3

I have a question regarding the data usage of one of my USB 3G modems. I am currently using a Huawei E303 USB 3G dongle in a Raspberry Pi Zero W, with a normal SIM-card. I am running the RPi without any GUI, only booting to terminal window, and using the latest Raspbian OS. My goal is to use the Raspberry as a monitoring station, which picks up some data and sends it to a database every ~hour.

When I turn on the device and connect to the network, I can see that the amount of data received and transmitted (the RX and TX packets) keeps rising, even when no program is running. This happens when I'm using an ethernet cable, when I'm on wifi and when I'm using the dongle mentioned above. Apparently, the communciation protocol is the reason as to why amount of packets keep rising all the time.

So my question is, why is there network traffic when I'm not running any programs accessing any network?

edit: About the ethernet cable, I'm using a USB adapter. I kept the RPi with the dongle in running over the weekend (8/3 - 10/3) and noticed that the SIM-card had used many MBs of data, around 3Mbs, even when no program is sending any data, and I'm looking for a way to reduce that amount of data so I won't have to upgrade the payment. The data will accumulate over the month to quite a lot.

edit 2: The amount of network traffic seems to fluctuate quite a bit - keeping the RPi running today for about 1,5h used up 1,1MBs. Almost all of the traffic comes from RX packets. I am checking network usage by connecting a screen to the RPi, but I can SSH into it aswell, and sometimes do.

edit 3: It is the network traffic on the 3G interface that I'm concerned about. The traffic on the ethernet cable for example is given, and I understand that part. It is the 3G interface which is the problem - when I'm not accessing the internet, I'm still seeing a rise in the traffic over that interface. Apologies for not being clearer about this.

edit 4: I'm measuring the data simply using either simply ifconfig to look at the amount of traffic, or using iftop. In the past week I contacted the provider of the SIM-card, and his report of the amount of data I was using was largely consistent with my own findings. Do you guys think I should use some other program mentioned here - maybe I'm not getting the correct numbers?

edit 5: Yesterday I captured around 1 hours worth of traffic on the wireless 3G interface using Wireshark, and have the file saved with the packets. Thing is, I'm not sure if I should post it. I'm a total newbie to network stuff - is it safe to post the packet data, i.e. could anybody DDoS me or something?

Also, I'm very grateful for all the responses, thank you so much for your help :)

