Network traffic numbers way off on Linux

[404d]

I've tried both searching and browsing for similiar threads to no avail, so here's one. Sorry if there's a thread already.

1) Which version of WhatPulse are you running?
WhatPulse 2.4

2) What Operating System are you using?
elementary OS 0.2 (Luna) 64-bit (Ubuntu 12.04 LTS-based distro)

Code:

Linux Yukiho 3.2.0-51-generic #77-Ubuntu SMP Wed Jul 24 20:18:19 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

Most of the info that describes the issue itself should be in the attachments. There's mainly two screenshots of interests which shows monitoring tools + WP before and during an iperf test. Permissions are set, and for the record running the binary with sudo doesn't change the outcome. Network configuration is done using `/etc/network/interfaces`, Network Manager is disabled.

Although in this case I've got two interfaces bonded together, I've experienced similiar if not the same problem when they weren't bonded. Outbound network traffic will be routed from `10.0.1/24` to `192.168.10/24` before being sent to the 'tubez'. The issue has also occured in a setting at the computer party The Gathering, in which the interfaces weren't bonded.

The issue is "permanent", i.e. there's not been any cases so far where it's been counting the traffic correctly. This applies to both inbound and outbound traffic.

Screenshot description
- The top-left Munin graph is interface data grabbed from the computer itself.
- The middle-left and bottom-left Munin graphs are the two ports on the switch that this computer is connected to and in a trunk with.
- The bottom-middle Munin graph is from the WAN link on my switch
- Middle-middle is Gnome System Monitor
- To the very top is iftop running on the bond0 interface

On the left-hand graphs there is a 200 M+ spike before the relevant data, you can safely disregard the spikes (iperf testing). To my recollection, even though local traffic isn't counted towards your total it should still show up under WP's network tab. The monitoring tools to take a look at to see the difference between and during iperf testing is Gnome System Monitor, iftop and WP.

NICs

Code:

00:19.0 Ethernet controller: Intel Corporation Ethernet Connection I217-V (rev 05)
08:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 11)

[smitmartijn]

There seems to be a skew of 1,58GB on 14GB, which is like 10%. That can have several reasons;

- The type of traffic you're sending. If you're sending small packets, the skew will be bigger; the client only counts the data and leaves the headers out.
- pcap can't keep up. It's not getting enough CPU time and basically dropping packets.
- Interface card offloading is making for giant packets which the client can't unpack.

Most likely, you're running into the first..I've seen that a lot with benchmark tests. The WhatPulse client is built for customer desktops with average workloads, which is where it's pretty accurate.