Constant network activity from idle client

[Avro]

I've got a FreeNAS server running in a SOHO environment. There are two physically separate LANs here, each connected to one of the two Ethernet ports on the FreeNAS box. The 'primary' LAN is where most of the work takes place, and the other has only the media server connected to it. The media server is a re-purposed desktop PC running Win 10.

I've noticed constant activity on em1, which is the secondary LAN. It's not much, averaging 375 bits per second, but it's constant.

Anyone have an idea as to what's taking place? I'm aware that this is perhaps more of a "what's the Win 10 PC up to?" question than a FreeNAS one, but it's FreeNAS where I'm seeing the activity. The Win10 machine has read-only access to the shares that it can see, so I'm scratching my head as to what's continually coming in at that rate.

More curious than concerned.

Thanks,

Bill

Server specs:
FreeNAS 9.3
SuperMicro MBD-X9SCM
Intel Xeon E3-1230
24 GB ECC RAM
6 x WD Red 4TB HDDs, RAID-Z2

 

[diedrichg]

What's the media server software?

 

[Avro]

Ah, I should have mentioned that: no media server software. ...just a standard Win10 setup with Windows Explorer access to the medial files. From there, I can play them with VLC. So I guess it's a 'media player' not a server.

Lame, I know, but I haven't' gotten around to putting anything on it yet. So there's no database synchronization going on, as the PC just sits there and stares at itself most of the time.

 

[c32767a]

Anyone have an idea as to what's taking place? I'm aware that this is perhaps more of a "what's the Win 10 PC up to?" question than a FreeNAS one, but it's FreeNAS where I'm seeing the activity. The Win10 machine has read-only access to the shares that it can see, so I'm scratching my head as to what's continually coming in at that rate.

More curious than concerned.

It's probably the ethernet equivalent of background radiation.

Lots of things like to send the occasional broadcast or multicast packet, all of which will be received and processed (and graphed) by FreeNAS. The graph auto-scaling is what makes it look more interesting than it is. 64 bits/sec doesn't even scale to a single pixel in the em0 graph, but is 1/6 the height of the blue volume on the em1 graph. Assuming the smallest ethernet packet size of 64 bytes, that's about 6 packets per second on em1.

If you're really curious, you could use tcpdump -i em1 from the freenas command line to see specifically what packets are hitting the interface, but my speculation would be a combination of ARPs, Bonjour and other broadcasts. Maybe some Spanning Tree as well if your switch speaks it.

Always thought the Arrow was a nice ship.

 

[Avro]

Thanks. You're right - just a bunch of minor chatter between devices. The guest AP is on that switch, but on a different VLAN, however I'm seeing ARP stuff between it and the router. I'd assumed that if the FreeNAS box was recording it, it was traffic making it 'through' the Ethernet port. It's not - it's all just stuff passing by. The scale makes it look more that it is.

And yeah, it was a nice one. Had the privilege to talk to Jan Zurakowski about his work on it before he died.

Thanks again!

 

[tvsjr]

Or run Wireshark on the Win10 box... you can kill many hours obsessing over a handful of packets if you wish :)