Hello,
Should’t that be quite easy to find out what’s that traffic when you login ssh root user and use tcpdump command from shell?
I haven’t got same model you have, but observing first interface name using following and picking the one you need
# ifconfig | more
then once you have interface name and if’s still enabled system level (having UP listed below inet and inet6 address lines), you can see what’s going on by
# tcpdump -i $interface -s 1500 -n
where $interface is the interface you like to see. That command will stay following live, you can interrupt it by ^C (Ctrl-C) and if that is something you would like to save in file and then come back later time to get that file you can
# tcpdump -i $interface -s 1500 -n -w save.pcap &
you should see it’s running background with command.
# jobs
If you wish to terminate while still logged in same session user
# fg
and then you are back to interactive session to that job and can terminate it with ^C . But if you log out and leave it running, then session connection is lost to that process and need to use
# ps | grep tcpdump
and you see it’s still running, you can terminate it with
# kill -HUP $(pidof tcpdump)
and check results with that ps command above, it’s gone. Anyway once you are done. you can fetch that capture save.pcap file to you computer and get Wireshark software from https://wireshark.org and open that save.pcap file and study what kind of traffic is using that interface.
OK, some further advise. Remove that save.pcap from the afterwards, use
# rm save.pcap
and see it’s gone listing the directory
# ls -l
The amount of traffic leaking you mentioned is so small that file shouldn’t be large and this is quote safe to do. But remember that capture files can get large if you capture from interface where you have a lot of traffic and filling small flash disk in the device could cause problems. Therefore consider using external flash memory disk or like in that kind of situations.
Also if you are about to study and save traffic from the interface you have logged in to the device you need to prevent causing loop capturing your own traffic. Then you first need to check what is your own IP address where you logged to the device and exclude that address from the capture.
# netstat -tn
You can see your connecting address in Foreign address column, if as I assume you are only one logged that time, otherwise it lists all connected. Teltonika RutOS does’t unforutunately include Linux/*nix programs which you usually would look that kind of using “who am i” or “w” commands.
Then once having you connection IP you can exclude your won’t connection traffic adding filter string end of tcpdump command line “not host IP”
# tcpdump -i $interface -n … not host $your-own-ip-here
Tcpdump command line syntax can be hard to get right and require few attempts. Man page is quite long, but is worth checking out when more complicated use cases are needed. Following is link to tcpdump version I’ve got my Teltonika current stable OS version.
And once you get that save.pca file, you could perhaps send it to Teltonika support and they will able to see from there quite directly what’s going on there.
cheers,
riku
e: s/caution/causing/
–