Hi All Thanks for all help. I think I worked out what the problem was with tshark and wireshark.
For info: I would appear that the increase in traffic was due to a broken dovecot-imap-thunderbird 16.0.2 interaction. When left open, thunderbird was synching up to several 100's Mb of email from server to client hourly - it had been set to synch every 10 mins - but instead of only checking new headers it was downloading every email message. It was set to locally cache messages. Plus other legimate traffic it was adding up to ~3 Gb of upload traffic daily - which was way more than I had expected. There are related bugs reported on the thunderbird website. I had recenly upgraded t/bird, so its a regression. There are posts relating to dovecot and t/bird. I am not sure if it also applies to other imap servers or only dovecot-t/bird combination. Seems to have been fixed in latest T/bird 17 beta which I am using now. Cheers Daniel. On Tue, 20 Nov 2012 15:57:42 +1100 DanyJ <[email protected]> wrote: > Hello > > I have run tshark and downloaded the capture file. I am reading the > capture file using wireshark > > I see a lot of the following showing: > > 18 1.047790 111.67.22.211 111.67.23.255 > DB-LSP-DISC 153 Dropbox LAN sync Discovery Protocol > > What are these? There is not Dropbox on the server. Any one can help > please? > > Cheers > Daniel. > > > > Hello LUVers > > > > I have been experiencing an increase of about 5x factor in my > > outgoing network traffic for a while -at least last week - I > > cannot explain that change in activity,configuration etc... (It > > does peak to much higher level at a specific time, but I have > > worked out why that was so.. a overgrown backup file that was being > > transfered daily) > > > > So I need to find out what that traffic is. > > > > What is a recommended log analysers to help me quickly here? Want > > it to tell me how much data is being transfered by which protocol > > > > Or any recommended procedure to identify that traffic? > > > > Any ideas please? > > > > Its a Ubuntu 10.04 server, running Apache, Postfix and related > > stuff (Spamassassin, Amavisd etc) (I had varnish on it, but I > > turned it off) > > > > Cheers > > Daniel. > > _______________________________________________ > > luv-main mailing list > > [email protected] > > http://lists.luv.asn.au/listinfo/luv-main > > _______________________________________________ > luv-main mailing list > [email protected] > http://lists.luv.asn.au/listinfo/luv-main _______________________________________________ luv-main mailing list [email protected] http://lists.luv.asn.au/listinfo/luv-main
