3

On a Unix or Linux computer we can run the iftop command and monitor the packets of all the other computers on our local network. Why does this not completely saturate the bandwidth of our connection?

If we have a 100 Mbs connection, and 10 other computers also have a 100 Mbs connection on the network, why do we still have any usable bandwidth since our network adapter is receiving all the packets intended for the other computers at all times?

Improve this question
3
  • I think you may be confusing old bus-topology networks with modern switched networks. On very very old networks, every host on a bus received each packet. In bus networks, yes, the possibility of collision or the bus being perpetually busy could cause major performance issues, because of the shared media. Newer networks are "Micro-segmented" in that each host has its own network line, and doesn't share it with anyone else. Only traffic to or from that host ever ends up on that line. the switch the host is plugged into is smart and only sends traffic the host wants.
    – Frank Thomas
    Oct 13, 2014 at 9:10
  • @FrankThomas Hmm, my office must use this old technology, as I can see the bandwidth usage of many clients on the network when I type 'iftop'.
    – Steve M
    Oct 13, 2014 at 11:24
  • Ahh ok, yes, broadcast and multicast traffic would be visible to all clients. the important takaway here is that for broadcast and multicast traffic, you are an intended recipient, whether you want the packet or not. the op is not seeing traffic for other clients, they are seeing traffic other clients are sending to them (and everyone else), for service discovery/announcement, network convergence, or coordinated realtime content delivery. Anyway, op, this traffic does not constitute the majority of those terminals usage. your station can't see Unicast traffic between other hosts.
    – Frank Thomas
    Oct 13, 2014 at 19:17

2 Answers 2

Reset to default
5

On a Unix or Linux computer we can run the iftop command and monitor the packets of all the other computers on our local network. Why does this not completely saturate the bandwidth of our connection?

Your premise is incorrect. iftop does not “monitor the packets of all the other computers on our local network.” As described in the official documentation for iftop:

iftop - display bandwidth usage on an interface by host

Additionally in the description; emphasis is mine:

iftop listens to network traffic on a named interface, or on the first interface it can find which looks like an external interface if none is specified, and displays a table of current bandwidth usage by pairs of hosts.

All iftop does is present network data for the machine it is run on including packets destined for the specific machine. But unless iftop is run from a server that is a router or some kind of device that sits in the middle of all network traffic, it won’t ever show anything but traffic on the local machines network ports.

That said, you if you are seeing packets from other machines they are most likely from devices broadcasting their presence via ARP and/or multi-cast. Line via technology like Bonjour or Avahi. But this is not tons of packets but rather bursts of "I'm here!" announcements from devices that help your interface know who/where these devices are.

In some environments, ARP traffic & broadcasting is disabled for this reason. It’s not so much that it saturates bandwidth as much as the constant announcements can just cause confusion to switches and such.

Improve this answer
2
  • Yes, it monitors traffic on the interface. The reason I said what I said is: I bring my Ubuntu laptop into the office, log into wifi network, type iftop. I can see bandwidth usage of many different computers, including computers that are connected via ethernet only. Are you saying this is an unusual condition? Maybe the network is improperly configured?
    – Steve M
    Oct 13, 2014 at 11:18
  • And more back to my question - given this condition, is my computer actually see the bandwidth of all the computers it is monitoring then?
    – Steve M
    Oct 13, 2014 at 11:21
-1

You're not receiving all the packets of the other computers on the local network. You're only receiving the ones that happen to leak to your connection.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .