I have a very strange problem I haven’t seen anywhere else on the web, which is odd in itself.
When I fire up my pc (OpenSuse version 12.3 KDE 4.10.3) NetworkManager is constantly uploading between 95-120 kb/sec which then slows down any work I’m doing in my browser. The only workaround I’ve found is to go into YAST, switch to traditional method and hit okay. After it reconfigures, it either does not connect to the internet, or it has the same upload symptom. I then reboot the computer, switch back to NetworkManager under YAST, and the problem goes away (sometimes I need to reboot again, sometimes not.)
On 2013-06-26 05:24, Jim Henderson wrote:
> On Wed, 26 Jun 2013 01:36:02 +0000, Schlomy wrote:
>
>> NetworkManager is constantly uploading between 95-120 kb/sec which then
>> slows down any work I’m doing in my browser.
>
> NetworkManager shouldn’t be initiating any connections on its own - how
> are you determining that it is?
I would run in a terminal “iptraf” or “iptraf-ng” to list the active
connections, to find out what it is.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
On Wed, 26 Jun 2013 09:53:08 +0000, Carlos E. R. wrote:
> On 2013-06-26 05:24, Jim Henderson wrote:
>> On Wed, 26 Jun 2013 01:36:02 +0000, Schlomy wrote:
>>
>>> NetworkManager is constantly uploading between 95-120 kb/sec which
>>> then slows down any work I’m doing in my browser.
>>
>> NetworkManager shouldn’t be initiating any connections on its own - how
>> are you determining that it is?
>
> I would run in a terminal “iptraf” or “iptraf-ng” to list the active
> connections, to find out what it is.
That’s one tool that would do it; I use nethogs, but it’s not installed
by default.
IMO this is normal for a period of time, depending on your network security, number of machines on your network, network configuration and quality, Internet/Network apps configured to connect on bootup/login.
Shortlist examples:
Workgroup elections
ARP activity to discover and advertise “new” machine on the network
Dropbox(and other Cloud services) file sync
Apper
Email
As you describe, rebooting can interrupt sync/update services which may or may not run immediately with any boot.
I doubt NM is the real culprit, it’s what you’ve configured on the machine. You can verify maybe with connections but I would also recommend viewing running processes(eg top), running apps(eg KDE System Activity) and packet capture.
Sorry for the slow response, been traveling. Here’s what iptraf gave me. Not sure how to figure out what the ip’s are. The only upside to the constant uploading, because it does slow things terribly (right now it’s uploading 181kB downloading 0), is that when I do reboot and get some normal traffic, after a short while it just drops the connection (although the wifi signal is still strongly received/connected) and I have to disable wifi with Network Manager, and then reenable. But it only works a short while. At least with the constant upload it stays connected.
iptraf-ng 1.1.3.1
┌ TCP Connections (Source Host:Port) ────────── Packets ─── Bytes Flag Iface ──┐
│┌108.160.162.105:80 > 4 566 --A- wlan1 │
│└192.168.1.111:36092 > 2 982 -PA- wlan1 │
│┌192.168.1.111:55021 > 6 410 --A- wlan1 │
│└74.125.225.176:443 > 4 356 -PA- wlan1 │
│┌192.168.1.111:40023 > 4 256 --A- wlan1 │
│└217.146.2.2:5938 > 2 152 -PA- wlan1 │
│┌192.168.1.111:42343 = 4 216 CLOS wlan1 │
│└174.35.30.198:80 = 3 164 CLOS wlan1 │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└ TCP: 4 entries ──────────────────────────────────────────────── Active ─┘
┌──────────────────────────────────────────────────────────────────────────────┐
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
│ UDP (1320 bytes) from 192.168.1.111:40006 to 224.0.0.56:46412 on wlan1 │
└ Bottom ────── Elapsed time: 0:01 ──────────────────────────────────────────┘
Packets captured: 13936 │ TCP flow rate: 0.00 kbps
Up/Dn/PgUp/PgDn-scroll M-more TCP info W-chg actv win S-sort TCP X-exit
Thanks, and sorry for the slow reply, I’ve been traveling.
It’s not just a short period of uploading, it is constant. I’ve been online for 40 minutes now, and we’re holding steady at 181 kB upload, 0 download. The only upside is, that when it isn’t uploading, my connection drops consistently, and I have to disable wireless through Netmanager, then reenable and I connect for awhile. At least while I’m uploading, the connection maintains. But it slows down any downloading terribly.
Thanks again for thinking about it. Any other ideas?
I’m not sure that Network Manager is the problem, but I’ve got a network monitor widget running and that’s showing me the traffic. The only upside to the constant uploading, because it does slow things terribly (right now it’s uploading 181kB downloading 0), is that when I do reboot and get some normal traffic, after a short while it just drops the connection (although the wifi signal is still strongly received/connected) and I have to disable wireless with Network Manager, and then reenable. But it only works a short while. At least with the constant upload it stays connected.