Output of ps -All

pi@raspberrypi:~$ ps -All
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0     1     0  0  80   0 -  1380 -      ?        00:00:03 systemd
1 S     0     2     0  0  80   0 -     0 -      ?        00:00:00 kthreadd
1 S     0     3     2  0  80   0 -     0 -      ?        00:00:00 ksoftirqd/0
1 S     0     4     2  0  80   0 -     0 -      ?        00:00:00 kworker/0:0
1 S     0     5     2  0  60 -20 -     0 -      ?        00:00:00 kworker/0:0H
1 S     0     7     2  0  80   0 -     0 -      ?        00:00:00 rcu_sched
1 S     0     8     2  0  80   0 -     0 -      ?        00:00:00 rcu_bh
1 S     0     9     2  0 -40   - -     0 -      ?        00:00:00 migration/0
1 S     0    10     2  0  60 -20 -     0 -      ?        00:00:00 lru-add-drain
1 S     0    11     2  0  80   0 -     0 -      ?        00:00:00 cpuhp/0
1 S     0    12     2  0  80   0 -     0 -      ?        00:00:00 cpuhp/1
1 S     0    13     2  0 -40   - -     0 -      ?        00:00:00 migration/1
1 S     0    14     2  0  80   0 -     0 -      ?        00:00:00 ksoftirqd/1
1 S     0    16     2  0  60 -20 -     0 -      ?        00:00:00 kworker/1:0H
1 S     0    17     2  0  80   0 -     0 -      ?        00:00:00 cpuhp/2
1 S     0    18     2  0 -40   - -     0 -      ?        00:00:00 migration/2
1 S     0    19     2  0  80   0 -     0 -      ?        00:00:00 ksoftirqd/2
1 S     0    21     2  0  60 -20 -     0 -      ?        00:00:00 kworker/2:0H
1 S     0    22     2  0  80   0 -     0 -      ?        00:00:00 cpuhp/3
1 S     0    23     2  0 -40   - -     0 -      ?        00:00:00 migration/3
1 S     0    24     2  0  80   0 -     0 -      ?        00:00:00 ksoftirqd/3
1 S     0    26     2  0  60 -20 -     0 -      ?        00:00:00 kworker/3:0H
5 S     0    27     2  0  80   0 -     0 -      ?        00:00:00 kdevtmpfs
1 S     0    28     2  0  60 -20 -     0 -      ?        00:00:00 netns
1 S     0    29     2  0  80   0 -     0 -      ?        00:00:00 khungtaskd
1 S     0    30     2  0  80   0 -     0 -      ?        00:00:00 oom_reaper
1 S     0    31     2  0  60 -20 -     0 -      ?        00:00:00 writeback
1 S     0    32     2  0  80   0 -     0 -      ?        00:00:00 kcompactd0
1 S     0    33     2  0  60 -20 -     0 -      ?        00:00:00 crypto
1 S     0    34     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    35     2  0  60 -20 -     0 -      ?        00:00:00 kblockd
1 S     0    36     2  0  60 -20 -     0 -      ?        00:00:00 watchdogd
1 S     0    38     2  0  60 -20 -     0 -      ?        00:00:00 rpciod
1 S     0    39     2  0  60 -20 -     0 -      ?        00:00:00 xprtiod
1 S     0    40     2  0  80   0 -     0 -      ?        00:00:00 kswapd0
1 S     0    41     2  0  60 -20 -     0 -      ?        00:00:00 vmstat
1 S     0    42     2  0  60 -20 -     0 -      ?        00:00:00 nfsiod
1 S     0    52     2  0  60 -20 -     0 -      ?        00:00:00 kthrotld
1 S     0    53     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    54     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    55     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    56     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    57     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    58     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    59     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    60     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    61     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    62     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    63     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    64     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    65     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    66     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    67     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    68     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    69     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    70     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    71     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    72     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    73     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    74     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    75     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    76     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    77     2  0  60 -20 -     0 -      ?        00:00:00 iscsi_eh
1 S     0    78     2  0  60 -20 -     0 -      ?        00:00:00 dwc_otg
1 S     0    79     2  0  80   0 -     0 -      ?        00:00:01 kworker/2:1
1 S     0    80     2  0  60 -20 -     0 -      ?        00:00:00 DWC Notificati
1 S     0    81     2  0  61 -19 -     0 -      ?        00:00:00 VCHIQ-0
1 S     0    82     2  0  61 -19 -     0 -      ?        00:00:00 VCHIQr-0
1 S     0    83     2  0  60 -20 -     0 -      ?        00:00:00 VCHIQs-0
1 S     0    84     2  0  80   0 -     0 -      ?        00:00:00 VCHIQka-0
1 S     0    85     2  0  70 -10 -     0 -      ?        00:00:00 SMIO
1 S     0    86     2  0  80   0 -     0 -      ?        00:00:00 kworker/1:1
1 S     0    87     2  0  80   0 -     0 -      ?        00:00:00 kworker/3:1
1 S     0    88     2  0  80   0 -     0 -      ?        00:00:00 kworker/2:2
1 S     0    89     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0    90     2  0  80   0 -     0 -      ?        00:00:00 mmcqd/0
1 S     0    92     2  0  80   0 -     0 -      ?        00:00:00 jbd2/mmcblk0p7
1 S     0    93     2  0  60 -20 -     0 -      ?        00:00:00 ext4-rsv-conve
1 S     0    94     2  0  60 -20 -     0 -      ?        00:00:00 ipv6_addrconf
1 S     0   110     2  0  60 -20 -     0 -      ?        00:00:00 kworker/3:1H
1 S     0   116     2  0  80   0 -     0 -      ?        00:00:00 kworker/u8:1
1 S     0   122     2  0  80   0 -     0 -      ?        00:00:00 kworker/u8:2
1 S     0   124     2  0  80   0 -     0 -      ?        00:00:00 kworker/0:2
1 S     0   134     2  0  80   0 -     0 -      ?        00:00:00 kworker/1:2
1 S     0   136     2  0  80   0 -     0 -      ?        00:00:00 kworker/3:2
4 S     0   139     1  0  80   0 -  2996 -      ?        00:00:00 systemd-udevd
4 S     0   145     1  0  80   0 -  2482 -      ?        00:00:00 systemd-journa
4 S   106   416     1  0  80   0 -   968 -      ?        00:00:00 avahi-daemon
4 S     0   417     1  0  80   0 -  1267 -      ?        00:00:00 cron
4 S     0   418     1  0  80   0 -  8104 -      ?        00:00:00 rsyslogd
4 S   105   421     1  0  80   0 -  1372 -      ?        00:00:00 dbus-daemon
1 S     0   443     2  0  60 -20 -     0 -      ?        00:00:00 cfg80211
5 S 65534   444     1  0  80   0 -   572 -      ?        00:00:00 thd
5 S     0   446     1  0  80   0 -   640 -      ?        00:00:00 dhcpcd
1 S   106   454   416  0  80   0 -   968 -      ?        00:00:00 avahi-daemon
1 S     0   481     2  0  60 -20 -     0 -      ?        00:00:00 kworker/0:1H
4 S     0   504     1  0  80   0 -   962 -      ?        00:00:00 systemd-logind
1 S     0   507     2  0  60 -20 -     0 -      ?        00:00:00 kworker/1:1H
1 S     0   513     2  0  60 -20 -     0 -      ?        00:00:00 kworker/2:1H
4 S   110   522     1  0  80   0 -   591 -      ?        00:00:00 vnstatd
5 S   107   563     1  0  80   0 -  1421 -      ?        00:00:00 ntpd
4 S     0   564     1  0  80   0 -  1416 -      tty1     00:00:00 login
4 S     0   565     1  0  80   0 -   967 -      ?        00:00:00 agetty
4 S     0   584     1  0  80   0 -  1964 -      ?        00:00:00 sshd
1 S     0   628     2  0  80   0 -     0 -      ?        00:00:00 scsi_eh_0
1 S     0   629     2  0  60 -20 -     0 -      ?        00:00:00 scsi_tmf_0
1 S     0   630     2  0  80   0 -     0 -      ?        00:00:00 usb-storage
4 S  1000   690     1  0  80   0 -  1243 SyS_ep ?        00:00:00 systemd
5 S  1000   704   690  0  80   0 -  1719 -      ?        00:00:00 (sd-pam)
4 S  1000   729   564  0  80   0 -  1539 wait_w tty1     00:00:00 bash
1 S     0   735     2  0  60 -20 -     0 -      ?        00:00:00 bioset
1 S     0   956     2  0  80   0 -     0 -      ?        00:00:00 kworker/3:0
1 S     0   957     2  0  80   0 -     0 -      ?        00:00:00 kworker/2:0
4 S     0   958   584  0  80   0 -  2377 -      ?        00:00:00 sshd
5 R  1000   964   958  0  80   0 -  2377 -      ?        00:00:00 sshd
0 S  1000   966   964  0  80   0 -  1538 wait   pts/0    00:00:00 bash
0 R  1000   983   966  0  80   0 -  1071 -      pts/0    00:00:00 ps

