Mystery network traffic

[Control]

I installed nload with ipkg on my wl500-gx. ifconfig shows me the following network interfaces:

br0
eth0
eth1
lo
vlan0
vlan1

if I monitor them with nload, it shows them all to be fairly quiet (~0.7 KBit/s) except for eth0 and vlan1, which constantly show traffic between 20 and 75 kBit/s. In both cases, this traffic is incoming, with a far smaller amount outgoing. If I understand this correctly, vlan1 is the NIC which is connected to my cable modem, but I'm not sure what eth0 is. I have three computers connected to the wl500-gx, plus a USB printer and a USB HDD. Wireless is turned off and the web interface shows no dhcp leases (the three computers have manually assigned IPs). If I didn't know better, I'd say someone was downloading pr0n or something over my line, but that really can't be.

Any ideas?

[ega2002]

Please take a look at this picture:



Though it is for Linksys WRT54, I guess it can be used for Asus as well

[Control]

Ok, that makes sense. Thank you.
So seeing incoming traffic on vlan1 and eth0 means I have packets coming from the outside WAN (cable modem), and going to my wl-500g. But why is it so high. What's my router permantly downloading?

[ega2002]

Ok, that makes sense. Thank you.
So seeing incoming traffic on vlan1 and eth0 means I have packets coming from the outside WAN (cable modem), and going to my wl-500g. But why is it so high. What's my router permantly downloading?

Most likely broadcast/multicast packets.

[Control]

70 KBit/s ? Isn't that a bit high for just administrative traffic?

Here's the output from nload vlan1:

Curr:19.59 kBit/s
Avg: 23.61 kBit/s
Min: 10.98 kBit/s
Max: 94.30 kBit/s
Ttl: 22.51 MByte

Those total 22.5MB are since three hours ago, when I rebooted my wl-500gx.

[ega2002]

70 KBit/s ? Isn't that a bit high for just administrative traffic?

Multicast isn't "administrative traffic", it is used for example for internet radio or TV. Anyway, some kind of traffic analyzer (e.g. iptraf) may help you.