Dual NIC, odd incoming traffic depeding NIC in use

Discussions related to using VirtualBox on Windows hosts.
Post Reply
IMR
Posts: 2
Joined: 16. Sep 2021, 21:38

Dual NIC, odd incoming traffic depeding NIC in use

Post by IMR »

Hello,

I have been using Virtualbox for quite long time at my home office. We just moved to new place, where I setup the network bit differently than before and now the Virtualbox (latest, 6.1.26) behaves bit oddly, ie. depending which NIC I use and where it is connected, there is either constant 4.2 Mbps incoming traffic on the NIC, with the other there is no such traffic.

The topology is bit like this (all connections are cables)

Code: Select all

PC --------> Dir655 ----- > Switch (Netgear G108) ---------+
|                                                          +-------------- Asus GT AC5300 --> modem --> fiber .... WORLD
+------------------ Switch (Netgear G108) ------------------+
The MB is Asus ROGEE with Marvell 10G Ethernet + normal Intel 1G Ethernet

If I make in VirtualBox the network connection to be bridged adapter via the Marvell 10G or the 1G, when it is connected directly to the Switch, there is constant 4.2 Mbps traffic coming in (seen via Task Manager's performance tab). If I then change the bridge to go through the NIC, which goes via Dir655, there is no such traffic coming in.

Edit: And in both configurations, the connections work, but for the "odd one", there is constant extra 4.2 Mbps.

Any idea, why this would be? And how this situation could be remedied.

Cheers.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Dual NIC, odd incoming traffic depeding NIC in use

Post by mpack »

You don't give us much data to work with.

If you are using bridged networking then VirtualBox isn't involved in the network, all it does is provide a host driver that implements the simple switch. You should use other tools to investigate network traffic.

I'm told that one reason SMB1 fell out of favor, and no longer enabled by default on modern devices, is because of the large amount of traffic it generates. I don't know if that would account for this tho.

Otherwise it could be some kind of syncing task on a new PC: OneDrive or email perhaps.

Try opening a guest task manager, details view, and enable the I/O columns.
IMR
Posts: 2
Joined: 16. Sep 2021, 21:38

Re: Dual NIC, odd incoming traffic depeding NIC in use

Post by IMR »

Thank you for the reply.

I played bit more with the home cabling/networking and re-arranged the topology a bit and now the odd constant incoming traffic is gone.

I changed the topology to:

Code: Select all

  + --------> Dir655 ----- +
PC                          +  Switch (Netgear G108)   +-------------- Asus GT AC5300 --> modem --> fiber .... WORLD
  +-------------------------+
I need to study bit more, what caused this.

It was pretty odd, that this alteration fixed the issue. Maybe the two switches was the issue, as the other second switch had e.g. a rasperrypi and some other devices connected to it.

Again, thank you for help.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Dual NIC, odd incoming traffic depeding NIC in use

Post by scottgus1 »

FWIW The forum allows pictures to be posted using the Upload Attachment tab. A quick Paint PNG might help to decipher the layout.

Maybe you had a network loop? A wireshark investigation could also help locate the source of the traffic.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Dual NIC, odd incoming traffic depeding NIC in use

Post by mpack »

IMR wrote: I played bit more with the home cabling/networking and re-arranged the topology a bit and now the odd constant incoming traffic is gone.
Again, you don't confirm any of my guesses so still no data to base a reliable opinion on. If the tracking was some kind of syncing process then it'll be gone when the sync is completed.

I have a PiHole in my LAN too, providing DNS and DHCP, and I'm not aware of it doing any strange comms. I don't think the Pi even does update checks unless you tell it to ("sudo apt update"), but I don't consider myself a Linux expert so could easily be wrong. In any case a PC on the network shouldn't see that traffic unless you're both on a repeater hub.
Post Reply