursts seem to happen when a new version of Chrome browser is released. I don’t use Chrome, I use a non-Google variant of Chrome some. It’s portable and I have more than one copy, and “check for updates” was not disabled on all of them. So I thought that I may have plugged the hole, but it seemed odd so I kept an eye on it.

Today I had about 80mb go “poof” thanks to MpCmdRun.exe and its friends at deploy.static.akamaitechnologies.com.

This is at least the second time MpCmdRun.exe and deploy.static.akamaitechnologies.com have used up a burst of bandwidth, but last time it was a lot less. From what I read, MpCmdRun.exe is Windows Defender… which I don’t use… (I use MSE) Update history does list a failed MSE definition update about the time the burst started, but 80mb seems rather high for a definition update. And MpCmdRun.exe kept running (and downloading) after I manually updated definitions just to see if that was the problem. Finally I restarted and things are quiet…

LABS - a family friendly webcomic about scientists, robots and Wisconsin

Reply | Quote

I experienced the same today. MSE updated the latest definition update to 1.249.252.0. MSE says it was successful and Windows Update determines it ‘failed’.

Microsoft Malware Protection Command Line Utility received 123MB at the same time. This is not the size of the definition update – they are never this large.

This was preceded by Akamai netsession-win exec running. A bandwidth burst indeed.

Reply | Quote

Akamai netsession? Isn’t that a p2p program for delivering programs to you? (and uploading to others)

Reply | Quote

Yes it is. Unfortunately it is installed by other programs that need it (not Akamai). I checked to see if Microsoft uses it for MSE definitions and they do.

Reply | Quote

“Akamai netsession” the program, or “Akamai” the CDN?

There is a huge difference there.

The first is a p2p program for distributing software.

The second is a load balanced hosting system which huge numbers of websites and content distributions are backed by (possible MSE definitions).

Reply | Quote

Yeah, it looked like it was starting again today, but I jumped on it quick. MSE said it had just finished updating definitions, so I quickly restarted. That seems to convince it to not keep downloading.

I wonder if maybe it’s trying to download the entire definition instead of just an update?

Reply | Quote