Log in

Bekijk de volledige versie : Mystery network traffic


Control
29-04-2006, 08:44
I installed nload with ipkg on my wl500-gx. ifconfig shows me the following network interfaces:

br0
eth0
eth1
lo
vlan0
vlan1

if I monitor them with nload, it shows them all to be fairly quiet (~0.7 KBit/s) except for eth0 and vlan1, which constantly show traffic between 20 and 75 kBit/s. In both cases, this traffic is incoming, with a far smaller amount outgoing. If I understand this correctly, vlan1 is the NIC which is connected to my cable modem, but I'm not sure what eth0 is. I have three computers connected to the wl500-gx, plus a USB printer and a USB HDD. Wireless is turned off and the web interface shows no dhcp leases (the three computers have manually assigned IPs). If I didn't know better, I'd say someone was downloading pr0n or something over my line, but that really can't be.

Any ideas?
ega2002
01-05-2006, 19:39
Please take a look at this picture:

http://cobaltech.org/e107_images/WRT54_sw2_internal_architecture.png

Though it is for Linksys WRT54, I guess it can be used for Asus as well
Control
02-05-2006, 05:21
Ok, that makes sense. Thank you.
So seeing incoming traffic on vlan1 and eth0 means I have packets coming from the outside WAN (cable modem), and going to my wl-500g. But why is it so high. What's my router permantly downloading?
ega2002
02-05-2006, 07:56
Ok, that makes sense. Thank you.
So seeing incoming traffic on vlan1 and eth0 means I have packets coming from the outside WAN (cable modem), and going to my wl-500g. But why is it so high. What's my router permantly downloading?
Most likely broadcast/multicast packets.
Control
02-05-2006, 08:50
70 KBit/s ? Isn't that a bit high for just administrative traffic?

Here's the output from nload vlan1:

Curr:19.59 kBit/s
Avg: 23.61 kBit/s
Min: 10.98 kBit/s
Max: 94.30 kBit/s
Ttl: 22.51 MByte

Those total 22.5MB are since three hours ago, when I rebooted my wl-500gx.
ega2002
02-05-2006, 09:59
70 KBit/s ? Isn't that a bit high for just administrative traffic?
Multicast isn't "administrative traffic", it is used for example for internet radio or TV. Anyway, some kind of traffic analyzer (e.g. iptraf (http://wl500g.info/showthread.php?t=666)) may help you.