Page 1 of 1

periodic heavy load on network

Posted: Fri Jul 28, 2017 10:39 am
by hstoellinger
Hello folks,
Looking at the systems monitor on Mint 18.2-KDE, I periodically see high transmission activity going on - both transmit and receive. Any ideas, why this might be the case and how I might find out the culprit? It might just be between my Mint laptop and my own private Debian 9 PC server. They are connected via LAN. Or else it might involve some download/upload to somebody on the internet, who knows? The former is possibly "only" a performance issue, the latter is somewhat worrying to my, as long as I am "in the dark". Thanks for any ideas
Regards from Salzburg
H. Stoellinger

Re: periodic heavy load on network

Posted: Fri Jul 28, 2017 10:53 am
by hstoellinger
Hello again,
By the way, the heavy network load may last for even a minute or more, then there is a break of a minute or two, where the load is "0" - only to recur again at the same hight level...

Re: periodic heavy load on network

Posted: Fri Jul 28, 2017 2:15 pm
by greerd
I usually install 'etherape' and 'wireshark' but I don't know how many dependencies KDE requires.

For command line, you can use netstat.
To see established connections with PID continuously

Code: Select all

watch -d -n0 "netstat -ap | grep ESTA"
Ctl-c to exit. Might want to prefix with sudo to monitor system level connections.

Re: periodic heavy load on network

Posted: Sun Jul 30, 2017 7:31 am
by hstoellinger
Hello,

Thanks for your help! I have now installed wireshark and collected some information - even though I am not familiar with it.
In general, looking at the KDE-Systems Monitor, I can see that heavy traffic on the LAN is directly related to starting/stopping
the smbd daemon on my debian 9 server system. I did NOT have the same experience under Debian 8.1!
From wireshark I can see loads of TCP-requests/responses from port 445 on the server to constantly increasing port numbers
on the LAN-connected Mint-8.2-KDE samba-client. These are lots of FIN, SYN, ACK packages.

Also, by activating an iptables-based firewall with appropriate entries , I see that the traffic has something like halved. It is
however still far too high to be comfortable! I do have to allow port 445 because I also have a Windows-7-client occasionally
on the LAN-connected laptop).

I am at a loss about what to do now. I can of course try to check whether the same occurs if I run the client under Mint 17.3.
Any ideas?
Thanks in advance
H. Stoellinger
Salzburg, Austria

Re: periodic heavy load on network

Posted: Sun Jul 30, 2017 8:30 am
by hstoellinger
Hello again,
Just tried out samba file sharing using Mint 17.3 on the client side. No high load there! So, I suppose the issue must
have something to do with MInt 18.2.
Regards,
H. S.

Re: periodic heavy load on network

Posted: Sun Jul 30, 2017 10:05 am
by altair4
Interested is an experiment? One that is easily reversible?

On the Mint18 client machine edit /etc/samba/smb.conf and add two lines in the [global] section right under the workgroup = WORKGROUP line:

Code: Select all

client min protocol = SMB2_02
client max protocol = SMB3
This disables SMB1 on your client. SMB1 is described as being "chatty" and "conversations" take place between machines using it even when file transfers are not taking place. I don't think it's to the degree you are experiencing but it might be interesting to find out.

Note: You will lose the ability to "browse" for other samba servers on your network when SMB1 is disabled. You can still access them by name but you have to do that explicitly.

Alternately you can add an avahi / samba service announcement file to your Debian server to restore that browsing functionality to your Linux / macOS clients. This describes how to do that: Samba Browsing in an all Linux or Linux/macOS network

Re: periodic heavy load on network

Posted: Sun Jul 30, 2017 11:28 am
by hstoellinger
Hello,
Thanks for your hints! Tried them both but it didn't do the trick.
I could send you some wireshark output, if you so desire. Are there any
special parameters I should specify there?
Thanks in advance for your help and - have a good Sunday in spite of
working!
Regards

Re: periodic heavy load on network

Posted: Mon Jul 31, 2017 6:27 am
by hstoellinger
Hello again,
One thing I noticed just now: smbd starts at boot-time on the Debian 9 server. When I then start my Laptop Mint 18.2 64-bit system - connected through Ethernet LAN to the sever - everything is o.k.. I can see and cd to the server-shares from the client Mint system. Everything is fine - no heavy load on the LAN. This immediately changes to the heavy load situation the second I restart or stop/start the smbd service on the server. The heavy load then continues forever. Again, all this is quite o.k. when connecting to the server through Mint 17.3-32-bit.
Regards
H. S.