Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • 2
    > Does all tun0 traffic also go through eth0 or is it seperate traffic going through the two devices? We can't tell you how you've set up your VPN! Commented Jul 1 at 10:12
  • 1
    Fair point, I took over this project from someone else, so right now don't know the specifics of how OpenVPN has been configured. But is on my list of todos, I only added the information and the bonus question in the hope it added additional useful context Commented Jul 1 at 11:01
  • I guess the VPN packets on tun0 are encapsulated and sent over the real network interface eth0. This could be an explanation for 124.27 MiB vs. 115.67 MiB. If the additional traffic on eth0 is TCP, then you can try running tcpdump and capture SYN and FIN packets using something like tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0' with writing to a file and later check the IP addresses and port numbers. Maybe you can guess what could be causing the additional traffic. Commented Jul 1 at 14:24
  • 1
    If you're running tcpdump over, e.g., an ssh connection on the same interface you're dumping, you will want to exclude that ssh connection from the tcpdump (e.g. add and not (port ssh and host x.x.x.x)` to the tcpdump expression, where x.x.x.x is your IP address or hostname). Otherwise every packet monitored will generate more traffic over the ssh connection, which will also be monitored, resulting in even more traffic, and so on. The interesting stuff you're looking for will be buried in the noise of all the ssh traffic. Commented Jul 2 at 6:42
  • 1
    @christian-37 You should edit your question and add all information to the question. It is difficult to get the whole picture by reading all comments. Instead of only describing some commands output with your own words, also show the exact output in the question. This helps us to verify that your interpretation is correct. Commented Jul 3 at 10:50