[plug] broadband monitoring?

[Gavin Chester]

On Tue, 2007-06-26 at 15:09 +1000, Rob Dunne wrote:
> Hi Gavin,
> 
> Gavin Chester wrote:
> > What about
> > gkrellm? it would be the best option for your chosen WM, I reckon. It
> > gives bytes in/out reports for daily, weekly monthly for any interface
> > ppp0, eth0, etc. 
> 
> so far gkrellm gives a stack of tiny widgets monitoring a lot of 
> different things. It looks quite complicated to get it to get it to do 
> something like bytes in/out reports on a daily basis. Do you know if it 
> can give a report that lists both the address and the bytes? If it is 
> just the total traffic then the iiNet volume usage tool can give me that.

Warning: CLI warriors avert your eyes, this is GUI talk ;-) gkrellm is
great IMHO. I always end up having it running in the background on any
system I install. If you have it running, right-click on its title bar
area and it will bring up the option to configure. You can then turn on
and off each little box of info in the vertical stack. Eg, under network
you can turn on any interfaces that suit to see a real-time graph of
activity. If you then hover your mouse over the lower right area of that
box (for eth0, say) a little button appears. Click this and the traffic
stats pop up in a separate window. I haven't looked into whether you can
export it as text.     


> jnettop is up and running -- but no reporting yet.
> 
> > 
> > But 400+Mb when not doing anything? Are you running a cron to update
> > your package cache every day or every week? 
> I wasnt aware of anything. There is a file
> /etc/cron.daily/apt

I would have thought that an apt update would not be any where near what
you see unless it was a fresh install of an older version - and then it
would only do it the once. Hmm, even with a cache update it would not be
that big, so that's a mystery. 
 
> 
> but I dont think it updates a package cache
> 
> Anyway -- this doesn't happen daily. I have only had one strange
> period of net activity.
> 
>  > Only thing I can think of
> > otherwise you're being diddled by your provider or you're sitting on a
> > zombie machine. 
> 
> how would I detect this?

I didn't mention "wireshark" before, but this is a great GUI network
packet sniffer/recorder. Used to be called ethereal. You can do a live
capture and have name resolution done as well, in real-time. Haven't
checked whether it also offers byte logging, but it will tell you where
the traffic is going/coming. You can save the packet capture as a file
for later viewing. 

Gavin