Arch Linux

skanky

Member

From: WAIS

Registered: 2009-10-23

Posts: 1,847

Network device in constant use...

My wireless device, wlp16s0 is in constant use and racking up a fair usage:

# ip -s link
....
3: wlp16s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT qlen 1000
    link/ether 00:19:d2:26:99:51 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    62610024   94357    0       0       0       0      
    TX: bytes  packets  errors  dropped carrier collsns 
    4159256    38443    0       0       0       0      

- I know the amounts are usage dependent but I can watch it growby repeating the command.

I used lsof -i and shut down avery process listed there. I have a status script that calls the network every five minutes or so, and didn't shut that down, but this usage is more frequent than that.

I'm not running a firewall, and am behind a NAT router with no forwarded ports.

I'm fairly sure that I've seen discussions of this sort of thing before somewhere but can't find anything relevant - probably just not getting the right search terms.
I've tried ss, but don't really know what I'm looking for.

If anyone can tell me how to track down what's doing this, I'd be grateful.

---

"...one cannot be angry when one looks at a penguin."  - John Ruskin
"Life in general is a bit shit, and so too is the internet. And that's all there is." - scepticisle

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,677

Re: Network device in constant use...

wireshark ?

edit:
netstat?
iotop?

Last edited by ewaller (2013-02-25 00:05:34)

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way

skunktrader

Member

From: Brisbane, Australia

Registered: 2010-02-14

Posts: 1,677

Re: Network device in constant use...

nethogs

skanky

Member

From: WAIS

Registered: 2009-10-23

Posts: 1,847

Re: Network device in constant use...

Thanks for the suggestions. I don't have netstat installed and thought ip and ss replace it?

I will try the others though.

---

"...one cannot be angry when one looks at a penguin."  - John Ruskin
"Life in general is a bit shit, and so too is the internet. And that's all there is." - scepticisle

skanky

Member

From: WAIS

Registered: 2009-10-23

Posts: 1,847

Re: Network device in constant use...

Okay, I think I've solved it, thanks to the above.

When I close down all network using processes the Rx for wlan still keeps on climbing at a slow but steady rate. Tx too, but a lot less so.
However nethogs shows nothing using the device and iostat suggests the same.

nload says an average rx of about 600bits/s.

A peruse of a wireshark dump shows my router spamming the network with 1-2 ARP broadcasts a second "who has 192.168...etc.". This seems to be the way these routers (it's a BT hub which are made by 2wire) and I can't turn it off.

Does this pass the smell test, anyone know?

I've not yet checked the ethernet device - I noticed this while not plugged in and via the wifi led always flashing - but will do so.

---

"...one cannot be angry when one looks at a penguin."  - John Ruskin
"Life in general is a bit shit, and so too is the internet. And that's all there is." - scepticisle

Stebalien

Member

Registered: 2010-04-27

Posts: 1,239

Website

Re: Network device in constant use...

Or someone could be trying to crack your wifi (unlikely)... http://www.aircrack-ng.org/doku.php?id= … einjection

---

Steven [ web : git ]
GPG:  327B 20CE 21EA 68CF A7748675 7C92 3221 5899 410C

skanky

Member

From: WAIS

Registered: 2009-10-23

Posts: 1,847

Re: Network device in constant use...

Or someone could be trying to crack your wifi (unlikely)... http://www.aircrack-ng.org/doku.php?id= … einjection

Don't think that's the case, thanks.

Incidentally, the ethernet card picks up the broadcasts, but it doesn't seem to carry as much traffic as the wireless - though I've not taken any hard numbers, so that's just (probably incorrect) perception.

---

"...one cannot be angry when one looks at a penguin."  - John Ruskin
"Life in general is a bit shit, and so too is the internet. And that's all there is." - scepticisle