|
We are seeing unusual amounts of traffic heading upstream on our WAN connection, during the day our system can exceed (or attempt to exceed) the 1Mbps limit imposed on the connection. I have PRTG netmon which gives the figures but cannot identify where is going from/to (or the actual protocol which is 'other'). How can I identify this traffic? Where should my port sniffer be connected? VM/Windows based network → Sonicwall TZ170 firewall → Speedtouch DSL modem → Demon Internet |
|||||||
|
|
In order to trace back the source you first need to figure out which device is generating the traffic. The best, in my opinion, would be to set up a flow collector of some sort. There are generally two ways to do this,
Most high end network gear will generate some kind of flow record, such as sFlow, jFlow, or NetFlow. These are produced directly by the router and sent to a collector. You'll then use some kind of analysis tool like flow-tools or nfsen/nfdump to process the records. Using other devices will involve getting a copy of all the traffic somehow, typically using a tap or setting up a mirror/span/monitor port on you border device. A tap is a physical device that you place inline with a connection and it will electrically duplicate the signals. The mirror port is configured on the network device itself and will send a copy of all packets from one switch port to another. Most "enterprise grade" devices support this, but for lower grade equipment a tap may be required. Once you have a copy of the data you'll need something that will take the traffic stream and turn it into flow records. There are a number of commercial products, but I am most familiar with the open source product Argus, produced by Qosient. It will process the packets on an interface, much like tcpdump, and produce data files that consist of flow records. Whether you go with exporting flows, commercial products, or Argus you now have everything you'll need for your analysis. Any of those collection tools will contain all the necessary tools to produce bandwidth reports like you want. Or just about any kind of report you want, really. I'm sure this sounds like a massive overkill, but the results are fantastic. These types of records are invaluable for network troubleshooting, incident response, forensics, billing, etc. |
|||||||||
|
|
In terms of tracking this down I'd be inclined to start by looking at volume of traffic and then narrowing down the to/from addresses. Probably the best place to start this will be on the Firewall device. There's likely to be some level of monitoring available on it to show which ports are generating what volume of traffic. From that you should be able to get an idea of which port would be best to sniff traffic on (e.g. By starting with the port generating the most upstream traffic) Depending on your network layout this might lead you to a specific system or set of systems, but you should be able to attach a port sniffer to the identified firewall port with wireshark or similar to that port once you've identified it, which should give you information on source/destination IP addresses and the protocols in-use... |
|||
|
