Odd high incomming traffic from nfs share

QuickBox Support
#1

From the dashboard I saw abnormal high incomming traffic for no reason. There is no torrent beeing downloaded. Why is there such high incomming traffic? I can’t find the process assigned to port 941.
What is quickbox reading? Except the obvious ~1Mbps from rtorrent.

sudo lsof -i | grep 941 results in null,


iftop:
191Mb 381Mb 572Mb 763Mb 954Mb
mqqqqqqqqqqqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqqqqqqqqqqqq
192.168.1.34:941 => 192.168.1.95:nfs 1.44Mb 985Kb 1.52Mb
<= 77.8Mb 54.8Mb 91.5Mb

iptraf:
IPTraf
lqqqqqq PktsIn qqqqqqqq IP In qqqq BytesIn qqqqqq InRate qqq PktsOut qqqqqqq IP Out qqqq BytesOut qqq OutRate qqqqqk
x Ethernet HW addr: 000c294a6de9 on eth0 x
x m 94180 0 135961K 45691.8 52948 0 25665779 9226.2 x

45 Mbps in! from mac 000c294a6de9 ! vmware mac.

sudo arp -vn 00:0c:29:4a:6d:e9
00:0c:29:4a:6d:e9: Unknown host

netstat | grep 941
tcp 0 0 192.168.1.34:941 192.168.1.95:nfs ESTABLISHED

#2

apt install nethogs
then run it its pretty good at finding what is using the bandwidth

#3

Yeah i tried that but it wont start even logged in as root.

“sudo nethogs
creating socket failed while establishing local IP - are you root?”

#4

sudo su nethogs

#5

Also lsof -N doesnt show anything odd, only the torrent that is slowly seeding.

[usernamexxx@quickbox]:(31.7kb)~/.autodl$ sudo su

|========================================================================|
You are running QuickBox v2.4.8 - on 192.168.1.21:0.0
Your BASH version is 4.3
Tue Dec 27 12:56:42 GMT 2016
|------------------------------------------------------------------------|
| Just type any one of the following commands |

to turn on different bash prompts
commandprompt_on
this prompt shows last command used & more
powerprompt_on (default)
this prompt shows colorful system data - cpu, load etc.
basicprompt_on
this prompt shows color coded load & cpu avg
prompt_OFF
this turns off prompts and goes back to default
========================================================================

quickbox:/home/usernamexx/.autodl# nethogs
creating socket failed while establishing local IP - are you root?

#6

Working for me with :

su root
nethogs eno1 -v 3

eno1 is the server external IP address :wink:

1 Like
#7

what version are you using?
“nethogs -V
version 0.8.0”

I’ll need to separate internal and external traffic so Ill at least get a graph over only wan/internet traffic.

But im still have no idea why quickbox is generating that much incomming traffic from the nfs share without any obvious files beeing accessed.

#9

I’m reinstalling quickbox since I cant get autodl-irssi to function again.

Edit: ok reinstalled the script and connectivity is back, but I don’t know why it failed before. And the high network traffic is back too … really odd.

#10

Are you by chance downloading/uploading anything via FTP?

It will read all internal and external traffic on the displayed (found) adapters. As per QuickBox creating this traffic… no. Something in there is requesting work from those networks and it should show itself with nethogs as stated. Additionally, just give h/top a once over and see if there may be any other additional indications of some gone awry.

#11

No no FTP is installed. I added a tunnel for the torrent traffic and there is no outbound traffic thats not accounted for via torrents.
The read data isn’t forwarded outside my network atleast.

I added a tunnel since its to much work to get to the server in the closet right now :slight_smile: too much stuff in the way…

btw it would be a good ide to choose chich interfaces to base the graph on, not just add all interfaces.

#12

htop sorted by read bytes shows nothing out of the ordinary.

1 Like
#13

just a update, this is a rtorrent bug.