This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Crazy traffic every day at 10am

So every day at 10:30-10:35am we're reporting our full bandwidth usage up to 10Mb/s. I ran tcpdump and captured all of the traffic from 9:59-10:36am (complete packets).

Looking at the traffic in Wireshark I found that at this time the most common IP address I could find.

I made a packet rule to:
any > any > badIP = drop
and
badIP > any > any = drop.
Both set to log traffic.

I'm still getting usage spikes. Going to run another tcpdumpp today to figure out if it's the same IP, but I'm not finding that IP in any packet filter logs. Did I do something wrong? I would assume that by setting it to "log traffic" I would see the violations in the packet filter logs.

Thanks for any help

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Thanks, Hsinan,

OK, I think you achieve the same thing inside WebAdmin with a packet filter rule:
Internet -> Any -> External (Address) : Drop

"Anything from the outside world that was sent to the External interface is dropped." In essence, using the "Interface (Address)" object (instead of a Host definition with an IP) means selecting all packets that enter the FORWARD chain. Is that the same thing?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

Thanks, Hsinan,

OK, I think you achieve the same thing inside WebAdmin with a packet filter rule:
Internet -> Any -> External (Address) : Drop

"Anything from the outside world that was sent to the External interface is dropped." In essence, using the "Interface (Address)" object (instead of a Host definition with an IP) means selecting all packets that enter the FORWARD chain. Is that the same thing?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data