Our internet is getting shaped, so excess traffic is affecting us far more than normal. I've narrowed down the source of traffic to my own PC, which is a freshly installed Xubuntu 16.10 machine. My router measures around 128 KB/s incoming with the machine on, and effectively 0 with the machine off. This seems to be quite constant. If I disable the interface by ifdown or equivalently with the NetworkManager tool, traffic also drops to 0.
However, trying to work out what is actually causing this is very intruiging. Tools like iftop and nethogs only report a very small amount of traffic, 4-5 KB/s when my machine is idle. These tools seem to report programs I am aware of (browser, email, ssh) accurately. The router still reports 128 KB/s incoming here.
How can I find out what is causing this traffic, and why are iftop and nethogs not finding it?
