UTM 9.204-19 - I noticed crazy spikes in traffic. Not just reported in UTM but verified at the switch, so it's not phantom traffic that just gets mis-reported. It's real traffic.
UTM reports it to be Office 365 related and it sucks up to 100Mbit/s connecting to various IP addresses such as
165.254.202.211
165.254.202.203
These do not have reverse DNS entries and WHOIS doesn't show them to be related to Microsoft but UTM reports this traffic as MS Office 365.
When I check in flow monitor I see no client involved in this traffic. It just shows the external interface talking to one of these IP addresses at up to 100Mbit/s.
Making an Application Control Rule in UTM to block Office 365 traffic stops this but obviously blocks legitimate use of Office 365 altogether.
I normally average 1-2 Mbit/s on that box but as shown here the issue is quite extreme:
This thread was automatically locked due to age.
