# [solved]How to know which app is transfering data

## pd1986

I am just aware that from the net monitor in conky, there are always data downloaded to my laptop. Even though I did nothing after booting. I How could I know where it is from? Which application is downloading something?

ThanksLast edited by pd1986 on Wed May 30, 2012 5:07 pm; edited 1 time in total

----------

## pd1986

I tried nethogs, but I found nothing. no app, no debit

----------

## ghutzl

Have you tried iotop?

----------

## pd1986

 *ghutzl wrote:*   

> Have you tried iotop?

 

Just tried after you said, I kept looking at the terminal for 30s, nothing found. no disk read, no write no swapin. but there are still data downloading.

However the debit is not important, 10K/s or 5K/s or so. Is that normal?

----------

## pd1986

it is from 3 K/s to 5K/s rirght now

----------

## xaviermiller

Do you have any netwok session open ? (ssh, ...)

----------

## pd1986

 *XavierMiller wrote:*   

> Do you have any netwok session open ? (ssh, ...)

 

NOoo, I don't think I have. I don't need remote control, so I never touch ssh. But I'm not familiar with "network session", so I'm not sure if I have one. but ssh is off I can ensure that.

----------

## xaviermiller

How do you connect to that machine ? what applications run on it ?

----------

## pd1986

 *XavierMiller wrote:*   

> How do you connect to that machine ? what applications run on it ?

 

I'm sorry, what do you mean by "connect to that machine"? Which machine? Mine?

In fact, that's my laptop, I install Gentoo several months ago. Now, I use grub to start the system and use Bash shell, That's all.

Then I log in with my user account, there is nothing weird. But after connecting to my wifi network in using wpa_supplicant, the debit starts. At that moment, I did nothing after booting and I haven't even connected to my desktop environment. I just ran one command to see if there are received data.

```
cat /proc/net/dev
```

By the way, there is no data sent to exterior, only data received. I don't where it comes fromLast edited by pd1986 on Wed May 30, 2012 2:34 pm; edited 2 times in total

----------

## pd1986

 *XavierMiller wrote:*   

> How do you connect to that machine ? what applications run on it ?

 

