On a Unix or Linux computer we can run the iftop
command and monitor
the packets of all the other computers on our local network. Why does
this not completely saturate the bandwidth of our connection?
Your premise is incorrect. iftop
does not “monitor the packets of all the other computers on our local network.” As described in the official documentation for iftop
:
iftop - display bandwidth usage on an interface by host
Additionally in the description; emphasis is mine:
iftop listens to network traffic on a named interface, or on the first
interface it can find which looks like an external interface if none
is specified, and displays a table of current bandwidth usage by pairs
of hosts.
All iftop
does is present network data for the machine it is run on including packets destined for the specific machine. But unless iftop
is run from a server that is a router or some kind of device that sits in the middle of all network traffic, it won’t ever show anything but traffic on the local machines network ports.
That said, you if you are seeing packets from other machines they are most likely from devices broadcasting their presence via ARP and/or multi-cast. Line via technology like Bonjour or Avahi. But this is not tons of packets but rather bursts of "I'm here!" announcements from devices that help your interface know who/where these devices are.
In some environments, ARP traffic & broadcasting is disabled for this reason. It’s not so much that it saturates bandwidth as much as the constant announcements can just cause confusion to switches and such.
I think you may be confusing old bus-topology networks with modern switched networks. On very very old networks, every host on a bus received each packet. In bus networks, yes, the possibility of collision or the bus being perpetually busy could cause major performance issues, because of the shared media. Newer networks are "Micro-segmented" in that each host has its own network line, and doesn't share it with anyone else. Only traffic to or from that host ever ends up on that line. the switch the host is plugged into is smart and only sends traffic the host wants. – Frank Thomas – 2014-10-13T09:10:40.787
@FrankThomas Hmm, my office must use this old technology, as I can see the bandwidth usage of many clients on the network when I type 'iftop'. – Steve M – 2014-10-13T11:24:38.030
@FrankThomas I believe what the original poster is referring to is ARP and/or multicast announcements. See my answer; just edited it to reflect that. – JakeGould – 2014-10-13T16:43:29.227
Ahh ok, yes, broadcast and multicast traffic would be visible to all clients. the important takaway here is that for broadcast and multicast traffic, you are an intended recipient, whether you want the packet or not. the op is not seeing traffic for other clients, they are seeing traffic other clients are sending to them (and everyone else), for service discovery/announcement, network convergence, or coordinated realtime content delivery. Anyway, op, this traffic does not constitute the majority of those terminals usage. your station can't see Unicast traffic between other hosts. – Frank Thomas – 2014-10-13T19:17:51.277