Something sucking out my internet dry

Today, my internet data ran out. It’s earlier than I expected. Bought new package, and few minutes later 2GB suddenly being sucked out.

Today I found out my PC using almost 10GB of data, and I wasn’t doing anything. I tried to find out the culprit. It is not my phone.

Using vnstat, it does say that my PC spent 9.2 GB of data.
I’m using nethogs to monitor my internet usage per application but, it does not give ueful information. It shows that my internet usage is small so it’s not accurate.

At the time of writing this, it’s still being sucked out really fast.
Steam auto update is turned off, pamac “check for new update” also turned off. I set my ethernet connection as “metered connection” in network manager.

WHYY What could be using my internet?!
Is it something to do with the operating system?

vnstat -d                                                                                     ✔ 

 enp8s0  /  daily

          day        rx      |     tx      |    total    |   avg. rate
     2022-01-29     1.04 GiB |   72.14 MiB |    1.11 GiB |  110.82 kbit/s
     2022-01-30     0.98 GiB |   94.36 MiB |    1.08 GiB |  106.89 kbit/s
     2022-01-31     1.10 GiB |   86.34 MiB |    1.18 GiB |  117.67 kbit/s
     2022-02-01   597.73 MiB |   71.57 MiB |  669.30 MiB |   64.98 kbit/s
     2022-02-02   146.86 MiB |   34.74 MiB |  181.59 MiB |   17.63 kbit/s
     2022-02-03     1.53 GiB |  101.44 MiB |    1.63 GiB |  161.94 kbit/s
     2022-02-04     8.04 GiB |  391.84 MiB |    8.42 GiB |  837.45 kbit/s
     2022-02-05     1.21 GiB |   87.29 MiB |    1.30 GiB |  128.97 kbit/s
     2022-02-06     1.35 GiB |   80.06 MiB |    1.43 GiB |  142.18 kbit/s
     2022-02-07     1.26 GiB |   85.95 MiB |    1.34 GiB |  133.22 kbit/s
     2022-02-08     2.58 GiB |  152.92 MiB |    2.73 GiB |  271.56 kbit/s
     2022-02-09     3.18 GiB |  132.73 MiB |    3.31 GiB |  328.82 kbit/s
     2022-02-10     4.56 GiB |  399.74 MiB |    4.95 GiB |  491.82 kbit/s
     2022-02-11     4.90 GiB |  828.10 MiB |    5.71 GiB |  567.67 kbit/s
     2022-02-12     1.31 GiB |   95.47 MiB |    1.41 GiB |  139.69 kbit/s
     2022-02-13   587.04 MiB |   59.87 MiB |  646.91 MiB |   62.81 kbit/s
     2022-02-14     1.52 GiB |  119.79 MiB |    1.64 GiB |  162.56 kbit/s
     2022-02-15     9.22 GiB |  616.54 MiB |    9.83 GiB |  976.81 kbit/s
     2022-02-16     4.93 GiB |  328.17 MiB |    5.25 GiB |    6.83 Mbit/s
     estimated     64.55 GiB |    4.20 GiB |   68.74 GiB |

NOTE Normal internet usage should be around 1GB per day. The log in previous days that is 3GB or higher is when I intentionally woke up in the middle of the night to download something, because midnight internet is free. Today I didn’t do that but it spent a looot of my internet.
That 9GB usage is SO WEIRD, I didn’t intentionally download big files.

nethogs shows only small traffic. Which is weird because the usage is a lot more.

This is ridiculous data usage. WHAT WOULD IT BE. Can someone help me find out why?

now Gnome system monitor says 13GB of data received to day. Too bad it does not tell me where did that came from.

I just ran iftop, and it quickly shows a lot of data usage.
Unfortunately it’s still does not help since the table only shows current traffic, not overall.

320MB in just few minutes, and 400MB when i wrote this.
THat is so stupid.

SOrry if I sounded rude, I’m just pissed off right now. Not sure if there are better tools to check it. Too bad we don’t have Glass Wire equivalent tool in linux.

Meanwhile nethogs that had been ran for quite a while only shows 200MB total usage. WHICH IS WRONG.

ALso It’s midnight now, so I can run test for the next 3 hours. I will not watch youtube, download stuff or anything. I’ll just let my PC on with these network monitoring tool and see how much data it uses.
I turned off steam and discord as well.

I see big traffics occasionally from gnome-system-monitor. But again, it does not tell me where is it coming from.

Install a program like OpenSnitch. It is a application firewall, but you should see which programs create traffic.

Or to see the destinations use a tool like wireshark and use the statistics - endpoints view.

It is usually hard to see short bursts with iftop.

1 Like

Thank you for the suggestion. opensnitch sounds like interesting tool.
But if I’m not mistaken, it does not show bandwidth usage right? It only shows what program trying to use internet.
It will ask if I want to allow a program to connect to internet or not only in the first time the program tried to do it.

I’m not sure how I can find out what eat all my internet with that. Say if the program tried to download thing the first time, it’s a small file. Then 3 minutes later it suddenly download bigger file.

So far I havent found out what program does eat all my internet, but I think it has stopped for quite some time before I installed opensnitch.

Perhaps it was between steam or discord. hmm… I hope it does not happen again in the future.

But I did find some stuff that I don’t understand trying to access internet. Perhaps I should start learn what those things do. like goa daemon

This is correct, but it also shows which application connects to which IP. The statics from wireshark show which IP addresses are responsible for the traffic. If you combine both you should see which application crates the treaffic.

However, this should also possible with nethogs.

Gnome Online Accounts.



FYI, you’ve been recommended this before;

1 Like

Try nethogs. It’s in the repos and it shows (in console) real time network traffic by process.

1 Like

Ah I’m sorry I missed that, I didn’t revisit that post after marking solution.
That looks like a great tool! I’ll try that out, hope it will be accurate.
Thank you for the reminder.

nethogs is what I already used. It’s not accurate, and that’s where my frustation came from.

However there is bandwhich which is similar but more accurate. It’s also in the repo. Not only it shows app usage, it also shows where that app connected to and how big the traffic to that address is.
I’m pretty satisfied with it.

I tried running iftop, nethogs, and bandwhich in a session. iftop is the most accurate, bandwhich is pretty close, and nethogs is way off.

One downside I found so far from bandwhich is that, there is <unknown> app and it also count traffic through localhost. It does not have big impact on daily use but Don’t Starve Together made massive localhost traffic.

I still haven’t found what ate my internet that day since it hasn’t happened again. I will have my revenge!

I hope I’m not necroposting. I came back to this thread after testing bandwhich for a bit.

1 Like

Don’t expect any help for your wish. This is undoubtly a non legal act you are trying and none will assist in a criminal act. I hope that the forum-maintainer will close this thread as soon as possible to prevent damage.

Maybe this post was intended for another thread?
It does not seem to fit anything that is mentioned here.

1 Like

That’s what the Flag button is for, you can use it yourself…

… except monitoring their own bandwidth is perfectly legal.

1 Like

I see you focus only on your PC/Linux… maybe you should take a look at your Router!

Deactivate Wlan on your Router and use cable connection instead.

When you sure your Router is perfectly secure and under full control, maybe a Firewall on Linux could also help.