On Mon, Sep 8, 2008 at 11:42 PM, Daniel Bauer wrote:

Hello,

I am connected via cable to a router via eth0. I also have a wireless eth1 in my laptop. When I now look at the graphs of gkrellm it shows me that eth1 is busy all the time. Usually there is nothing on eth1 when I'm connected by cable. So how comes I see so much activity there now?

If I switch off wireless with the hardware switch on my laptop the graph also doesn't show any more traffic, so I'm sure it really shows the wireless stuff.

I thought, using KnetworkManager the wirless interface would be inactive as soon as I connect a cable and vice versa?

How can I find out what's going on?

thanks for your hints.

Daniel

Maybe its GKrellm sniffing around out there? Shut down GKrellm and use ifconfig to see if the TX/RX counts climb. It could be just looking for wireless netowrks (iwscan or something). -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Tue, Sep 9, 2008 at 12:32 AM, Daniel Bauer wrote:

On Tuesday 09 September 2008 08:52:29, John Andersen wrote:

...

On Mon, Sep 8, 2008 at 11:42 PM, Daniel Bauer wrote:

...

I am connected via cable to a router via eth0. I also have a wireless eth1 in my laptop. When I now look at the graphs of gkrellm it shows me that eth1 is busy all the time. Usually there is nothing on eth1 when I'm connected by cable. So how comes I see so much activity there now?

How can I find out what's going on?

Maybe its GKrellm sniffing around out there?

Shut down GKrellm and use ifconfig to see if the TX/RX counts climb. It could be just looking for wireless netowrks (iwscan or something).

ok, gkrellm is not running anymore, and ifconfig shows that some dropped rx packets and some tx bytes :

RX packets:0 errors:0 dropped:905 overruns:0 frame:0 TX packets:1 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:23994 (23.4 Kb)

some seconds later, some more:

RX packets:0 errors:0 dropped:916 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:24420 (23.8 Kb)

RX packets:0 errors:0 dropped:959 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:26388 (25.7 Kb)

RX packets:0 errors:0 dropped:1036 overruns:0 frame:0 TX packets:7 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:30462 (29.7 Kb)

RX packets:0 errors:0 dropped:1155 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:34998 (34.1 Kb)

What is tx'ed here? Does this mean anything?

Daniel

Rx=Received Tx=Transmitted. The packet count is pretty small. Its not receiving anything. My best guess is Its just looking for wireless routers. On the other hand, if you have it in adhoc mode it might be advertising a network. Its late here or I'd power up my laptop for comparison. Perhaps between now and tomorrow some one will have a more definitive answer. -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Tuesday 09 September 2008 16:24:02, Randall R Schulz wrote:

On Tuesday 09 September 2008 00:32, Daniel Bauer wrote:

...

...

ok, gkrellm is not running anymore, and ifconfig shows that some dropped rx packets and some tx bytes :

RX packets:0 errors:0 dropped:905 overruns:0 frame:0 TX packets:1 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:23994 (23.4 Kb)

some seconds later, some more:

RX packets:0 errors:0 dropped:916 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:24420 (23.8 Kb)

RX packets:0 errors:0 dropped:959 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:26388 (25.7 Kb)

RX packets:0 errors:0 dropped:1036 overruns:0 frame:0 TX packets:7 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:30462 (29.7 Kb)

RX packets:0 errors:0 dropped:1155 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns:0 carrier:0 RX bytes:0 (0.0 b) TX bytes:34998 (34.1 Kb)

What is tx'ed here? Does this mean anything?

Hi Randal,

All the received packets are being dropped. I'm far from an expert on these things,

I'm even more far from an expert, much much more more far far :-)

but this must mean either they're not for any IP on the receiving host or they're not for the MAC that received the packet (which would imply the adaptor is in promiscuous mode, I think).

Ehm, if you'd say, I'm in promiscuous mode, I'd understand what you mean, but what does that mean in regard to the adaptor? Is that bad?

It does seem odd to me that the transmitted byte count is going up while the transmitted packet count remains at zero.

Can you communicate on the link whose activity is shown in these reports?

I have no wireless here in Basel and all the others around here are encrypted, so i cannot say, if wireless actually would work. It shows other LANs right now and it worked in Spain, though.

Maybe it's receiving its own transmitted packets?

Also, the ratio between the dropped packet count and the transmitted byte count, while not fixed, might be asymptotic to a number in the low 30s or so, which might be some kind of clue.

