Saturday, June 12, 2010

Who's eating my bandwidth?

No pictures, this is a low bandwidth post.

ecently my irc conversations were being minced up by lag. I ended up connecting with the 3G card and not the ADSL and then the little netbook sucked the 3G card dry. In this country where it is cheaper to buy a legitimate DVD rather than torrent a ripped copy I started to investigate.
All though the laptop didn't seem to be the hungry one, I started on the laptop, here are the tools I settled on.

First - find out how much I am using:
For the netbook and the laptop, a  command line bandwith watcher - vnstat
You can monitor multiple interfaces and it will tally over days, weeks and months.
sudo apt-get install vnstat
and then in my case
vnstat -u -i eth0
vnstat -u -i wlan1

to check do the following.

Daily bandwidth report.
vnstat -i eth01 -d

Hourly bandwidth report.
vnstat -i eth0 -h

Monthly bandwidth report.
vnstat -i eth0 -m

Real time speed report.
vnstat -i eth0 -l

Next I started playing with Conky

From an overwhelming variety of links here's the two I found most useful, a blog entry with example, and the color chart.

In my .conkyrc file I have this command:

${execi 30 netstat -ept | grep ESTAB | awk '{print $9}' | cut -d: -f1 | sort | uniq -c | sort -nr}
which just does a netstat -ept and finds established connections and then does some formating and sorting showing a process ID and name something like this:

4 1728/beam.smp
4 1626/python
3 13962/chromium-brow
1 21097/python
1 2010/weechat-curses
1 1452/python

From this I see that chromium-browser and weechat-curses has the internet but also 3 python scripts and beam.smp. Possibly others but the were not on the top list. So who are these pythons who are also eating the bandwidth.

ps -ef |grep 1626
says ...
xxxx 1626 1384 0 18:32 ? 00:00:01 /usr/bin/python /usr/bin/gwibber-service
repeat for 21097 and 1452
xxxx 21097 1 0 18:50 ? 00:00:07 /usr/bin/python /usr/lib/ubuntuone-client/ubuntuone-syncdaemon
xxxx 1452 1384 0 18:31 ? 00:00:08 /usr/bin/python /usr/bin/

AHA! so its gwibber and ubuntuone and my gmail notify scripts. Weird thing is I thought I disabled UbuntuOne and Gwibber startup tasks.

Now who is beam.smp? The Internet says ... something to do with couchdb ... my ps search confirms this and shows it was startup up by somthing related to erlang. Now who is interpreting Erlang on my pc and using couchdb and accessing the internet all the time? The mystery continues. From this bug it seems to be related to Gwibber and UbuntuOne. Hmmm...

Moral of this story
Backup on Flash not Cloud.