I have a question, does your NS send/receive lots of traffic? Please take a look at my Ntop, would like to know if it is normal.
My best guess is that these are mainly updates. When you use a NS 6.7 ISO, there will be a lot of updates. Also, when you install services, those will be downloaded too.
However, sending that amount of traffic is … a lot… It makes me wonder what interface you are looking at with ntop: green or red?
Rob, I think it is reading the green interface which is the IP 192.168.10.1.
Ok… then that makes sense… the your “upload” is actualy your download…