Just rebooted my laptop, here is the tasklist without doing anything

```
UID        PID  PPID  C STIME TTY          TIME CMD

root         1     0  0 16:19 ?        00:00:00 init [3]  

root         2     0  0 16:19 ?        00:00:00 [kthreadd]

root         3     2  0 16:19 ?        00:00:00 [ksoftirqd/0]

root         4     2  0 16:19 ?        00:00:00 [kworker/0:0]

root         5     2  0 16:19 ?        00:00:00 [kworker/u:0]

root         6     2  0 16:19 ?        00:00:00 [migration/0]

root         7     2  0 16:19 ?        00:00:00 [migration/1]

root         8     2  0 16:19 ?        00:00:00 [kworker/1:0]

root         9     2  0 16:19 ?        00:00:00 [ksoftirqd/1]

root        10     2  1 16:19 ?        00:00:00 [kworker/0:1]

root        11     2  0 16:19 ?        00:00:00 [cpuset]

root        12     2  0 16:19 ?        00:00:00 [khelper]

root        13     2  0 16:19 ?        00:00:00 [netns]

root        14     2  0 16:19 ?        00:00:00 [kworker/u:1]

root       236     2  0 16:19 ?        00:00:00 [sync_supers]

root       238     2  0 16:19 ?        00:00:00 [bdi-default]

root       240     2  0 16:19 ?        00:00:00 [kblockd]

root       378     2  0 16:19 ?        00:00:00 [ata_sff]

root       388     2  0 16:19 ?        00:00:00 [khubd]

root       395     2  0 16:19 ?        00:00:00 [md]

root       401     2  0 16:19 ?        00:00:00 [kworker/1:1]

root       498     2  0 16:19 ?        00:00:00 [rpciod]

root       530     2  0 16:19 ?        00:00:00 [kswapd0]

root       599     2  0 16:19 ?        00:00:00 [fsnotify_mark]

root       616     2  0 16:19 ?        00:00:00 [nfsiod]

root       622     2  0 16:19 ?        00:00:00 [crypto]

root       686     2  0 16:19 ?        00:00:00 [kworker/u:2]

root       760     2  0 16:19 ?        00:00:00 [scsi_eh_0]

root       763     2  0 16:19 ?        00:00:00 [scsi_eh_1]

root       766     2  0 16:19 ?        00:00:00 [scsi_eh_2]

root       769     2  0 16:19 ?        00:00:00 [scsi_eh_3]

root       772     2  0 16:19 ?        00:00:00 [scsi_eh_4]

root       775     2  0 16:19 ?        00:00:00 [scsi_eh_5]

root       778     2  0 16:19 ?        00:00:00 [kworker/u:3]

root       779     2  0 16:19 ?        00:00:00 [kworker/u:4]

root       780     2  0 16:19 ?        00:00:00 [kworker/u:5]

root       781     2  0 16:19 ?        00:00:00 [kworker/u:6]

root       782     2  0 16:19 ?        00:00:00 [kworker/u:7]

root       783     2  0 16:19 ?        00:00:00 [kworker/u:8]

root       826     2  0 16:19 ?        00:00:00 [kworker/0:2]

root       837     2  0 16:19 ?        00:00:00 [kpsmoused]

root       840     2  0 16:19 ?        00:00:00 [exec-osm]

root       847     2  0 16:19 ?        00:00:00 [block-osm]

root       974     2  0 16:19 ?        00:00:00 [jbd2/sda10-8]

root       975     2  0 16:19 ?        00:00:00 [ext4-dio-unwrit]

root      1087     1  0 16:19 ?        00:00:00 /sbin/udevd --daemon

root      1351     2  0 16:19 ?        00:00:00 [kworker/1:2]

root      1352     2  0 16:19 ?        00:00:00 [cfg80211]

root      1355     2  0 16:19 ?        00:00:00 [hd-audio0]

root      1358     2  0 16:19 ?        00:00:00 [iwlwifi]

root      1362     2  0 16:19 ?        00:00:00 [hd-audio1]

root      1542     2  0 16:20 ?        00:00:00 [jbd2/sda8-8]

root      1543     2  0 16:20 ?        00:00:00 [ext4-dio-unwrit]

root      1550     1  0 16:20 ?        00:00:00 /usr/sbin/mount.ntfs-3g /dev/sda5 /media/sda5 -o rw,noexec,nosuid,nodev,users,utf8=true,uid=1000,umask=0022

root      1553     1  0 16:20 ?        00:00:00 /usr/sbin/mount.ntfs-3g /dev/sda6 /media/sda6 -o rw,noexec,nosuid,nodev,users,utf8=true,uid=1000,umask=0022

root      1558     1  0 16:20 ?        00:00:00 /usr/sbin/mount.ntfs-3g /dev/sda7 /media/sda7 -o rw,noexec,nosuid,nodev,users,utf8=true,uid=1000,umask=0022

root      1930  1087  0 16:20 ?        00:00:00 /sbin/udevd --daemon

root      1931  1087  0 16:20 ?        00:00:00 /sbin/udevd --daemon

101       2165     1  0 16:20 ?        00:00:00 /usr/bin/dbus-daemon --system

root      2179     1  0 16:20 ?        00:00:00 supervising syslog-ng

root      2180  2179  0 16:20 ?        00:00:00 /usr/sbin/syslog-ng

root      2194     2  0 16:20 ?        00:00:00 [kworker/0:3]

root      2201     1  0 16:20 ?        00:00:00 /usr/sbin/console-kit-daemon

root      2280     1  0 16:20 ?        00:00:00 /usr/libexec/polkitd --no-debug

root      2408     2  0 16:20 ?        00:00:00 [flush-8:0]

root      2921     1  0 16:20 ?        00:00:00 /usr/sbin/wpa_supplicant -Dwext -c /etc/wpa_supplicant/wpa_supplicant.conf -W -B -i wlan0 -P /var/run/wpa_supplicant-wlan0.pid

root      2928     1  0 16:20 ?        00:00:00 /usr/bin/wpa_cli -a /etc/wpa_supplicant/wpa_cli.sh -p /var/run/wpa_supplicant -i wlan0 -P /var/run/wpa_cli-wlan0.pid -B

root      2958     1  0 16:20 ?        00:00:00 /usr/sbin/cron

root      2971     1  0 16:20 tty1     00:00:00 /bin/login --        

root      2972     1  0 16:20 tty2     00:00:00 /sbin/agetty 38400 tty2 linux

root      2973     1  0 16:20 tty3     00:00:00 /sbin/agetty 38400 tty3 linux

root      2974     1  0 16:20 tty4     00:00:00 /sbin/agetty 38400 tty4 linux

root      2975     1  0 16:20 tty5     00:00:00 /sbin/agetty 38400 tty5 linux

root      2976     1  0 16:20 tty6     00:00:00 /sbin/agetty 38400 tty6 linux

peiding   3130  2971  0 16:20 tty1     00:00:00 -bash

root      3154     1  0 16:20 ?        00:00:00 dhcpcd -m 2002 wlan0

peiding   3200  3130  0 16:20 tty1     00:00:00 ps -ef

```

----------

## radius

Are you looking for something like NetHogs perhaps?

I haven't used it, but it seems to offer what you want. Sorry if it does not work.

----------

## pd1986

 *radius wrote:*   

> Are you looking for something like NetHogs perhaps?
> 
> I haven't used it, but it seems to offer what you want. Sorry if it does not work.

 

I mentioned that in the 2nd reply of this thread, I found nothing.

I really assume that it comes from my wifi network. I will see what happens when I get home. If it's the same, that will be my system's problem.

----------

## pd1986

Confirmed. I am right now at home and there is no received data any more. So that's the problem of the network where I work.

What could be that? I was under attack?

----------

## Ant P.

Maybe there are other machines on that network broadcasting data?

----------

## krinn

windows machine love to broadcast things: dlna, ms sharing and pnp queries to router. on heavy network, you will get lot of "whois" query from hosts to the router itself

wireshark could have tell you who is doing what.

----------

## pd1986

 *krinn wrote:*   

> windows machine love to broadcast things: dlna, ms sharing and pnp queries to router. on heavy network, you will get lot of "whois" query from hosts to the router itself
> 
> wireshark could have tell you who is doing what.

 

Thank you very much.

----------

