avp2306 Posted January 5, 2020 Share Posted January 5, 2020 (edited) Seeing very high, unexplained inbound network traffic, eth0 shows constant inbound 17.6 Mbps and outbound ~7 Kbps. CPU usage is always 2-3%. I have no VMs, no Dockers, all disks are spun down, Active Streams shows empty, I'm the only user, server is idle 99% of the time. Running latest version of UnRaid, all plugins / apps have been updated. Log shows no errors. I'm also running a Network Stats plugin which shows network usage over time, and every hour the machine is receiving exactly 7.35 GB. Why? This is so weird.. See screenshot: So this has me worried about what's happening, the machine should be completely idle. Please help me understand what's going on and how to resolve this. Thanks! Edited January 5, 2020 by avp2306 Quote Link to comment
bonienl Posted January 5, 2020 Share Posted January 5, 2020 2 minutes ago, avp2306 said: Why? This is so weird.. With no further information, it is impossible to answer your question. As a first step start your system in "safe mode" (no plugins) and verify again Quote Link to comment
Squid Posted January 5, 2020 Share Posted January 5, 2020 6 minutes ago, avp2306 said: no Dockers, Are you sure? I would install Netdata and verify via it the traffic situation. Quote Link to comment
avp2306 Posted January 5, 2020 Author Share Posted January 5, 2020 8 minutes ago, bonienl said: As a first step start your system in "safe mode" (no plugins) and verify again Thanks for the suggestion. Just rebooted in Safe Mode without any plugins - same problem, instantly showing 17.6 Mbps Inbound. Quote Link to comment
avp2306 Posted January 5, 2020 Author Share Posted January 5, 2020 Including Diagnostics.zip tower-diagnostics-20200105-1741.zip Quote Link to comment
BRiT Posted January 5, 2020 Share Posted January 5, 2020 The /system/lsof.txt file shows the following activity over SAMBA (smbd) where user mediauser has 36 file updates running over a local IPV4 connection and there's other updates happening over a local IPV6 connection: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME smbd 4446 mediauser 36u IPv4 31900225 0t0 TCP 192.168.1.25:445->192.168.1.42:64038 (ESTABLISHED) smbd 14253 root 36u IPv6 24440816 0t0 TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::ecc6:fad3:7f63:5a0b]:51109 (ESTABLISHED) smbd 15256 root 36u IPv6 30752540 0t0 TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::51aa:719a:4a63:f41e]:49673 (ESTABLISHED) smbd 15607 root 35u IPv6 24067072 0t0 TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::3807:937a:de20:eb5e]:56566 (ESTABLISHED) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 12939 0.0 0.0 52152 15188 ? Ss Jan02 0:00 /usr/sbin/smbd -D mediaus+ 4446 0.1 0.1 60616 20180 ? S Jan04 3:00 \_ /usr/sbin/smbd -D root 12942 0.0 0.0 52368 8232 ? S Jan02 0:09 \_ /usr/sbin/smbd -D root 12943 0.0 0.0 50324 7384 ? S Jan02 0:00 \_ /usr/sbin/smbd -D root 14253 0.0 0.0 52548 15040 ? S Jan02 0:00 \_ /usr/sbin/smbd -D root 15256 0.0 0.1 57504 18748 ? S Jan03 0:11 \_ /usr/sbin/smbd -D root 15607 0.0 0.1 54048 17372 ? S Jan02 0:05 \_ /usr/sbin/smbd -D Quote Link to comment
avp2306 Posted January 5, 2020 Author Share Posted January 5, 2020 9 minutes ago, BRiT said: The /system/lsof.txt file shows the following activity over SAMBA (smbd) where user mediauser has 36 file updates running over a local IPV4 connection and there's other updates happening over a local IPV6 connection Thanks, useful to know how to read that. That was my PLEX VM which runs on another machine. I just shut down PLEX and all other machines that connected to UnRaid but problem still remains, constant Inbound 17.6 Mbps. What else can I try? Quote Link to comment
BRiT Posted January 5, 2020 Share Posted January 5, 2020 Maybe run the following command and see what shows up? netstat Quote Link to comment
bonienl Posted January 5, 2020 Share Posted January 5, 2020 First you said, no docker and no vm. Now there is a plex vm??? Stop your docker service and stop your vm service. See Settings Quote Link to comment
BRiT Posted January 5, 2020 Share Posted January 5, 2020 (edited) @bonienl there is nothing running on his unraid server. Check his diagnostics ps.txt and you'll see nothing running locally. That Plex VM is from a different server. The only thing related on this unraid server is: root 8450 0.0 0.4 1048992 69048 ? Sl 2019 11:35 /usr/bin/dockerd -p /var/run/dockerd.pid --mtu=9198 --storage-driver=btrfs --log-level=error root 8465 0.0 0.2 559724 32908 ? Ssl 2019 7:18 \_ containerd --config /var/run/docker/containerd/containerd.toml --log-level error Edited January 5, 2020 by BRiT Quote Link to comment
bonienl Posted January 5, 2020 Share Posted January 5, 2020 1 minute ago, BRiT said: @bonienl there is nothing running on his unraid server. Check his diagnostics ps.txt and you'll see nothing running locally. That Plex VM is from a different server. ok, I can’t check diagnostics atm. Quote Link to comment
avp2306 Posted January 6, 2020 Author Share Posted January 6, 2020 5 hours ago, BRiT said: Maybe run the following command and see what shows up? netstat Just ran this through to the webui terminal, below is the result. 192.168.1.16 is my local machine that was used to login and run the cmd on UnRaid. Quote Link to comment
avp2306 Posted January 6, 2020 Author Share Posted January 6, 2020 (edited) Quick update and thanks to everyone who replied. Since everything possibly connecting to UnRaid was shut down, I figured it must have been UnRaid itself. I did some checking / tinkering with UnRaid's Network Settings and disabled both Bonding and Bridging. I think both of these settings were enabled by default after install as I kept most settings as they were. I only have 1 network adapter on this machine, so figured it was not necessary. After disabling both Bonding and Bridging settings, Inbound went down to 19 Kbps and Outbout to 4 Kbps. I'm assuming these non zero values could be attributed to Web UI being opened - pl. correct me if I'm wrong here and if Inbound & Outbound should be zero or close to it. Posting my Network Settings below for reference - pl. let me know if anything else should be changed / optimized. I'm using MELLANOX CONNECT X-2 PCI-E 10G SFP+ network card. Edited January 6, 2020 by avp2306 2 Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.