# "something" causes internet traffic...

## Martux

Well, gkrellm2 showed me that something is constantly having up/downstream between 5 and 10 kb/s. I suspect kpoete/skype as when I close them it seems to stop.

How could I find out what exactly this traffic is? I tried ntop but can't make anything out of it.

In the log files I couldn't find anything interesting but I am also not running services on this machine, it's a laptop.

----------

## mikegpitt

Try running tcpdump in a terminal window when you aren't utilizing the network connection for anything else.  You should (hopefully) be able to figure out what's connecting based on where the traffic is going to.  Another option is etherape.

----------

## Martux

Hmmpf, I think I found the responsible: Kopete's MSN plugin gone totally wild and trying to connect all the time  :Sad:  At least I know now what's up.

----------

## krinn

netstat could have answer that too

----------

## Hu

 *krinn wrote:*   

> netstat could have answer that too

 This can be true for TCP, but is not true for UDP.  In some cases, it might not be true of TCP.  For TCP, if the offending program is spamming connect requests to a server that is alive and actively rejecting the connection, you may never catch a socket in SYN_SENT and the sockets would never progress past that.  For UDP, you could confirm that an application had a socket, but you could not confirm an association, since UDP is connectionless.

----------

## overkll

net-analyzer/iftop is a handy utility for checking live traffic.

----------

## Ant P.

```
emerge net-analyzer/wireshark
```

----------

