RRD phantom traffic

[clarknova]

2.0-BETA5 (amd64)
built on Tue Jan 4 02:47:18 EST 2011

I have only only one WAN and my other networks are internal, sharing the WAN for internet access. I have large amounts of traffic appearing on my WAN graph that cannot be accounted for looking at my internal networks. In the attached screenshots you can see significant amounts of traffic on the WAN from 04:30 to 06:00, but no corresponding traffic on the other interfaces. Ideas?

[jimp]

What packages do you have installed?

[clarknova]

squid and RRD Summary.

[jimp]

It's probably squid downloading content into the cache. I've seen that happen before.

[clarknova]

I have a lot to learn about squid then. I thought it cached pages as users requested them, not before or after. I even did a quick google search on "squid precache" and didn't find anything interesting. Thanks for your answer.

[jimp]

Did you set it up to cache any kind of updates? (Windows updates, etc) That's usually where I saw it.

[clarknova]

Windows, AVG, Symantec, Avast and Spywareblaster. So it's actually doing those without a client trigger? This page is interesting: http://www.squid-cache.org/Doc/config/refresh_pattern/

but I don't see anything there about precaching. Looks like I'm going to need the book.