I remember when I've set up vnstat on a Raspberry Pi hosted in a DataCenter, without Tor... only a webserver + NTP were available
And I saw a lot of RX Megabytes, that's why I've set up NTOP to monitor eth0.
It was a lot of broadcast/multicast, ex: 224.0.0.0
+ others friends for sure on the same router in the datacenter (many IPs around)

On an exit, I think "ntop" will take a lot of resources ? It can monitor every ports, and show you who is speaking with your server, which ports, etc...

About Unbound:
a quick add if I'm not wrong :
-- dnscrypt enabled by :

unbound-control-setup

-- Check config to find an error :

unbound-checkconf
      /etc/unbound/unbound.conf

-- Automatic downloading root file to use root DNS servers, with crontab -e :

00 5 * * 1 wget
      ftp://ftp.internic.net/domain/named.cache -O
      /etc/unbound/root.hints && /etc/init.d/unbound restart

(every week at 5:00, the 1st day (monday) it will download the file, then restart the Unbound service to eat the new file)

-- 
Petrusko
PubKey EBE23AE5
C0BF 2184 4A77 4A18 90E9 F72C B3CA E665 EBE2 3AE5