Network traffic from unknown source

[KarsaOrlong]

I've got a constant 15-20kb/s up/down traffic on my DS920+. I don't know where this traffic is originating. I suspect it might be the connection between the NAS and my desktop, but I don't know for sure. I'd like to confirm this, and I don't know if it's me being stupid or if network monitoring really is this hard to accomplish on this NAS model.

I've tried DarkStat which doesn't seem to be supported on my model. I've tried looking for various docker images, all of which are either outdated, just plain doesn't work, or are massively over-specced for my needs - I just want to monitor traffic and its sources. At the very least I'd hope there's something like vnstat, which I have running on all my other machines, to be able to monitor bandwidth across time (I've looked for this as well, found several docker images, but none that work for my model).

Thanks for any help with this.

 

[Rusty]

I've got a constant 15-20kb/s up/down traffic on my DS920+. I don't know where this traffic is originating. I suspect it might be the connection between the NAS and my desktop, but I don't know for sure. I'd like to confirm this, and I don't know if it's me being stupid or if network monitoring really is this hard to accomplish on this NAS model.

I've tried DarkStat which doesn't seem to be supported on my model. I've tried looking for various docker images, all of which are either outdated, just plain doesn't work, or are massively over-specced for my needs - I just want to monitor traffic and its sources. At the very least I'd hope there's something like vnstat, which I have running on all my other machines, to be able to monitor bandwidth across time (I've looked for this as well, found several docker images, but none that work for my model).

Thanks for any help with this.

Try this docker image and monitor your traffic that way:

docker run --name=iotop -ti --privileged --net=host --pid=host esnunes/iotop:latest

 

[fredbert]

Alternatively you can use tcpdump via SSH command line.

Firstly run ifconfig to find the name of the interface you want to monitor, e.g. eth0, eth1, ovs_bond0. The DS920+ has two physical interfaces and you may be using them separately or bonded them with a form of LAG.

Next run this command, assuming:

• eth0 interface
• NAS is on LAN IP 192.168.0.100
• SSH server running on standard port 22

sudo tcpdump -n -i eth0 | grep -v 192.168.0.100.22

This requires your administrator's password to run:

• sudo super-user do... run will high privilege
• -n will not translate IP addresses to names
• -i eth0 is saying the interface
• | grep -v sends the tcpdump output to grep and it removes traffic related SSH using NAS_IP.SSH_PORT

Crtl-C to exit tcpdump.

Without the -n you would filter using whatever the NAS's network name is that is shown in the dump, with '.22' added.