[TriLUG] cause for alarm?

[Barry Gaskins]

   It seems to me that there are a lot of legitimate things that could
cause the upload count to be greater than the download count.  If you
have bittorrent distributing the latest release of Ubuntu Linux then
that would do it.  Or a simple apache web server serving web pages
since the web page response would be larger than the request.  Even
sending out email with pictures attached to your friends/relatives
would do it.

   Of course a spam bot running on a hacked machine would also do it.
Not sure how to be sure which one it is if you do not own the machines
behind the router.

   - Barry Gaskins

On Fri, Jun 6, 2008 at 10:50 AM, Ben Pitzer <bpitzer at gmail.com> wrote:
> I'd reserve judgement until you see the growth rates for those values.  You
> may well be looking at a wrapped counter.  Might be worth putting up some
> type of monitoring for those values.  Simple collection and pumping it into
> rrdtool might suffice.
>
> -Ben Pitzer
>
>
> On Thu, Jun 5, 2008 at 8:42 PM, Greg Brown <gwbrown1 at gmail.com> wrote:
>
>> After all this discussion of possible metering on TWC I decided to check
>> the
>> stats on my public router on at the outer banks (the public wi-fi network -
>> I figured, if any network, a public one would have a lot of bandwidth eaten
>> up).  What I found was interesting:
>>
>> In/out packets 44281817/56033743 (1.86 GB/3.83 GB)
>>
>> 'cuse me?  More outbound than inbound?  This particular modem has a 3/1
>> connection so the outbound is faster than most however I still would have
>> thought, over 60 days, the download would have been much higher than the
>> upload.  I wonder if the counters wrapped.
>>
>> What think yee?
>>
>> greg
>> --
>> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
>> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
>>
> --
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
>