I have been running WireShark on one of our VMs that is up in Microsoft Azure and I'm seeing quite a bit of BOINC traffic. However, it doesn't appear to be installed on the VM, or at least I am unable to find it in 'Services' or in either of the 'Program Files' folders. How would I find BOINC in this instance and remove it, or does MS use it for some reason in Azure?

Thank you for any help.

Wayne Pfeffer

quite a bit of BOINC traffic

What is "quite a bit of BOINC traffic"? How do you recognize it? And can't you use Wireshark to see what directory it comes from? A person installing it doesn't need to install it in the regular directories, or as a service. We don't know if MS uses (leftover) CPU cores for BOINC, you'd have to ask them that.

You can always ask MS Azure Support to check the machine out.
No, we don't condone people using machines they don't own.

This is a sample of the traffic that I'm seeing:

1379	47.863861	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TLSv1.2	1390	Application Data [TCP segment of a reassembled PDU]
1380	47.863861	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=172987 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1381	47.863861	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=174323 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1382	47.863861	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=175659 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1383	47.863861	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=176995 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1384	47.863861	blob.sn1prdstp01a.store.core.windows.net	110.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=178331 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1385	47.864043	10.XXX.XXX.XXX	blob.sn1prdstp01a.store.core.windows.net	TCP	54	boinc-client(1043) → https(443) [ACK] Seq=5577 Ack=179667 Win=8235 Len=0
1386	47.864407	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=179667 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1387	47.864407	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX TCP	1390	https(443) → boinc-client(1043) [ACK] Seq=181003 Ack=5577 Win=8221 Len=1336 [TCP segment of a reassembled PDU]
1388	47.864407	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TLSv1.2	1348	Application Data
1389	47.864434	10.XXX.XXX.XXX	blob.sn1prdstp01a.store.core.windows.net	TCP	54	boinc-client(1043) → https(443) [ACK] Seq=5577 Ack=183633 Win=8235 Len=0
1652	62.874746	10.XXX.XXX.XXX	blob.sn1prdstp01a.store.core.windows.net	TLSv1.2	519	Application Data
1653	62.878054	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TLSv1.2	985	Application Data
1654	62.878387	10.XXX.XXX.XXX	blob.sn1prdstp01a.store.core.windows.net	TLSv1.2	519	Application Data
1655	62.879984	blob.sn1prdstp01a.store.core.windows.net	10.XXX.XXX.XXX	TLSv1.2	985	Application Data
1656	62.880260	10.XXX.XXX.XXX	blob.sn1prdstp01a.store.core.windows.net	TLSv1.2	518	Application Data

The 10.XXX.XXX.XXX address is for the same machine.

Thank you for any help you're able to give.

Wayne Pfeffer