Unusual Bandwidth Usage From LLNW.NET
I have been watching a bit of web traffic occurring regularly on our servers; the traffic points to a domain of llnw.net. All of the connections resolve to various addresses under Limelight Networks Inc. One interesting observation is they are, per machine, all at the same number of minutes per day, e.g. 15:55, 16:55,20:55, 21:55. The website at www.llnw.net brings up a 403 access error.
There is some information about Limelight networks on the Wiki page http://en.wikipedia.org/wiki/Limelight_Networks. An observation on the Wiki is that in August 2007 Limelight signed a content delivery agreement with Microsoft. More details of their services can be found in High-Performance CDN For Digital Media.
So, it looks like some kind of content delivery from Microsoft, possibly Microsoft Update (but the times don’t seem to tally). I will post more about this if I find anything further.
Tags
Curiosities-
LLNW.net is Limewire. They are the number 2 service provider behing Akamai.net.
Akamai is based in Cambridge, Massachusetts and Limewire like Akamai has branch offices throughout key points in the US. There was once a running legal battle between these two companies who have put their differences aside so as to sieze market share respectively.
I guess the pie is big enough that they both make billions. Mesa based Limewire does offer content of the multi-media sort as does Akamai, but they go a little further. It appears that each has positioned themselves at the routing bases across the country so as to better able offer content without hogging the bandwidth from coast to coast, thereby speeding delivery.Who do they offer content for? Facebook, Microsoft, and any other HTTPS type of service that is out there who looks to dish off their inhouse support and opt for more centralized content delivery that is based across the US, much like the TUCOWS servers used to do with FTP delivery a couple of decades ago.
Plusses= speedy content delivery and a seemingly secure way of doing this.
minuses= unsecure ports are open doors for those unscupulous people that work for corporations and can use the routers to play man-in-the-middle.If you understand what you just read, then you do realize the implications. As always when using the internet, beware. The safest content is over a VPN, using token authentification. Everything else is clear text until it hits a server.
You want to stop this traffic? A reasonable thought. disable automatic updating on every piece of software on your machines. When you do check for updates, you will see these entries again, unless you are connecting to acontent that is directly authenticated through either Akamai or Limewire.
These are not only content delivery companies, but they also host seemingly secure logons.
Have a great day, I am an MCSE and I do care about my network — if you are reading this, obviously, you care too.
-
I see this traffic when my DirecTV box is downloading HBO on demand. Roku/Netflix also uses them.
-
Also, just for the record, Steam (popular PC gaming server / client) uses lax.llnw.net. Took me a little while to track it down to that one but it is the culprit.
Comments