Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are seeing unusual amounts of traffic heading upstream on our WAN connection, during the day our system can exceed (or attempt to exceed) the 1Mbps limit imposed on the connection.

I have PRTG netmon which gives the figures but cannot identify where is going from/to (or the actual protocol which is 'other').

How can I identify this traffic? Where should my port sniffer be connected?

VM/Windows based network → Sonicwall TZ170 firewall → Speedtouch DSL modem → Demon Internet

share|improve this question
This sounds like a better question for ServerFault, as it is primarily about network administration and management (the security content is... thin). – D.W. Sep 15 '12 at 23:28
D.W; The quite large amounts of unexplained upstream traffic is eating our bandwidth, affecting downloads for the whole network. As long as it remains unidentified I have to remain suspicious as to it's origin. in the past hour I saw a 15min upstream of 460kbit/s which is almost 50% of the available bandwidth being used with no one on the system (barring myself). I am concerned this actually may be security problem. – Bill Sep 16 '12 at 11:02

In order to trace back the source you first need to figure out which device is generating the traffic. The best, in my opinion, would be to set up a flow collector of some sort. There are generally two ways to do this,

  • Exporting flows from the device
  • Software analysis to generate flows

Most high end network gear will generate some kind of flow record, such as sFlow, jFlow, or NetFlow. These are produced directly by the router and sent to a collector. You'll then use some kind of analysis tool like flow-tools or nfsen/nfdump to process the records.

Using other devices will involve getting a copy of all the traffic somehow, typically using a tap or setting up a mirror/span/monitor port on you border device. A tap is a physical device that you place inline with a connection and it will electrically duplicate the signals. The mirror port is configured on the network device itself and will send a copy of all packets from one switch port to another. Most "enterprise grade" devices support this, but for lower grade equipment a tap may be required.

Once you have a copy of the data you'll need something that will take the traffic stream and turn it into flow records. There are a number of commercial products, but I am most familiar with the open source product Argus, produced by Qosient. It will process the packets on an interface, much like tcpdump, and produce data files that consist of flow records.

Whether you go with exporting flows, commercial products, or Argus you now have everything you'll need for your analysis. Any of those collection tools will contain all the necessary tools to produce bandwidth reports like you want. Or just about any kind of report you want, really.

I'm sure this sounds like a massive overkill, but the results are fantastic. These types of records are invaluable for network troubleshooting, incident response, forensics, billing, etc.

share|improve this answer
Thanks for yor input Scott, unfortunately the only devices with 'flow' are in the VM core (iSCSI/SAN). Can I make a 'tap' by simply introducing a hub (or does it need to be a switch?) between firewall/DSL modem and using Wireshark at this point? – Bill Sep 16 '12 at 9:54
@Bill: Yes, you can use a hub, although keep in mind that it will reduce your throughput to that of the hub. There are some 100Mbps hubs out there, but they're fairly rare so you're much more likely to have 10Mbps. I know quite a few people who carry hubs in their jump bags for use as impromptu taps. In all normal situations you CANNOT use a switch to do this. – Scott Pack Sep 16 '12 at 12:49
Hi Guys, I had to get a 'hub' of fleabay, duly installed between Firewall & DSL Modem. Oh Dear..... At 3am this morning I was monitoring the excessive upstream traffic with Wireshark and found what I suspect is an authenticated RDP connection (from a Ukranian IP!) to one of the internal file servers -Gulp! Off to find a security consultant London....Bill. – Bill Sep 20 '12 at 12:29
@bill if you're looking for some pointers on the london consultant some one's you could look at (not used their Incident response services but I know they've got some good guys working there)… or – Rоry McCune Sep 20 '12 at 14:09

In terms of tracking this down I'd be inclined to start by looking at volume of traffic and then narrowing down the to/from addresses.

Probably the best place to start this will be on the Firewall device. There's likely to be some level of monitoring available on it to show which ports are generating what volume of traffic. From that you should be able to get an idea of which port would be best to sniff traffic on (e.g. By starting with the port generating the most upstream traffic)

Depending on your network layout this might lead you to a specific system or set of systems, but you should be able to attach a port sniffer to the identified firewall port with wireshark or similar to that port once you've identified it, which should give you information on source/destination IP addresses and the protocols in-use...

share|improve this answer
Thanks Rory, I have Wireshark on the network but cannot really identify any external traffic. I have Wireshark running on the DSL modem but only get ARP/Broadcast stuff. See my reply to Scott about the 'tap'. – Bill Sep 16 '12 at 9:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.