This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Flow monitor not showing Outward bandwidth usage

We have a 2Mbit outbound connection that for some reason is being saturated. Clicking on this in the 'Out' section of Dashboard brings up the flow monitor, but as far as I can tell, it is only showing inwards usage.

If I'm wrong, how can I tell what is the source IP that is causing the outbound traffic?

Running Release 9.201-23

The device's CPU utilisation is about 63%, RAM 52%.

Thanks,

James.

This thread was automatically locked due to age.

Parents

0 teched_01 over 10 years ago
Realtime? Command line: iftop

Some information may be available in the reporting database (it may be broken too).

Non-realtime? tcpdump capture transfered off UTM for processing with wireshark or reporting database.

tcpdump for wireshark:D.3.*tcpdump: Capturing with tcpdump for viewing with Wireshark

Reporting database: Gather the reporting data, below, and compare the deltas.

Accumulated in/out/total transfers by AFC protocol for the day :
psql reporting -U reporting -c "SELECT afc_proto, cast(SUM(raw_in_pktlen) AS bigint) AS total_raw_in_pktlen, cast(SUM(raw_out_pktlen) AS bigint) AS total_raw_out_pkt_len, cast(SUM(raw_in_pktlen + raw_out_pktlen) AS bigint) AS combined_total_pktlen FROM accounting WHERE logday:[:D]ate = '2014-07-31' GROUP BY afc_proto ORDER BY afc_proto;"

"Fully accumulated" source/destination byte and connection count for the day:
psql reporting -U reporting -c "SELECT * FROM accounting WHERE logday:[:D]ate = '2014-07-31';"

AFC numbers are listed in /etc/afc/applications

Original posts with the commands above (review for warnings, more info):
AFC counts list: https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34479

Connection count: https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34404
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 teched_01 over 10 years ago
Realtime? Command line: iftop

Some information may be available in the reporting database (it may be broken too).

Non-realtime? tcpdump capture transfered off UTM for processing with wireshark or reporting database.

tcpdump for wireshark:D.3.*tcpdump: Capturing with tcpdump for viewing with Wireshark

Reporting database: Gather the reporting data, below, and compare the deltas.

Accumulated in/out/total transfers by AFC protocol for the day :
psql reporting -U reporting -c "SELECT afc_proto, cast(SUM(raw_in_pktlen) AS bigint) AS total_raw_in_pktlen, cast(SUM(raw_out_pktlen) AS bigint) AS total_raw_out_pkt_len, cast(SUM(raw_in_pktlen + raw_out_pktlen) AS bigint) AS combined_total_pktlen FROM accounting WHERE logday:[:D]ate = '2014-07-31' GROUP BY afc_proto ORDER BY afc_proto;"

"Fully accumulated" source/destination byte and connection count for the day:
psql reporting -U reporting -c "SELECT * FROM accounting WHERE logday:[:D]ate = '2014-07-31';"

AFC numbers are listed in /etc/afc/applications

Original posts with the commands above (review for warnings, more info):
AFC counts list: https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34479

Connection count: https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34404
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

Flow monitor not showing Outward bandwidth usage

Submitted a Tech Support Case lately from the Support Portal?