excessive network traffic

unsobill · Aug 23, 2011

Hello, my FreeBSD box is under constant network pressure... Where should i look for source of traffic ?

Could it be bad NiC card or postfix or something else ?

Code:

Nload output Incoming:                                               Curr: 2.77 kBit/s
                                                                     Avg: 2.20 kBit/s
                                                                     Min: 944.00 Bit/s
                                                                     Max: 5.91 kBit/s
                                                                     Ttl: 701.66 MByte

Code:

Nload output Outgoing: 
                                                                     Curr: 8.04 kBit/s
                                                                     Avg: 7.95 kBit/s
                                                                     Min: 5.15 kBit/s
                                                                     Max: 9.34 kBit/s
                                                                     Ttl: 292.24 MByte

Code:

server# netstat -w1
            input        (Total)           output
   packets  errs idrops      bytes    packets  errs      bytes colls
         9     0     0        272          6     0          0     0
        14     0     0        272          9     0        170     0
         3     0     0        423          1     0        212     0
         4     0     0        120          1     0        170     0
         4     0     0        300          2     0        170     0
         2     0     0        120          1     0        170     0
         5     0     0        120          1     0        170     0
         2     0     0        120          1     0        170     0

Code:

root        11 100.0  0.0     0     8  ??  RL    9Aug11 18987:42.60 [idle]
root         0  0.0  0.0     0    56  ??  DLs   9Aug11   0:01.19 [kernel]
root         1  0.0  0.0  2912   360  ??  ILs   9Aug11   0:00.18 /sbin/init --
root         2  0.0  0.0     0     8  ??  DL    9Aug11   0:00.01 [g_event]
root         3  0.0  0.0     0     8  ??  DL    9Aug11   0:13.63 [g_up]
root         4  0.0  0.0     0     8  ??  DL    9Aug11   0:22.20 [g_down]
root         5  0.0  0.0     0     8  ??  DL    9Aug11   0:02.53 [fdc0]
root         6  0.0  0.0     0     8  ??  DL    9Aug11   0:00.00 [sctp_iterator]
root         7  0.0  0.0     0     8  ??  DL    9Aug11   0:00.00 [xpt_thrd]
root         8  0.0  0.0     0     8  ??  DL    9Aug11   0:00.73 [pagedaemon]
root         9  0.0  0.0     0     8  ??  DL    9Aug11   0:00.00 [vmdaemon]
root        10  0.0  0.0     0     8  ??  DL    9Aug11   0:00.00 [audit]
root        12  0.0  0.0     0   144  ??  WL    9Aug11   9:44.12 [intr]
root        13  0.0  0.0     0     8  ??  DL    9Aug11   0:28.57 [yarrow]
root        14  0.0  0.0     0   128  ??  DL    9Aug11   0:12.50 [usb]
root        15  0.0  0.0     0     8  ??  DL    9Aug11   0:00.01 [pagezero]
root        16  0.0  0.0     0     8  ??  DL    9Aug11   0:03.00 [bufdaemon]
root        17  0.0  0.0     0     8  ??  DL    9Aug11   0:05.80 [vnlru]
root        18  0.0  0.0     0     8  ??  DL    9Aug11  31:58.29 [syncer]
root        19  0.0  0.0     0     8  ??  DL    9Aug11   0:06.57 [softdepflush]
root     28481  0.0  0.1  1888   524  ??  Is    3:25PM   0:00.00 /sbin/devd
root     28680  0.0  0.1  3352  1096  ??  Ss    3:25PM   0:00.01 /usr/sbin/syslogd -s
root     28986  0.0  0.3  6712  3148  ??  Is    3:25PM   0:00.00 /usr/sbin/sshd
root     29010  0.0  0.1  3380  1152  ??  Is    3:25PM   0:00.01 /usr/sbin/cron -s
root     29159  0.0  0.1  3532  1428  ??  Is    3:25PM   0:00.02 /usr/local/libexec/postfix/master
postfix  29160  0.0  0.1  3532  1428  ??  I     3:25PM   0:00.01 pickup -l -t fifo -u
postfix  29161  0.0  0.1  3532  1480  ??  I     3:25PM   0:00.01 qmgr -l -t fifo -u
root     29195  0.0  0.4  9436  3884  ??  Is    3:30PM   0:00.07 sshd: user [priv] (sshd)
user     29198  0.0  0.4  9436  3876  ??  S     3:30PM   0:00.40 sshd: user@pts/0 (sshd)
root     29114  0.0  0.1  3816  1508  v0  Is    3:25PM   0:00.02 login [pam] (login)
root     29162  0.0  0.2  5656  2340  v0  I     3:25PM   0:00.06 -csh (csh)
root     29275  0.0  0.1  3548  1272  v0  I+    3:40PM   0:00.00 less
root     29115  0.0  0.1  3352   920  v1  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv1
root     29116  0.0  0.1  3352   920  v2  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv2
root     29117  0.0  0.1  3352   920  v3  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv3
root     29118  0.0  0.1  3352   920  v4  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv4
root     29119  0.0  0.1  3352   920  v5  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv5
root     29120  0.0  0.1  3352   920  v6  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv6
root     29121  0.0  0.1  3352   920  v7  Is+   3:25PM   0:00.00 /usr/libexec/getty Pc ttyv7
user     29199  0.0  0.1  3632  1380   0  Is    3:30PM   0:00.01 -sh (sh)
root     29200  0.0  0.1  3812  1500   0  I     3:30PM   0:00.01 su
root     29201  0.0  0.3  5656  2800   0  R     3:30PM   0:00.20 _su (csh)

