Questions[traffic](ubuntu)

I'm running speedometer 2.8 which has been recommended in various answers on this site to monitor network utilization. I have read the manual page and have searched on Google but I am not seeing it documented what the numbers on each interface mean.

For instance, when I am receiving data, I might see something like this:

RX: wlp3s0  2.73 MiB/s 2.52 MiB/s  947 KiB/s

A screenshot from the documentation shows:

In addition, above these numbers to the right of the cyan ASCII graph are two vertical bars, one blue and one white which seem to be tracking two of these numbers, although I'm not sure which. This picture shows them circled in yellow.

I assume that maybe these three numbers represent the transfer rate during the last period as well as maybe average, minimum, or maximum values. But it is unclear as to which might be which.

What specifically does each number refer to, and to which of these numbers do the blue and white graphs correspond?

Using NetHogs on an Ubuntu 16.04 (web) server, i.e. on a machine where no consumer applications or web browsers are installed, besides traffic that is to be expected (HTTP and SSH)

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
5266 www-data /usr/sbin/apache2                                 eth0      15.142       2.924 KB/sec
4698 <ME>     sshd: <ME>@pts/0                                  eth0       0.899       0.071 KB/sec

I’m also seeing quite a few suspicious connections that look like this:

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
   ? root     <SERVER_IP_V4>:515-122.228.XXX.XXX:43652                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:4946-92.118.XXX.XXX:44243                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1703-94.177.XXX.XXX:51820                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1433-123.207.XXX.XXX:45628                    0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:34568-223.71.XXX.XXX:40922                    0.000       0.011 KB/sec
   ? root     <SERVER_IP_V4>:9444-51.91.XXX.XXX:46170                      0.000       0.000 KB/sec
   ? root     unknown TCP                                                  0.000       0.000 KB/sec

So they have no associated process ID [1], are all run by root, seem to be outgoing connections from random-looking ports to other random-looking ports (i.e. no outgoing HTTP requests [2] [3]), have no associated device, and all have little to no traffic [4].

The geographic origins of the destination addresses seem to be China, Russian Federation and Seychelles, among others, as per whois.

My firewall rules, as per ufw status verbose, should actually block any incoming traffic except for SSH and HTTP(S). So these outgoing connections would have to be caused by malicious programs running on the host, right?

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  

Is this indeed suspicious or perhaps even evidence of malicious traffic, or are these some false positives (for some reason I may not be seeing)?

Or is the order of the two IP addresses in each pair not relevant [5] [6], so that these might in fact be incoming connections? If so, how can this happen if UFW has been configured to block such connections, and how can one of these connections even have data transferred?

At the moment I'm working at a company and the problem is they allow SSH on wifi but not on their wired network. At the moment I push everything through a vpn, but that gives overhead on an already slow network.

I was wondering how I could make all my traffic go through my eth0 but make my ssh connection use wlan0 instead of eth0.

It's important all other traffic goes through eth0 as the wifi here is extremely slow, but just fast enough for a simple shell.

Is there software I can install to enable me to monitor inbound and outbound internet traffic for security reasons?

I recently installed ubuntu and loving it because of speed and interface. I want to do what I can to make this the greatest OS I've ever worked with. Can you provide suggestions as to what I should install or do?

I use a 3G cellular Internet connection with a very strict traffic limit, but some times I go to office and use an unlimited and fast cable connection (and of course I do traffic-consuming operations, like updating the system there).

I'd like to keep track of how much have I already downloaded using the mobile connection (so, it can either filter by interface or be easily suspendable so that I can pause it when I use an unlimited line) this month (so, the counter most not reset when I reboot my laptop or reconnect, I'd lile to only reset it manually).

What's the easiest way to do this in Ubuntu 10.10?

I wouldn't like to set up any complex monitoring/billing systems.