How to debug check.NetworkBandwidth

[KAGEYAM4]

config

[general]
interval = 300
idle_time = 1800
suspend_cmd = /usr/bin/systemctl suspend
wakeup_cmd = echo {timestamp:.0f} > /sys/class/rtc/rtc0/wakealarm
woke_up_file = /var/run/autosuspend-just-woke-up
lock_file = /var/lock/autosuspend.lock
lock_timeout = 30
notify_cmd_no_wakeup = su myuser -c notify-send -a autosuspend 'Suspending the system.'

[check.NetworkBandwidth]
enabled = true
interfaces = enp1s0

[check.ActiveConnection]
enabled = true
ports = 22

My debian headless LAN server (old pc) is kepping awake as can be seen in journal output, i have been using --allchecks option. I tried debuggin by running nethogs in tmux but i couldn' find any useful information from it. This old computer only has one network interface enp1s0

If no one is connected to the computer why is there traffic on enp1s0, do you have any idea and how to troubleshoot.

Feb 14 07:45:11 debian autosuspend[951]: 2026-02-14 07:45:11,579 - autosuspend.Processor - INFO - System is active. Resetting state
Feb 14 07:50:11 debian autosuspend[951]: 2026-02-14 07:50:11,579 - autosuspend.Processor - INFO - Starting new check iteration
Feb 14 07:50:11 debian autosuspend[951]: 2026-02-14 07:50:11,580 - autosuspend.Processor - INFO - Check NetworkBandwidth matched. Reason: Interface enp1s0 receive rate 139.02602245578777 byte/s higher than threshold 100
Feb 14 07:50:11 debian autosuspend[951]: 2026-02-14 07:50:11,594 - autosuspend.Processor - INFO - System is active. Resetting state
Feb 14 07:55:11 debian autosuspend[951]: 2026-02-14 07:55:11,595 - autosuspend.Processor - INFO - Starting new check iteration
Feb 14 07:55:11 debian autosuspend[951]: 2026-02-14 07:55:11,596 - autosuspend.Processor - INFO - Check NetworkBandwidth matched. Reason: Interface enp1s0 receive rate 148.84882386511688 byte/s higher than threshold 100
Feb 14 07:55:11 debian autosuspend[951]: 2026-02-14 07:55:11,610 - autosuspend.Processor - INFO - System is active. Resetting state
Feb 14 08:00:11 debian autosuspend[951]: 2026-02-14 08:00:11,611 - autosuspend.Processor - INFO - Starting new check iteration
Feb 14 08:00:11 debian autosuspend[951]: 2026-02-14 08:00:11,612 - autosuspend.Processor - INFO - Check NetworkBandwidth matched. Reason: Interface enp1s0 receive rate 137.57275581387304 byte/s higher than threshold 100
Feb 14 08:00:11 debian autosuspend[951]: 2026-02-14 08:00:11,626 - autosuspend.Processor - INFO - System is active. Resetting state
Feb 14 08:05:11 debian autosuspend[951]: 2026-02-14 08:05:11,627 - autosuspend.Processor - INFO - Starting new check iteration
Feb 14 08:05:11 debian autosuspend[951]: 2026-02-14 08:05:11,627 - autosuspend.Processor - INFO - Check NetworkBandwidth matched. Reason: Interface enp1s0 receive rate 138.2994743402784 byte/s higher than threshold 100
Feb 14 08:05:11 debian autosuspend[951]: 2026-02-14 08:05:11,642 - autosuspend.Processor - INFO - System is active. Resetting state
Feb 14 08:10:11 debian autosuspend[951]: 2026-02-14 08:10:11,643 - autosuspend.Processor - INFO - Starting new check iteration
Feb 14 08:10:11 debian autosuspend[951]: 2026-02-14 08:10:11,643 - autosuspend.Processor - INFO - Check NetworkBandwidth matched. Reason: Interface enp1s0 receive rate 132.58633991608602 byte/s higher than threshold 100

[languitar]

That's the problem with the bandwidth check. There's always something happening on a system or the network. You could use tcpdump and wireshark to find out what is happening there. Maybe some broadcast traffic in your subnet or something like that. In general just increase your thresholds to match or better switch to more deterministic checks based on connected ports, smb status or similar.

[KAGEYAM4]

Thank you tcpdump worked. everyone on the LAN is doing 'Who has ip_addr?'