Re: [gentoo-user] Re: Can root verify user is secure?

[Michael]

On Saturday, 29 August 2020 22:01:18 BST Grant wrote:

> The strange behavior was a critically slow internet connection first
> thing in the morning that wasn't fixed by a reboot or modem power
> cycle.  My net0 monitor didn't show any traffic but I still wonder if
> the upstream pipe could have been clogged with data.  My problem
> seemed to be the downstream but I think a full upstream pipe can slow
> the downstream?  No ISP reports online and it cleared up after a short
> while.  I haven't seen that before.  Would you be concerned?

This can be entirely an ISP congestion problem at their central concentrators.  
If you have ADSL, or a non-symmetric connection, a saturated upstream pipe at 
your router will reduce what the downstream can achieve.  Google for 
'bufferbloat' if you want to adjust your upstream rate on your router to 
maximise downstream performance.

If your local PC/switch/router do not indicate traffic flowing through when 
there should be, then the problem is clearly upstream.

It doesn't hurt to be a bit paranoid and keep an eye out, but I wouldn't lose 
sleep over it.  Taking some measurements and recording traffic will help to 
bottom it out.  Intelligent switches and more expensive routers have a 
capability of cloning ports for the purpose of monitoring traffic over them, 
running a packet capture, etc.  Firewall logs would also help indicate what 
connections were happening at the time and you should be able to forward these 
on your LAN to a syslog server to store and review later.


> Is there a separate device I can put on the network to monitor traffic
> so I can review it later on?

If you want to guard against changes to your OS, check:

app-admin/tripwire

Otherwise, router logs should be helpful in the first instance.