2

I have been using Linux for about 5 years now but i am not very skilled with the commands to monitor and figure out internal issues.

I recently was having trouble with the internet. My roommates were complaining about internet being very slow. For some reason i checked my task manager and it said i uploaded 731 GB of data. I am not sure what it was. Its not doing it right now.

I do not know when it uploaded 731GB of data. Is there a way to figure out the history of the past few days to see when my computer uploaded that much data.

The issue here is not that my internet is slow but who(Process) and most importantly "WHEN" did it/they upload soo much data.

I have used NetHogs/ntop commands to make sure there is no process trying to upload data currently but i dont know how to check the history.

Thank you :)

EDIT: Its doing it again. Here is the screenshot of Nethogs command

Nethogs screenshot - do not know what those processes are

closed as off-topic by muru, Fabby, hg8, Volker Siegel, Eric Carvalho Dec 22 '15 at 13:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This is not about Ubuntu. Questions about other Linux distributions can be asked on Unix & Linux, those about Windows on Super User, those about Apple products on Ask Different and generic programming questions on Stack Overflow." – muru, Fabby, hg8, Volker Siegel, Eric Carvalho
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Malware is unlikely, some other possiblities are: Bittorrent or Initial backup to Megasync or other cloud storage – Oliver Oberdorf Dec 15 '15 at 16:47
  • I ran the history command to look at all the commands that got run. I did not see any bad commands. – hunterr986 Dec 15 '15 at 16:49
  • Also, my computer has a static ip behind the router. And I also have port forwarding to enable SSH to my machine. I have applications like team viewer, Dropbox, Skype on my machine. I also never used any torrent software. – hunterr986 Dec 15 '15 at 16:50
  • @hunterr986 Most likely, it was skype or dropbox streaming large amounts of data that required extra gigs to ensure a stable upload quality.That can make upload sizes increase drastically. A static IP will make that even higher. – David Dec 15 '15 at 16:52
  • Hmm. But a total of around 700 gigs? That's a lot right! – hunterr986 Dec 15 '15 at 16:54
1

I would start with WireShark:

Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions.

Basically, this tool helps you to find out where the data goes. Here's how to install WireShark on Ubuntu.

  • But I would like to know who and when the data was uploaded. I would like to know the process of figuring out the history of all the data sent over the network. – hunterr986 Dec 15 '15 at 17:41
  • You can see target servers or structure of traffice (torrents) and so derivate the source program. – Jasom Dotnet Dec 15 '15 at 17:47
  • Please look at the screenshot in the post. I an not sure how to read it. Why isnt there a PID? what are all those programs run by the root? – hunterr986 Dec 15 '15 at 18:33
  • ip-api.com/#122.228.8.145 Try to change root pass and, of course, update your system. Which Ubuntu do you have? – Jasom Dotnet Dec 15 '15 at 18:40
  • I have 14.04. I just figured out where the data is going to. Its all going to "122.228.8.145" but i cant figure out which process is doing it and how to kill it. I figured out the Ipaddress using the "iftop" command. – hunterr986 Dec 15 '15 at 18:55
1

May be you Torrent client is seeding continuously when you're connected to internet.

Use Wireshark to see the traffic's content (in addition to the remote address, but not the local process).

for that reason i use Network Monitor.

  • Please look at the screenshot in the post. I an not sure how to read it. Why isnt there a PID? what are all those programs run by the root? – hunterr986 Dec 15 '15 at 18:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.