Traffic used without any active connection!

Question

Hi I've got a problem here confusing me, and thought Server Fault community could help.

I've noticed a continuous traffic (1-10 Kbit/s) being generated on my desktop. It was running on Windows XP. I checked up all the processes, scanned for viruses and malware. That was not the case! Even when netstat shows nothing but localhosts, the traffic is being used.

Then I switched to Ubuntu 10.10, which is also installed on the same computer. And I was shocked to see the same traffic consumption here on System Monitor. I ran the Firestarter firewall, which shows network activity with no active connections established!

I start to think there's some kind of problem on hardware level, though it sounds ridiculous - network adapter problem causing continuous low traffic... I ran out of ideas!

If you know what to do or have any ideas on the issue, please help! Thank you!

Answer 1

The first question is: what is the traffic? Assuming eth0 is the connected interface, on the box, can you do a

tcpdump -n -n -i eth0

and look at the results? Obviously, you'll need to do this on the box itself, or nearly all you'll see is your own traffic.

Secondly, which direction is the traffic flowing - in or out?

For comparison purposes, I see 600-1200bytes/s of inbound background network traffic, which is other people's ARP requests, UDP broadcast packets (mostly windows boxes dying to know if there's anyone else there), DHCP traffic, and so on. If you're transmitting much, there may be cause for alarm, but receiving is going to happen even if you aren't doing anything yourself.