Internet traffic when not doing anything

[debian_nb2]

Hi,
I have noticed lately that quite often my laptop receives and sends data to the Internet (looking at Network History in the System Monitor) when I'm not doing anything, and even if I just turned on my computer without opening any programs. Is this normal, or is there something wrong here?

My installation (Debian 8.7 with Cinnamon) is very clean with almost no additional programs installed.

Thank you!

[GarryRicketson]

To some extent it is normal, there are not enough details to say exactly what
is going on in your case.
I did a search for you, using the same keywords as your subject title:
Internet traffic when not doing anything

The first hit, explains a little, as to why, etc. It is not something that only occurs
with "network manager" and Debian. Actually in the link below it is the modem, that indicates activity,..but in a nutshell , there all ways is some activity. It does not matter if is "network manager" or the modem, what ever , they all ways will show some activity.
http://lifehacker.com/5979481/why-does-my-modem-blink-even-when-im-not-using-the-internet
You can determine what the activity is more specifically if you want. There are tools available to do that.
Again, a search will get you all kinds of details on that.
On a Debian system, how can I see what the network activity is
Maybe the best place to start:
https://wiki.debian.org/SystemMonitoring

==== additional note====
Personally, I do NOT use any "automatic" connecting,..I only go on-line, connect
when I have a reason, for example to check this forum, or other servers, after I am finished with my on-line tasks, I completely disconnect from internet, and stay disconnected , to do my off-line tasks / work.
I never just leave the computer connected to internet and un-attended, even for a few minuets.
Of course , a server is different and it is online 24 hours, 7 days ,...continuously.

[dasein]

Is this normal, or is there something wrong here?

Could be either one, and without a lot more detail (amount of data being transmitted, a more precise definition of "quite often," what [if any] programs are open), there's no way to know for sure.

For really basic traffic monitoring, have a look at nethogs. Its functionality is somewhat limited, but it's relatively simple and straightforward and may give you at least a "first-cut" idea of which processes are involved. Fuller-featured programs (such as netstat or even wireshark) may prove necessary, but have a steeper learning curve.

[debian_nb2]

Alright, I guess I was using the wrong search words, sorry.
So it seems like some traffic is normal.

More details: the picture shows internet traffic a few minutes after the laptop was turned on, with no programs running. I guess its nothing to worry about then?

[dasein]

I guess its nothing to worry about then?

At the risk of seeming to repeat myself: you don't know that, either way. Yes, the "traffic" is minimal, which eliminates certain classes of problems (e.g., spambot). But if you're truly not running any network-related programs whatsoever, then it'd be handy to know the source for the traffic that you do see.

The explanation may be perfectly innocent (updater querying for updates, etc.), or it may not. But volume alone is not definitive.

[sunrat]

That tiny amount of traffic is probably just utility packets between your computer and router.
Wireshark may be massively overkill for this use, and mind-boggling to understand, but it will show you exactly what this traffic is all about.

[TonyT]

To see exactly what is occurring capture the packets using wireshark. If on a LAN behind a router you'll be surprised at all that is going on. Printer queries, samba broadcasts, updaters, messaging, mail, etc.

[pcalvert]

Some of that traffic is probably from the ntpdate program which keeps your computer's clock updated.

Phil

[debiman]

i'd be interested in someone actually trying to untangle that sort of thing...
so, debian_nb2, how's it going?

[GarryRicketson]

Post by pcalvert » 2017-03-20 23:14
Some of that traffic is probably from the ntpdate program---snip--

On mine that is the only active connection,

Using 'netstat' , and before I have even started a WM , and browser,..
I still get:

Code: Select all

$netstat > netstat-output.txt

Active Internet connections
Proto   Recv-Q Send-Q  Local Address          Foreign Address        (state)
udp          0      0  10.0.2.15.46493        Time100.Stupi.SE.ntp 
Active UNIX domain sockets
Address    Type   Recv-Q Send-Q      Inode       Conn       Refs    Nextref Addr
       0x0 stream      0      0        0x0        0x0        0x0        0x0
#---- snip----

Also if you are using "exim", and I guess the OP is,since it is a fresh install, and exim is installed by default,..
see this thread:
http://forums.debian.net/viewtopic.php?f=30&t=132254&hilit=exim