CAREY SCHUG via Talk said on Fri, 26 Sep 2025 22:48:29 -0500 (CDT)
2. whatever it is, in some fraction of september it was 800 gigabytes. I had consistantly used 200 GB per month for the 3 prior months, and was up to a terabite just in a little over half of september. (or are those numbers off by a factor of 1000?) (see table at end)
3. i doubt that is just "browser chatter" ^^^^^
It's an intermittent, intermittents are a bitch, and the root cause could be almost anything. I have a suggestion to add to the list of diagnostic tools you're assembling: A second by second log of network traffic. This might help you see several correlations to help focus in on things. Focusing in is all you can do because it's an intermittent. Here's what I recommend, running as root because that's what iftop likes: iftop -t | carey.sh >> carey.log And the following is carey.sh: ==================================================================== #!/usr/bin/env ksh date "+RESULTS: %Y/%m/%d_%H/%M/%S" while IFS= read -r line; do echo "$line" if [[ "$line" == "========="* ]]; then printf "\n\n\n" date "+RESULTS: %Y/%m/%d_%H/%M/%S" fi done ==================================================================== The carey.log has timestamped headers that make parsing pretty easy. You could even modify carey.sh to ring a bell and throw up a (zenity) message box when traffic goes over a certain amount. Another useful tool, though not for logging, is nethogs, which gives you a view of which of your processes is hogging all the traffic. Once again, run nethogs as root. HTH, SteveT Steve Litt http://444domains.com