DutchDaemon · Aug 23, 2011

Your 'network pressure' is 2-9 kilobits per second? Are you on a 9600 baud modem? That isn't even traffic, that's background noise. A few DNS queries will cause that, e.g. when you have set a log file to resolve IP addresses to hostnames.

wblock@ · Aug 23, 2011

NTP traffic can account for that, too.

unsobill · Aug 23, 2011

DutchDaemon said:
Your 'network pressure' is 2-9 kilobits per second? Are you on a 9600 baud modem? That isn't even traffic, that's background noise. A few DNS queries will cause that, e.g. when you have set a log file to resolve IP addresses to hostnames.

thanks, im just concerned with Ttl: 701.66 MByte value. Is that daily value or total traffic passed ? and how to view whats total traffic passed using ifconfig ?

SirDice · Aug 23, 2011

unsobill said:
thanks, im just concerned with Ttl: 701.66 MByte value. Is that daily value or total traffic passed ?

Total since the interface went up.

and how to view whats total traffic passed using ifconfig ?

You don't, that's what netstat(1) is for.

wblock@ · Aug 23, 2011

net-mgmt/darkstat can be helpful in seeing what's happening. There are much larger and more capable ports like net-mgmt/mrtg and net/ntop.

DutchDaemon · Aug 23, 2011

Simple command-line tool:

net-mgmt/bwm-ng

Code:

# bwm-ng -u bits -T avg -I em1


  bwm-ng v0.6 (probing every 0.500s), press 'h' for help
  input: getifaddrs type: avg (30s)
  \         iface                   Rx                   Tx                Total
  ==============================================================================
              em1:        2698.07 Kb/s         1026.60 Kb/s         3724.68 Kb/s
  ------------------------------------------------------------------------------
            total:        2698.74 Kb/s         1026.82 Kb/s         3725.56 Kb/s

Code:

# bwm-ng -u bits -T avg

  bwm-ng v0.6 (probing every 0.500s), press 'h' for help
  input: getifaddrs type: avg (30s)
  -         iface                   Rx                   Tx                Total
  ==============================================================================
             bge0:           1.40 Kb/s            2.36 Kb/s            3.75 Kb/s
              em0:         891.10 Kb/s         1295.20 Kb/s         2186.29 Kb/s
              em1:        1294.26 Kb/s          890.35 Kb/s         2184.61 Kb/s
              lo0:           0.00 Kb/s            0.00 Kb/s            0.00 Kb/s
           pflog0:           0.00 Kb/s            0.00 Kb/s            0.00 Kb/s
  ------------------------------------------------------------------------------
            total:        2186.00 Kb/s         2186.96 Kb/s         4372.97 Kb/s

DutchDaemon · Aug 23, 2011

But yeah, the 701.66 MByte is the total amount of traffic since the interface went up, which is usually the same time as reported by uptime(1). This will probably make it seem a lot less.

Kiiski · Aug 25, 2011

Also

[CMD=]systat -ifstat[/CMD]

has quite nice output (no port needed)

Code:

                    /0   /1   /2   /3   /4   /5   /6   /7   /8   /9   /10
     Load Average   ||

      Interface           Traffic               Peak                Total
            lo0  in      0.000 KB/s          0.000 KB/s            7.438 KB
                 out     0.000 KB/s          0.000 KB/s            7.438 KB

           nfe0  in      0.038 KB/s          0.038 KB/s           71.750 MB
                 out     0.051 KB/s          0.051 KB/s            4.048 MB

excessive network traffic

unsobill

DutchDaemon

Administrator

wblock@

unsobill

SirDice

Administrator

wblock@

DutchDaemon

Administrator

DutchDaemon

Administrator

Kiiski