Veeam Agent 2.0 Idle "Loopback" Networktraffic

[DaStivi]

Hello there, can someone explain why Veeam Agent is pretty chatty on "Loopback" interface?
What i mean is that Veeam.EndPoint.Tray.exe and Veeam.Endpoint.Service.exe constantly send/receive around 60KB/sec between them! You can see this in the Ressourcemonitor of Windows pretty well:



i tried to sniff the data with wireshark but didn't found anything helpfull in the traces...


i'm just curious about such activitys, not only because of recent HP Sound driver Keylogger "bug"

[skochetkov]

Hey Stephan!

There is no conspiracy at all in this: Veeam Tray Agent and Veeam Service talk with each other by RPC in order to make tray agent being able to display updated statuses regarding backup job status/schedule and etc.

[DaStivi]

ok... but this 60kb/s sums up to 5TB per day on internal chitter chatter .... probably not that many users will notice this as available system resources shouldn't used that much but still i see some possibility that cpu doesn't throttle accordingly and energy saving settings on pcs are gonna be affected!

i've seen a couple of tray agents that are talking to some background services and the poll the service from time to time... but Veeam tray is constantly 24x7 talking to the service! i don't understand what purpose this should have... the Agentgui is closed in tray taskbar and the exe is constantly polling data...

[skochetkov]

ok... but this 60kb/s sums up to 5TB per day on internal chitter chatter .... probably not that many users will notice this as available system resources shouldn't used that much but still i see some possibility that cpu doesn't throttle accordingly and energy saving settings on pcs are gonna be affected!

i've seen a couple of tray agents that are talking to some background services and the poll the service from time to time... but Veeam tray is constantly 24x7 talking to the service! i don't understand what purpose this should have... the Agentgui is closed in tray taskbar and the exe is constantly polling data...

Hello Stephan,

Please let me explain a little bit more: loopback traffic goes only thru RAM, no NIC is used for this type of communication. Moreover, I can calculate only 5Gb per day of this traffic if we suppose that VAW components constantly create 60kb/s of it. In addition, this kind of communication won't prevent CPU throttling, if only BIOS or OS settings prevent that.

As for the closed tray agent question: the connection between service and tray closes a little bit later when all data between them is being transferred.

[DaStivi]

As for the closed tray agent question: the connection between service and tray closes a little bit later when all data between them is being transferred.

event if GUI is closed in the tray and no backup is running there is still traffic gooing on the whole day... but of course when closing gui/tray completely the traffic goes away shortly after...

when you says its ok... i just thought that it could be some bug... as i didn't notice such behaviour from other apps...

[Dima P.]

Hi Stephan,

Thanks for the feedback. As noted this behavior is by design and should not affect your network performance.

If UI is closed I assume you still have a tray app running thus you see the loop back traffic. Backup service is responsible for backup job handling while tray is basically displaying all the info gathered from the service.

By the way, you can disable automatic update check which is performed one time per day.

[trialperiod]

I've spotted this too. I'm not convinced that harmless in memory cycles would appear in my network traffic without impacting network or CPU cycles.

In fact the only reason I came across it was to diagnose some slow network performance, and VEEAM endpoint was right up there at the top.

Unconvinced and likely to remove this software.

[Dima P.]

Hi trialperiod,

As support folks confirmed above:

loopback traffic goes only thru RAM, no NIC is used for this type of communication

If you see or suspect different behavior please open a support case via Control Panel > Support > Technical Support (it's completely free) and we will gladly help to investigate this issue. Thanks!

[tinkererguy]

I realize this is kind of an old thread, but I thought I'd drop a quick update, in case it's helpful to others, with a newer screenshot in English language, using:
- Windows 10 Version 1803
- Veeam Agent 2.1.0.423 - Workstation Edition

I noticed:
static.audienceinsights.net
in the Address field of Windows Resource Monitor, which I'm not seeing mentioned in this forum or release notes. Ports 6183, 6184, 9395, and 52322. It seems to be there whether I have the "Automatically check and notify me on available updates" option checked or unchecked.

[Gostev]

These ports are documented in the User Guide > Used Ports

[Dima P.]

Hello Paul.

I noticed:
static.audienceinsights.net
in the Address field of Windows Resource Monitor, which I'm not seeing mentioned in this forum or release notes.

Check the machine hosts file. Since agent tray and service are talking with each other over the network socket you see should the local machines address there (unless host file is not modified).

[tinkererguy]

Good poing Dima P., for those following along, the hosts file gets this line added:

Code: Select all

127.0.0.1 static.audienceinsights.net

so it's just localhost.

[smazlum24]

Hi, When I write <127.0.0.1 static.audienceinsights.net> will I stop this network traffic? I've tried. I could not be successful. or I think so. Could you help ?

[Dima P.]

smazlum24,

Agent service and tray are talking with each other over the network socket and it's not possible to block this communication (unless you want to disable Veeam Agent for Windows completely). Can you please elaborate what goal you are trying to achieve? Thanks!