[plug] strange network activity?

[W.Kenworthy]

I have not used jnettop so I dont know how good it is - however I do
trust the others and if they are not showing such packets, then they
dont exit.

Another good test for this is something like "tcpdump -i eth0" just let
it run in a console  and see if any odd packets show up.

One possibility seeing one is a NAS, is it scanning for MS systems to
connect to?  Try powercycling it and see if it triggers this behaviour.

BillK

On Tue, 2008-01-01 at 16:28 +1100, Rob Dunne wrote:
> William Kenworthy wrote:
>  > you dont say what operating systems each has.
> 
> 192.168.1.100 is ubuntu
> 
> 192.168.1.102 is debian -- a linkstation NAS hacked via FreeLink. 
> http://nas-central.org/index.php/FreeLink_for_the_Linkstation_Pro
> it doesnt support a monitor and there is no X-server installed on it.
> This is the one with the network activity.
> 
>  > Try iftop, iptraf, wireshark and etherape
> 
> iftop and  iptraf only show active connection to 192.168.1.100 and the
> modem.
> 
> iftop
> 192.168.1.100 <->  192.168.1.102
> 192.168.1.102 <->  iConnectAccess621
> 
> iptraf
> UDP (74 bytes) from 192.168.1.254:53 to 192.168.1.102:1558 on eth0
> UDP (72 bytes) from 192.168.1.102:1563 to 192.168.1.254:53 on eth0
> 
>  >
>  > You have a few networks showing - perhaps a quick sketch of the
>  > network(s) layout may help to see whats happening (do the others
>  > exist?).
> 
> there is just 192.168.1.100 and 192.168.1.102 connected to a hub and 
> then a modem -- none of the other machines (192.168.176.230 etc) exist.
> 
> Also iptraf  shows the incoming rates
> are the same as the outgoing rates -- is traffic just being routed 
> through 192.168.1.102 and  jnettop is just confused about all the other
> IP addresses?
> 
> Bye
> Rob
> 
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au