This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Figuring Out a Client'sOutbound HTTP Traffic

Hi All,

Yesterday, I had a client whose outbound HTTP traffic was over 300MB according to the Top Services By Client report. When I look at Top Applications by Client is shows that 250MB of outbound traffic were to Rapleaf. After researching, it seems they are a major player in the web user tracking and selling info game. I have isolated the time window based on a few other reports. Also, we screen capture all of our clients, so I was able to go back and replay her desktop session during this time, and the only thing of note she had open was a page from 123greetings.com. As expected, during this window there was lots of download traffic for all of the embedded video ads and content. But how do I track where the HTTP outbound traffic was going? My gut tells me that the Radleaf classification is not correct. When I look at the server oriented reports, they all show total bandwidth and don't break it down by in and out. Any ideas?

Thanks!

This thread was automatically locked due to age.

0 BAlfson over 10 years ago

Sounds like you might want to go to the 'Websites' tab in 'Filtering Options' to override the categorization for Rapleaf. I would also inform 123greetings.com and suggest a change at TrustedSource / XL.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 SouperGrover over 10 years ago in reply to BAlfson

Sounds like you might want to go to the 'Websites' tab in 'Filtering Options' to override the categorization for Rapleaf. I would also inform 123greetings.com and suggest a change at TrustedSource / XL.

Cheers - Bob

Yes, that's a valid solution for this particular instance. But, what about something like this:

3 clients each show 100MB HTTP upload on the above report. When you look at a report of servers, none of the servers show 100MB of traffic. In fact, you might see 10 servers with HTTP traffic ranging between 5 - 10 MB each. There is no wy to correlate which client went to which server that I can find. And, even if you do see a server who had 100MB of HTTP traffic sent to it, there is no way to prove which clients sent it the information. Do you know of a way to get this info?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

Without looking at the device myself, all I can suggest is familiarizing yourself with the various options in 'Logging & Reporting' on the 'Bandwidth Usage' tab in 'Network Usage' and for "Web Filtering" on the 'Search Log files' tab in 'View Log Files'.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 10 years ago

Are you willing to dig into the reporting database?

https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34404
Cancel
Vote Up 0 Vote Down

Cancel
0 SouperGrover over 10 years ago in reply to teched_01

Are you willing to dig into the reporting database?

https://www.astaro.org/gateway-products/management-networking-logging-reporting/52080-concurrent-connections.html#post264192

Yes, for sure. I ended up pulling the web filtering log and doing some stuff with it in Excel to get kinda close. It was ugly, though. Lots of work to answer what seems like might be a common concern. Would the accounting db give me more info?
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

The DB is where the GUI reports pull their info from. From the backend, you get more flexibility in what information you get back, based on the query you build. From the GUI, it's all pre-canned reports, but easier on the eyes.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel

0 teched_01 over 10 years ago

This post has some other psql commands for pulling data from the reporting database:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34479

This is a slightly modified query from the above posting that may help. Change date and srcip values as needed.

psql reporting -U reporting -c "SELECT srcip, dstip, l4_dport, cast(SUM(raw_in_pktlen) AS bigint) AS total_raw_in_pktlen, cast(SUM(raw_out_pktlen) AS bigint) AS total_raw_out_pkt_len, cast(SUM(raw_in_pktlen + raw_out_pktlen) AS bigint) AS combined_total_pktlen FROM accounting WHERE logday:[:D]ate = '2014-09-16' AND srcip = '192.0.2.2' GROUP BY srcip, dstip, l4_dport ORDER BY combined_total_pktlen "

Figuring Out a Client'sOutbound HTTP Traffic

Submitted a Tech Support Case lately from the Support Portal?