Show external connections?

1

The Status -> Network (Other) graph is very interesting. I’m seeing some interesting spikes of traffic during the night that I’d love to drill down on and see what is going on. Is there anything in IPFire that would allow me to figure out what those traffic spikes are all about?

Thanks,
Craig

1 Like
2

Hi Craig! Welcome to the IPFire forum.

Excellent question! I see the same thing every night near 1:30 AM.

Screen Shot 2020-10-18 at 1.52.17 PM
Screen Shot 2020-10-18 at 1.52.17 PM2000×698 165 KB

3

Hi @csete and @jon,

me too, every night near 1:30 AM too.

Open connections by week
Open connections by week916×323 52.1 KB

A ghost in the machines…? :wink:

4

At 01:25 fcron executes /etc/fcron.daily/openvpn-crl-updater.
Maybe this is ‘ghost’. :wink:

5

Given this conversation, I take it that there is nothing in IPFire that would allow me to see what those connections are up to?

6

Isn’t my explanation plausible?
Do you use OpenVPN?
What sort of WAN connection do you use?

7

Bernard - Your explanation could be plausible, however my real question was more about whether the function exists to see the connections that were made.

8

You can observe the actual connections in the ‘Status’ menu. But this means you must observe them at the peak time ( about 1:30 PM ).

9

Hi all,

on one of the IPFire systems I maintain, this seems to correlate to the daily PPPoE re-dial-in forced by my ISP, which usually happens around 03:15 AM here:

netother.cgi
netother.cgi910×300 19.3 KB

Thanks, and best regards,
Peter Müller

10

Hi,
after reasoning a bit about the problem, I did a test.
I can observe such peaks at my system also ( max. ~2000 ). They are not time related, but related to start of clients. Curiously the peaks only show up at the start of my laptop.
Thinking about my doings around startup, I remembered starting bittorrent service soon after switching on the computer. Stopping/restarting the service produced exactly the peak.
Thus an answer to the opening question is only possible, if you know the activities in your system.

11

Thanks. I guess I had just hoped that IPFire was keeping track of the outbound connections and there was a report hidden somewhere. No matter though, I’m still very happy with IPFire.

12

Yes @bbitsch , that’s a plausible explanation, but in my case I am not using OpenVPN on this firewall and I have not set it up…

13

Any other applications in the LAN ( see my explorations above ) or a PPPoE redial ( see Peters post )?

14

@bbitsch, thank you for your ideas, it is indeed a possibility, but:

  • all my machines are off at 1:30 AM (all night actually)
  • I do not plan an automatic reconnection (re-dial) with IPFire because it’s my upstream router (Internet box) which manages.

There is still a “connected” television (on standby) which may be trying to update its firmware…

Edit : I’ll look if I don’t have something else… :wink:

15

Looking at DHCP, I have about 30 active DHCP leases out right now. Between multiple computers, Raspberry Pi’s, streaming sticks, etc there are a lot of potential clients that could be busy doing things overnight.

16

Hi,

well, in case you are observing active connections while sitting in front of your IPFire’s GUI, this might help:

Thanks, and best regards,
Peter Müller