High Network Usage When Idle

[avp2306]

Seeing very high, unexplained inbound network traffic, eth0 shows constant inbound 17.6 Mbps and outbound ~7 Kbps. CPU usage is always 2-3%. I have no VMs, no Dockers, all disks are spun down, Active Streams shows empty, I'm the only user, server is idle 99% of the time. Running latest version of UnRaid, all plugins / apps have been updated. Log shows no errors. 

 

I'm also running a Network Stats plugin which shows network usage over time, and every hour the machine is receiving exactly 7.35 GB. Why? This is so weird.. See screenshot: 

So this has me worried about what's happening, the machine should be completely idle. Please help me understand what's going on and how to resolve this. Thanks!

 

Edited January 5, 2020 by avp2306

[bonienl]

2 minutes ago, avp2306 said:

Why? This is so weird..

With no further information, it is impossible to answer your question.

 

As a first step start your system in "safe mode" (no plugins)  and verify again

[Squid]

6 minutes ago, avp2306 said:

no Dockers,

Are you sure?  I would install Netdata and verify via it the traffic situation.

[avp2306]

8 minutes ago, bonienl said:

As a first step start your system in "safe mode" (no plugins)  and verify again

Thanks for the suggestion. Just rebooted in Safe Mode without any plugins - same problem, instantly showing 17.6 Mbps Inbound.

[avp2306]

Including Diagnostics.zip

tower-diagnostics-20200105-1741.zip

[BRiT]

The /system/lsof.txt file shows the following activity over SAMBA (smbd) where user mediauser has 36 file updates running over a local IPV4 connection and there's other updates happening over a local IPV6 connection:

 

COMMAND     PID      USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME

smbd       4446 mediauser   36u  IPv4 31900225      0t0  TCP 192.168.1.25:445->192.168.1.42:64038 (ESTABLISHED)

smbd      14253      root   36u  IPv6 24440816      0t0  TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::ecc6:fad3:7f63:5a0b]:51109 (ESTABLISHED)
smbd      15256      root   36u  IPv6 30752540      0t0  TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::51aa:719a:4a63:f41e]:49673 (ESTABLISHED)
smbd      15607      root   35u  IPv6 24067072      0t0  TCP [fe80::884:6cff:fe6a:c2e6]:445->[fe80::3807:937a:de20:eb5e]:56566 (ESTABLISHED)

 

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND

root     12939  0.0  0.0  52152 15188 ?        Ss   Jan02   0:00 /usr/sbin/smbd -D
mediaus+  4446  0.1  0.1  60616 20180 ?        S    Jan04   3:00  \_ /usr/sbin/smbd -D
root     12942  0.0  0.0  52368  8232 ?        S    Jan02   0:09  \_ /usr/sbin/smbd -D
root     12943  0.0  0.0  50324  7384 ?        S    Jan02   0:00  \_ /usr/sbin/smbd -D
root     14253  0.0  0.0  52548 15040 ?        S    Jan02   0:00  \_ /usr/sbin/smbd -D
root     15256  0.0  0.1  57504 18748 ?        S    Jan03   0:11  \_ /usr/sbin/smbd -D
root     15607  0.0  0.1  54048 17372 ?        S    Jan02   0:05  \_ /usr/sbin/smbd -D

[avp2306]

9 minutes ago, BRiT said:

The /system/lsof.txt file shows the following activity over SAMBA (smbd) where user mediauser has 36 file updates running over a local IPV4 connection and there's other updates happening over a local IPV6 connection

Thanks, useful to know how to read that. That was my PLEX VM which runs on another machine. I just shut down PLEX and all other machines that connected to UnRaid but problem still remains, constant Inbound 17.6 Mbps.

 

What else can I try? 

[BRiT]

Maybe run the following command and see what shows up? 

 

netstat

[bonienl]

First you said, no docker and no vm. Now there is a plex vm???

 

Stop your docker service and stop your vm service. See Settings

[BRiT]

@bonienl there is nothing running on his unraid server. Check his diagnostics ps.txt and you'll see nothing running locally. That Plex VM is from a different server.

 

The only thing related on this unraid server is:

 

root      8450  0.0  0.4 1048992 69048 ?       Sl    2019  11:35 /usr/bin/dockerd -p /var/run/dockerd.pid --mtu=9198 --storage-driver=btrfs --log-level=error
root      8465  0.0  0.2 559724 32908 ?        Ssl   2019   7:18  \_ containerd --config /var/run/docker/containerd/containerd.toml --log-level error

Edited January 5, 2020 by BRiT

[bonienl]

1 minute ago, BRiT said:

@bonienl there is nothing running on his unraid server. Check his diagnostics ps.txt and you'll see nothing running locally. That Plex VM is from a different server.

ok, I can’t check diagnostics atm.

[avp2306]

5 hours ago, BRiT said:

Maybe run the following command and see what shows up? 

netstat

 

Just ran this through to the webui terminal, below is the result. 192.168.1.16 is my local machine that was used to login and run the cmd on UnRaid.

 

[avp2306]

Quick update and thanks to everyone who replied. Since everything possibly connecting to UnRaid was shut down, I figured it must have been UnRaid itself. I did some checking / tinkering with UnRaid's Network Settings and disabled both Bonding and Bridging. I think both of these settings were enabled by default after install as I kept most settings as they were. I only have 1 network adapter on this machine, so figured it was not necessary. 

 

After disabling both Bonding and Bridging settings, Inbound went down to 19 Kbps and Outbout to 4 Kbps. I'm assuming these non zero values could be attributed to Web UI being opened - pl. correct me if I'm wrong here and if Inbound & Outbound should be zero or close to it. 

 

Posting my Network Settings below for reference - pl. let me know if anything else should be changed / optimized. I'm using MELLANOX CONNECT X-2 PCI-E 10G SFP+ network card. 

 

Edited January 6, 2020 by avp2306