All I know is that even before I open a browser or any other program, the monitor is showing a constant upload. I ran iptraf as suggested by robin_listas but don’t know how to interpret the results. They are in my response to him/her.
You can use “host ipaddress” to find out the server’s name.
Or use “netstat -tu” instead of iptraf-ng, that shows the name of possible.
┌ TCP Connections (Source Host:Port) ────────── Packets ─── Bytes Flag Iface ──┐
…
│┌192.168.1.111:40023 > 4 256 --A- wlan1 │
│└217.146.2.2:5938 > 2 152 -PA- wlan1 │
…
[/QUOTE]
wolfi@amiga:~> host 217.146.2.2
2.2.146.217.in-addr.arpa domain name pointer server20201.teamviewer.com.
That one is teamviewer.com, so I guess this is where you are uploading to.
Do you have TeamViewer installed?
Belay what I posted about the constant uploading allowing me to stay connected to the internet. But maybe that’s a clue? I left the computer on for the longest time yet with the network monitor showing uploading (now at 180 kB) and still in a firefox window I received the “no network connection” error page. Although the network monitor was still supposedly uploading! So again, I disabled Wireless through NetworkManager, the upload/download rate went to 0, reenabled, the upload went right up again, but I could download as well.
afaik TeamViewer is one way (of several) to let krackers into your
machine…
in Europe there is a scam where someone calls and says (something
like) “I work in the technical support center and we are getting
messages from your computer that you have a virus in your Windows
machine. . .”
if at that point you tell them you don’t have windows they hang up,
but if you play dumb and try to follow their directions (which i
don’t remember now) eventually they learn on their own that you
linux, and the very next thing they try is to get you to install
TeamViewer so they “can remove the virus from your machine…”
of course you must give them some passwords so they can “clean your
machine…for FREE”…
and of course, instead of removing something they want to install a
root kit . . . and use your machine as a control node they can
ssh/TeamViewer/whatever into to hide their own IP . . .
and the constant upload you see might that your machine is serving
as a kiddie porn relay site…or maybe it is just DropBox updating,
or packagekit checking to see if there are updates or or or…who
knows ??
On 2013-07-31 11:23, dd wrote:
> On 07/30/2013 10:46 PM, wolfi323 wrote:
>> Do you have ‘TeamViewer’ (https://en.wikipedia.org/wiki/Teamviewer)
>> installed?
>
> afaik TeamViewer is one way (of several) to let krackers into your
> machine…
It may…
> in Europe there is a scam where someone calls and says (something like)
> “I work in the technical support center and we are getting messages from
> your computer that you have a virus in your Windows machine. . .”
Heh. X’-)
> and the constant upload you see might that your machine is serving as
> a kiddie porn relay site…or maybe it is just DropBox updating, or
> packagekit checking to see if there are updates or or or…who knows ??
Agreed.
Schlomy, your machine is highly suspect, and perhaps under the control
of somebody else.
Remove that teamviewer fast. And consider reinstalling the machine.
Maybe, you can investigate what’s going on with ntop, but if the machine
is “controlled”, it might not work.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
Except that I sought out TeamViewer to take over my parent’s computer after reading some good Linux reviews of it. Is there some documentation that it is not legitimate? Nobody asked me for passwords except the one I used to create an account.
Also the upload issue happens even when I don’t have any internet connection.
But I’m getting frustrated, so, as much as I hate to do it, perhaps a reinstall is in my future anyway. It’s not like, as a Linux user, I haven’t done it many times before. sigh
On 2013-07-31 19:06, Schlomy wrote:
>
> Except that I sought out TeamViewer to take over my parent’s computer
> after reading some good Linux reviews of it. Is there some documentation
> that it is not legitimate? Nobody asked me for passwords except the one
> I used to create an account.
>
> Also the upload issue happens even when I don’t have any internet
> connection.
Huh? :-?
That’s strange, should be worth investigating.
Does you router have a disk, or usb stick, shared?
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
On 2013-07-31 21:56, Schlomy wrote:
>
> No. Just a basic netgear router.
>
> I won’t have time to try a reinstall until maybe next Tuesday
> (traveling again). I’ll post on what happens.
No, if you are sure that internet is disconnected (at the router), and
explain how you are sure, then the upload thing can not be to internet
and we have to reevaluate things.
It can not be an attack using TeamViewer. At least not on internet.
So delay that reinstall.
–
Cheers / Saludos,
Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)
So,
It looks like you’re running something that’s on a multicast network, do a Google search on the ip address 224.0.0.56 and it’ll turn up plenty of complaints.
Q - What are you running that operates on a multi-cast network? Could you either be relaying or serving content (by design)?