Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I've got a problem here confusing me, and thought Server Fault community could help.

I've noticed a continuous traffic (1-10 Kbit/s) being generated on my desktop. It was running on Windows XP. I checked up all the processes, scanned for viruses and malware. That was not the case! Even when netstat shows nothing but localhosts, the traffic is being used.

Then I switched to Ubuntu 10.10, which is also installed on the same computer. And I was shocked to see the same traffic consumption here on System Monitor. I ran the Firestarter firewall, which shows network activity with no active connections established!

I start to think there's some kind of problem on hardware level, though it sounds ridiculous - network adapter problem causing continuous low traffic... I ran out of ideas!

If you know what to do or have any ideas on the issue, please help! Thank you!

share|improve this question
up vote 2 down vote accepted

The first question is: what is the traffic? Assuming eth0 is the connected interface, on the box, can you do a

tcpdump -n -n -i eth0

and look at the results? Obviously, you'll need to do this on the box itself, or nearly all you'll see is your own traffic.

Secondly, which direction is the traffic flowing - in or out?

For comparison purposes, I see 600-1200bytes/s of inbound background network traffic, which is other people's ARP requests, UDP broadcast packets (mostly windows boxes dying to know if there's anyone else there), DHCP traffic, and so on. If you're transmitting much, there may be cause for alarm, but receiving is going to happen even if you aren't doing anything yourself.

share|improve this answer
Thanks for your immediate response, it was really helpful! It shows a whole lot of requests: UDP broadcasts, ARP requests and others! The traffic is mostly flowing in. So maybe there's really no cause of alarm, as you say. Thanks! :) P.S. I just thought 10 Kbit/s is too much for just "background" network-needs traffic... – avart Feb 4 '11 at 9:43
Avart: glad to help! Protocol round here is that, if you found the answer sufficiently helpful, you accept it, which I think involves clicking the tick outline. I'd be grateful if, provided you're satisfied with the answer, you were to do that. – MadHatter Feb 4 '11 at 10:26
MadHatter: Oh, sorry, I'm a newbie here. Is it ok now? – avart Feb 4 '11 at 12:23
Avart: absolutely! I could see you were a new user from your profile, and I hoped it would be OK to gently suggest some local pointers; thank you for taking it so graciously! – MadHatter Feb 4 '11 at 13:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.