Kaspersky, AVP, exe, traffic, software
Hello Kaspersky users!
In the previous stage, some users reported that there was a similar phenomenon of high upload and download traffic in avp.exe. Here, I will introduce the specific reasons of Kaspersky software and give you a clear statement.
Avp.exe process exists as the resident process of Kaspersky software system. In the system process list, there are two processes with the same name, one belongs to the system and the other belongs to the user, and the two processes are stationed in each other. Kaspersky network monitoring module applies for port 1 1 10 as Kaspersky traffic monitoring port through Kaspersky software. All network traffic entering and leaving the system will be scanned through Kaspersky traffic monitoring port 1 10, and then sent to the port used by the specific application accessing the network, so that the application can obtain the required information. Of course, this statement requires a condition, that is, it is set to "Monitor all ports" in the settings of "Network Ports" in "Settings", as shown in the following figure:
When we set this up, we can use Kaspersky's network monitoring function to check the current network access, as shown in the following figure:
We found the following characteristics:
1, 360se.exe First Line (360 browser) establishes a link with port 80 of server 8 1. 176.69.85 (Kabbah Family Forum Server) through local port 3997, and transmits 7KB data;
2. On the second line, avp.exe also established a link to port 80 of server 8 1. 176.69.85 (Kabbah Family Forum Server) through local port 3998, and transmitted 7KB of data;
3. In the third line, avp.exe monitors local port 3997 (the port used by 360 browser) through local port1/kloc-0 (Kaspersky network monitoring port) and scans 4.6KB of data.
To sum up, we can understand Kaspersky's thinking on network monitoring in this way. 360se.exe itself sends data through 3997. In fact, this 3997 port has been transferred by Kaspersky, and it is transferred to Kaspersky's 3998 port for outbound traffic scanning. When an external website sends traffic to port 3997 in 360se.exe, Kaspersky will also transfer this traffic target port from 3997 to Kaspersky's network monitoring module port 1 165438 for inbound traffic.
So, at this point, everyone will understand why Kaspersky avp.exe has network access traffic. If Kaspersky encounters the downloaded software running, it will also use the above method to monitor the incoming and outgoing traffic. When multiple ports such as BT and electric donkey need to be opened, the traffic in avp.exe will also increase with the size of downloading and uploading.
It should also be noted that Kaspersky 2009 and 20 10 series software have Kaspersky Secure Network (KSN) technology, which will also upload or download some data for analysis and killing. Generally, it will not exceed 5KB, and the traffic will only appear when you use scanning or start the program for the first time. The destination address of the traffic points to the KSN server.
In addition to the above, Kaspersky Software will not download or upload any user data. I want to emphasize the calculation principle of Kaspersky uploading and downloading data here:
Condition: "Monitor all traffic" is selected in the port settings of network settings. If port monitoring is specified, traffic will only appear when traffic appears on the specified port.
Formula: The sum of all software download and upload traffic is equal to the upload and download traffic displayed by Kaspersky Software (excluding the traffic generated by Kaspersky Secure Network).
I hope this article can answer your questions and clarify the relevant facts. There are similar problems in the forum in the future, so I will give this article directly to explain.