Thanks in advance.

P1138
  • 31
  • 2
  • 1
    It depends on which processes are active. I suggest to get a process list. Could you send the result of ps -All Thanks – tswaehn Mar 10 '19 at 18:38
  • Are you logging in with SSH to check the network usage? – Roger Jones Mar 11 '19 at 13:28
  • You may wish to install NetHogs. sudo apt-get install nethogs NetHogs will show network bandwidth utilization by process. – Tim Campbell Mar 11 '19 at 14:01
  • Hi, Please note that ps -All comes with capital A. This makes a huge difference. – tswaehn Mar 11 '19 at 16:11
  • Number of Tx/Rx packets is somewhat irrelevant for this purpose, as there are any number of keep-alive and network maintenance packets that can be exchanged and not count against your usage, it is not clear to me if you are tracking actual bandwidth used as measured by the GSM Provider? – crasic Mar 12 '19 at 21:54
  • @TomasBy ps -All was asked by @tswaehn. – Ingo Mar 12 '19 at 23:02
  • @tswaehn Does the output of ps -All help you to examine what's going wrong? – Ingo Mar 12 '19 at 23:03
  • The process list does not indicate a process that continuously sends data. Which goes along with the observation that most of data rate is RX. – tswaehn Mar 14 '19 at 06:51
  • By the way if you login to the device through ssh this will add up to the traffic for sure :) – tswaehn Mar 14 '19 at 06:52
  • Actually how do you measure your traffic? – tswaehn Mar 14 '19 at 06:53
  • 3
    In response to edit #4 I would highly recommend you use Wireshark to understand the nature of the packets. You may even be able to identify the culprit based on human readable parts of the packet data – crasic Mar 14 '19 at 17:31

2 Answers2

1

I do not understand your question because it is unclear what is how connected. For example a Raspberry Pi Zero W does not have an ethernet port where you can plug in an ethernet cable. But if you refer to the RX and TX packets there is nothing that eats this data. This are the ethernet data packets that are transfered through whatever line is used for data transfer, maybe the USB 3G modem, or a wifi connection, or a wired ethernet connection. Even if you do not transfer files to store them on the remote device you will have many packets made for the communication protocol that is temporary processed in memory.

There are many protocols are running just for network management and that produce packets received and sent through the interfaces. For example you may find DHCP RENEWs to refresh ip addresses, arp broadcasts to find devices on the network, upnp multicasts to propagate printer and/or media devices and so on. Particular Microsoft devices are very chatty (NETBIOS packets if enabled and others). If you want to know exactly what's going on on your network you can use a packet sniffer like tcpdump (console program) or wireshark (GUI program).

You should use a monitor and keyboard/mouse to manage the RasPi. If you "ssh" into it you will produce a huge amount of packets going through the interface. ssh is a TCP connection that transfer always the screen content.

If you observe that stored data are increasing for many MB over weekend without known activity you have to find the files that are increasing. The first look is at /var/log/ where you find many log files, most important /var/log/syslog but also others. If there is a bad configured interface (or something else) it will produce endless error messages and fill the log.

Ingo
  • 42,097
  • 20
  • 85
  • 197
1

If you have a Windows 10 PC on you network, MicroSoft updates once a month. It gobbles up most of my data. I think it is the second Tuesday of the month.

Ernie Hansen
  • 11
  • 1