Large amount of gateway traffic not appearing in reports

Something to think and investigate on your lan. If a download fails and restarts over and over again, the failed download never shows against any device because it never gets past the XG.

Not sure about this as I have not tried but you might try changing your scanning from realtime to batch to batch to see if that helps catch the device.

Sorry, not quite sure if I understand. Is this a Sophos XG setting? If so, where do I find it? I looked through a few menus and nothing appeared.

Hi Dean,

web -> protection -> malware scanning.

Ian

These are my settings so I'm already in batch mode.

I can't be sure but I suspect something do do with Onedrive or Edge browser might be a culprit. I'm seeing unusually high traffic with both but nothing seems to make it to the total traffic log.

As I suggested in the previous post, check for failed updates. Microsoft is notorious for these with strange generic error messages that mean nothing.

I ran Wireshark on my main desktop PC and over about 2 hours I received 4,202,994,665 bytes (about 4GB) from one address - 204.79.197.213. My PC also sent 38,556,221 bytes to this one address. All other traffic was relatively light, this one address made up 99% of traffic.

I checked quickly and I don't believe this data appears in the logs on the XG firewall.

The address resolves to a-0011.a-msedge.net which is owned by Microsoft and from the name appears to have something to do with MS Edge.

There's some reference to the IP address at:

https://social.technet.microsoft.com/Forums/en-US/c6176c93-2f7d-44ca-a164-e6d0eb8770dd/build-14955-constant-datastream-to-20479197213-eats-up-my-data-bundle-and-battery-usage?forum=win10itpromobile

https://www.computerforum.com/threads/getting-excessive-traffic-from-microsoft-server-causing-entire-home-network-to-slow-down.239239/

https://www.tenforums.com/performance-maintenance/41185-excessive-sessions-open-immediately-after-boot.html

There's also some reference on the first page above to the address being associated with Onedrive. This might make sense as I have had Onedrive constantly showing a message about "Syncing 1.9GB or 12.3GB" or some similar numbers. This has been going on for probably about the same time as I have been noticing excessive downloads. 

Tonight I might try to block or throttle this IP address and see the result. Wireshark demonstrates that the traffic is there - this still leaves the issue of why XG doesn't log it.

I finally tracked this down. The traffic was not being counted because it was under a HTTPS scanning firewall rule which was not ticked to be logged.

The actual cause of the traffic is Onedrive, which seems to sit continuously saying "Downloading x.xxGB of y.yyGB, zz files remaining". I have tried multiple solutions from various forums but the issue persists.

I finally found a solution which worked for me at least. If you left-click on the Onedrive tray icon it brings up a list of synchronisation files. Some of these don't exist on the PC but if you use the web version of Onedrive and search for them then they can be found and deleted. It's a painful process to do them one-by-one but for me, Onedrive is now up to date and not constantly syncing.

I finally found a solution which worked for me at least. If you left-click on the Onedrive tray icon it brings up a list of synchronisation files. Some of these don't exist on the PC but if you use the web version of Onedrive and search for them then they can be found and deleted. It's a painful process to do them one-by-one but for me, Onedrive is now up to date and not constantly syncing.