tl;dr The bandwidth usage recorded by nload (home page) is higher than what's provided by tcpdump (home page).
There seems to be a difference in bandwidth usage when I run tcpdump -e -w - | pv -a > /dev/null
as opposed to running nload
.
For example, I saw a bandwidth usage of 150kbps using nload
but only 30kbps using tcpdump
. To rule out pv
, I've done the following:
# open a tmux session where tcpdump dumps all traffic into a file for 60 seconds
$ tmux new-session -d -s tcpdump_60secs 'tcpdump -e -w tempfile' && sleep 60 && tmux kill-server
$ wc -c tempfile
# divide by 60, resulting in bytes per second
Any pointers to how nload
gets its bandwidth statistics will be appreciated.
Replicated on a clean Ubuntu 18.04 install, on a LXC proxmox container, tested with nload build using commit 8f92dc0.
I looked through the source code and it appears that the data mainly comes from
/proc/net/dev
Reference on GitHubTo look further, the data comes from the kernel rather than direct sources and will involve the heavy diving into this source tree to fully understand the process.