tl;dr The bandwidth usage recorded by nload (home page) is higher than what's provided by tcpdump (home page).

There seems to be a difference in bandwidth usage when I run tcpdump -e -w - | pv -a > /dev/null as opposed to running nload.

For example, I saw a bandwidth usage of 150kbps using nload but only 30kbps using tcpdump. To rule out pv, I've done the following:

# open a tmux session where tcpdump dumps all traffic into a file for 60 seconds
$ tmux new-session -d -s tcpdump_60secs 'tcpdump -e -w tempfile' && sleep 60 && tmux kill-server
$ wc -c tempfile
# divide by 60, resulting in bytes per second

Any pointers to how nload gets its bandwidth statistics will be appreciated.

Replicated on a clean Ubuntu 18.04 install, on a LXC proxmox container, tested with nload build using commit 8f92dc0.

2

1 Answer

I looked through the source code and it appears that the data mainly comes from /proc/net/dev Reference on GitHub

To look further, the data comes from the kernel rather than direct sources and will involve the heavy diving into this source tree to fully understand the process.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy