Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a Ubuntu Samba file server running Apache and an ftp client what amount of network traffic would be normal when no users are connected?

I am strictly a Windows admin and have just installed Ubuntu Server for the first time. I am using it as a file server/ftp server (for the IT Dept only) and I am hosting a website (which is also available to the IT Dept only).

I have noticed what appears to be traffic when the machine should be not in use. I have installed and am running VNSTAT, which shows about 82kb rx and 84kb tx in about an hour. This may or not be accurate. It looks like there is more traffic on the switch for that port.

I am looking for advice on monitoring and understanding network traffic for Ububtu Server.

Understanding network traffic, while part of my daily job, is probably my weakest area. I try to learn something new everyday/week and it seems there is alot out there on this subject, but nothing specifically written for a newby to see satisfying results immediately.

I guess my questions are- 1) how much traffic is normal for the situation listed above and 2) whats a good starting point (that I can build on) for understanding traffic

share|improve this question
+1 for paranoia in moving to a different platform -- I feel your pain -- and for learning more about analyzing network traffic. – nedm Jun 21 '09 at 6:53

You can use tcpdump or wireshark to see what kind of traffic it is. But it's probably some level 2 traffic like ARP, it seems totaly normal.

share|improve this answer
thanks..after having had a Windows server attacked and botted I am looking to be reassured. All advice is appreciated. – cop1152 Jun 20 '09 at 16:25

A Samba server will communicate with any attached clients every once in a while. You can probably look through your Samba logs and /var/log/messages to confirm this. 84kb per hour is rather minimal (that's like 20b per second).

share|improve this answer
up vote 0 down vote accepted

I ended up installing vnstat. It has several switches and will even monitor in real time.

Thanks everyone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.