Where is incoming traffic coming from?

[Amedee @ Ubuntu]

On Fri, July 31, 2009 05:14, Siggy Brentrup wrote:
>  On Fri, Jul 31, 2009 at 00:53 +0200, Amedee @ Ubuntu wrote:
>> Hello,
>>
>> I noticed that I got a lot of incoming traffic on my server. Look at
>> vnstat:
>>
>> # vnstat -d
>>

>>    10.07.     19.15 GB  |   17.26 GB  |   36.41 GB
>> %%%%%%%%%%%%%::::::::::::

> Anything particular on 10.07.?  It's the only day where rx/tx ratio
> approaches 1.

That may be the day when I did a full backup of my server and rsynced it
to somewhere else. Don't focus on that day please.

> I don't know what exactly vnstat counts.  In an argument with my ISP I
> once was told that they count all traffic, even the one dropped
> resp. rejected by my firewall, but even then numbers seem to be
> extrodinary high.

Vnstat counts every packet that reaches the network card, even packets
that get dropped/rejected. Your ISP is right.

> Counters below don't tell much since they don't
> cover a full day.  You might save counter values every hour and
> look what after a possible pattern.

Will do. Shorewall was already running for a while, but I just configured
accounting yesterday.

> Even with windoze broadcasts you're dropping the numbers seem
> exceedingly high, you have to provide more data.  Next time
> please come with a URL, these tables make mails way too big.

Sorry, next time I'll use pastebin. The thought occured to me when I
reread my mail - after I sent it.

-- 
Amedee