[Nottingham] /usr/lib/at-spi-registryd what?! Network haemorrhage...

[Richard Ward]

2009/4/27 Martin <martin at ml1.co.uk>:
> Folks,
>
> Just blundered across a strange one...
>
> Sometime overnight after many months of uptime, at-spi-registryd
> apparently spontaneously started spraying my local network with about 3k
> bit/s of continuous data.
>
> It looks like it was started up with my login many moons ago. It's now
> dead and the network haemorrhage died with it. All is fine oncemore.
>
> Which comes to...
>
> Short of starting up wireshark, how do you find out what process is
> spewing data across an interface?
>
> My usual trick of "netstat -atpu" didn't show it. I found it by cpu time
> used via "top" even though it always appeared to be in sleep mode.
>
> Cheers,
> Martin
>
> --
> ----------------
> Martin Lomas
> martin at ml1.co.uk
> ----------------
>
> _______________________________________________
> Nottingham mailing list
> Nottingham at mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/nottingham
>

ntop (http://www.ntop.org/) will give you all sorts of traffic
breakdowns, including IIRC what process is sending/receiving what and
to/from where. It even has a pretty web interface with pie charts 'n'
stuff.