By default the top window is showing only TCP traffic by IP pair.
You can see traffic by TCP/UDP and port by starting iptraf using "-s <network device>" -- but then you lose the IP pair information:
iptraf -s eth0
The UDP traffic in your output (at least the top two entries) are DNS root servers (
http://ipinfo.io/192.5.5.241 http://ipinfo.io/192.36.148.17 ) - I don't think this traffic is the problem.
I missed the detail in your first post about "Even my router that shows the amount of traffic being used, seemed to miss this traffic." -- can you provide more details on this? Is this router between the SME server and the internet, beside it, or behind it? If the router is the last device in your network before the ISP you'd have to have a device on the WAN side of the router or the ISPs network has been compromised somewhere else.
Can the ISP give you the IP and mac address of the device that is using all the bandwidth?
If not, perhaps you can dispute their quota system.
What kind of router is it? Is it up-to-date and does it have any unpatched security problems? Does it include any VPN or proxy services that could have been compromised by a remote attacker? Does it provide wifi, and is the wifi traffic included in the stats you're looking at?
Does the router reset its stats when rebooted, and has it been rebooted lately?
If so, perhaps someone is stealing your bandwidth and then rebooting the router to reset the network stats.
How big are the affa backups (how much total data)? Could there be an affa problem that is causing it to execute a full backup on every run instead of a hardlinked differential backup?
I had a problem like this when first testing Affa and using an SMB share as the backup destination...
If the router questions are a dead end -- what is your internet bandwidth supposed to be? Assuming 10mbit, it would only take about 5 hours to use 17GB of traffic. You would need to be running iptraf when the rogue process is running to see the traffic.
Try running iptraf for an extended period, checking the progress from time to time.
If you have a physical monitor attached, you could use that.
If not, you can do this using "screen" to make sure it keeps running if your ssh session is disconnected.
To start 'screen':
screen
Start 'iptraf' and set it to monitor traffic, set it to sort its display by bytes transferred (press "s" then "b") then exit from the screen session using <Ctrl>-A D (that is, press <Ctrl>-A, then press the "d" key)
Re-attach to screen to see how it's going using "screen -r"
screen -r
Don't forget to come back and stop iptraf at some point...