Heavy incoming traffic not showing up in Network Monitor

[jacksnitch]

I have MenuMeters installed with network traffic displaying on the menu bar, and at times I am noticing significant incoming traffic -- 500KB and up for several minutes at a time. I actually purchased Snitch to help me figure out what this traffic is.

The problem is: Snitch isn't showing the source of this traffic! In other words, when I see this heavy activity on Menu Meters, I am not seeing equivalent heavy activity on any of the applications listed in the Snitch network monitor.

Any ideas?

[neilmcg]

I think LS is checking outgoing traffic - not incoming (that is the firewall).

[paulc]

Set MenuMeter's Network monitor to "Throughput." You'll see Tx (transmit, not covered by LS) and Rx (received, what LS catches) and data in the menubar.

[r.giskard]

Did you enable the option 'Show Local Network Activity' in Little Snitch Network Monitor? By enabling 'Show Local Network Activity' Little Snitch Monitor will also show up network traffic within your local network. MenuMeters can't differ between external (internet) and local traffic.

[jacksnitch]

OK, so I think this problem might have been unique to the WWDC environment, with hundreds of other independent OSX machines on the same network ... bonjour traffic, shares, etc. Is that a possible explanation? Would these OS-level network activities bypass Snitch?

These days, I am generally able to explain Menu Meters throughput numbers with Snitch activity ...

Thanks for the suggestions.

[h1d]

I think LS is checking outgoing traffic - not incoming (that is the firewall).

Is this ignored?