Randall Schulz

Huuh - even after asking wikipedia I don't understand "asymptotic" etc. However, that activity was during about 4 hours this morning and then it stopped. Now it's absolutely quiet on eth1... But if it happens once again, ist there a way to log what happens or to find out where the activity comes from? Daniel -- Daniel Bauer photographer Basel Barcelona professional photography: http://www.daniel-bauer.com erotic art photos: http://www.bauer-nudes.com Madagascar special: http://www.fotograf-basel.ch/madagascar/ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Hi Randall, thanks for the explanations. I installed WireShark now and will start it to look at the strange traffic should it appear again... I'll then mail again, if appropriate... (The reports I've mailed here before were taken within a minute or so, about every 10 seconds by typing ifconfig. What I ment with "during 4 hrs" was that during that time I saw the activity, but I didn't capture the numbers anymore... However right now it's "RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)" on eth1 - as it should be.) Daniel On Tuesday 09 September 2008 17:16:12, Randall R Schulz wrote:

On Tuesday 09 September 2008 07:53, Daniel Bauer wrote:

...

...

Hi Randall,

...

All the received packets are being dropped. I'm far from an expert on these things,

I'm even more far from an expert, much much more more far far :-)

...

but this must mean either they're not for any IP on the receiving host or they're not for the MAC that received the packet (which would imply the adaptor is in promiscuous mode, I think).

Ehm, if you'd say, I'm in promiscuous mode, I'd understand what you mean, but what does that mean in regard to the adaptor? Is that bad?

Ordinarily, network adaptors don't present to the operating system / driver software any packets that do not bear the adaptor's only (unique throughout Earth) MAC address as the packet's destination address. However, many (most? all??) adaptors have a so-called "promiscuous" mode in which every packet they receive is presented to the driver software. This allows, e.g., network packet sniffers such as WireShark to monitor all link activity, not just that directed at the host on which the sniffer is running.

Running in promiscuous mode will force the main CPU to handle every packet traversing the link. If most of those packets are actually destined for your host, then it's no problem. If many are not, then it's wasted CPU time handling those packets to do nothing other than examine their destination MAC address and then ignore them.

...

...

It does seem odd to me that the transmitted byte count is going up while the transmitted packet count remains at zero.

Can you communicate on the link whose activity is shown in these reports?

I have no wireless here in Basel and all the others around here are encrypted, so i cannot say, if wireless actually would work. It shows other LANs right now and it worked in Spain, though.

So this is a wireless link? It wasn't clear to me from your post whether you were showin the wired or wireless link's stats. Perhaps these extraneous counts just reflect RFI or some wayward wireless traffic that reached your receiver.

I have the vague notion that wireless Ethernet's bandwidth comes from one of those unregulated blocks shared by bluetooth and other consumer wireless devices. If that's so, it could be that sort of electronics that are triggering these spurious counts.

...

...

Maybe it's receiving its own transmitted packets?

Also, the ratio between the dropped packet count and the transmitted byte count, while not fixed, might be asymptotic to a number in the low 30s or so, which might be some kind of clue.

Huuh - even after asking wikipedia I don't understand "asymptotic" etc.

Consider a ratio between two integers. Let's say I start out with the numerator 1 and the denominator 1,000. The ratio is 1:1,000. Now I increment each number, giving the ration 2:1,001. Keep doing that indefinitely and while the ratio will get as close as you like to 1.0, it will never reach that value. That ratio is asymptotic to 1.0.

It appeared to me that there might be an asymptotic ratio between the dropped inbound packet counts and the transmitted byte counts you reported and that that number might be something "magic" (a power of two or a power of two plus another smaller power of two, say 32 or 40), which suggests a runt packet of some sort.

...

However, that activity was during about 4 hours this morning and then it stopped. Now it's absolutely quiet on eth1...

I didn't realize that was such a long timespan. (In the future, it might be a good idea to include timestamps).

In this case, I'd definitely ignore it. This is the merest of trickles.

...

But if it happens once again, ist there a way to log what happens or to find out where the activity comes from?

Well, WireShark is the classic tool for learning everything there is to know about what's happening on your networks, but it's pretty complex and I've used it so little that I'm not the one to instruct you how to learn what you want to know.

There might be simpler tools, but as I've said, this isn't something I'm all that knowledgeable about. Maybe someone else can point to something more appropriate to diagnosing your symptoms.

...

Daniel

Randall Schulz -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org