Had a client say their Internet has been iffy all day. Remoted into the UTM and saw the External (WAN) interface was showing 18-19MBit/s (their Internet is 20Mbit/s down). When looking at the Internal interfaces (there are 3 sub-interfaces / eth0.40, eth0.41, eth0.45).
None of those interfaces showed anything above 100+kbit/s.
When looking at the Flow Control chart, the traffic was listed as unclassified and they two bandwidth suckers were from Akamai. Did a tcpdump on eth1 and saw the Akamai entires, but the source was the UTM. Figured that was the case because it TCP/80 traffic. So I did tcpdumps on the sub-interfaces and barely saw any traffic.
It's definitely only happening during business hours because the WAN isn't show hardly any traffic.
Would it best to disable the Web Proxy and monitor via the firewall logs?
I just wish the reporting was more accurate because while it says there was 30-35GB transferred that day, if you look at the Top 10 users it's nowhere near that.
This thread was automatically locked due to age.
