Data parasites
-
Starting in June or July I started getting notified virtually every month by my ISP (Comcast) that I'm getting close to, and in one instance exceeding, my data cap of 1.2 TB. I started off thinking maybe the Roku was parasitic, maybe the VPN was using a lot of traffic - they are known to add some girth to packet payload for the encryption - and ditched both of them.
The issue kept happening so, got a Netgate firewall and have been using PFSense. Now just to give a little personal background, I work in desktop support for a hospital system and am not a Network guy - although I got the Firewall to help me learn some of the concepts while I'm working on Network+. Bear that in mind, that while I understand the concepts by and large, my well of practical knowledge is rather shallow.
What I discovered was that at odd hours; almost always when I'm not home or overnight there will be large, multi-hour data transfers happening. The most recent one was Friday the 10th; transferred about 66 GB over 4 hours; about 16 G/hr or approximately 4 MBps, while I was at work. It happens enough that I approach my data cap almost every month. For reference the most data intensive thing I do is streaming services, which I do nominally at 720p - there's almost not enough hours in the month to use 1.2 TB that way. Also, these large data transfers happen when I'm not using my computer.
pfTop logging reports the data as going from my WAN to my PC's LAN address, it doesn't seem to be able to be more verbose than that. I can pcap the transfers when they're happening if I'm using the computer at the time, but they seem to happen when I'm not home. Just leaving it running all the time seems like it'll consume all my storage pretty quickly.Some technical info I use a Netgate 1100 and a tp-link 5 port managed switch. I have an old tp-link router that I have in AP mode for wireless. (been trying to figure out how to VLAN that but that's another story). The transfer seems to always happen on my PC; which is usually 10.68.69.10; the gateway is 10.68.69.1/24. I've checked DHCP leases, it shows my PC, the switch, the AP, my cell phone, TV & an old laptop I put Kali on.
I ran virus check and did the offline scan for rootkits which turned up nothing. The transfers are pretty equal in terms of tx and rx bits. It's doing about the same in as out, which doesn't seem like, for example, botnet behavior. I had put OpenVPN on the Netgate but it wasn't working how I wanted - didn't disguise my public IP - so I took it off, but the most recent transfer happened while it was on there.
I'm wanting some advice or ideas on how I can track what's going on and how I can prevent it. I was thinking there might be a way to catch it with firewall rules and when the offending process starts it'll log the packets. -
You might have an invasive container data marshaling your device. Format the device, or air gap it to see if that stops. You could also activate Snort AppID to see what application is doing this you would need text rules to use it.
-
@JonathanLee said in Data parasites:
invasive container data marshaling your device
Do you people watch too many hacker movies or what?? Are you partaking of recreational drugs that get you paranoid while watching said shows? Why is that the first thing you would jump too? How about like what IP is actually talking before we start jumping to conclusions that he has some invasive container running.
For all we know he set a full backup at night.. Which seems like a much more sane thing to jump too.
@SamR-0 said in Data parasites:
going from my WAN to my PC's LAN address,
You mean your wan network? The internet, some public IP.. Why would your pc be moving loads of data to your pfsense WAN IP? that makes no sense at all.. Is your pfsense wan behind another router, so you have a wan network like where your running a nas or something?
What port is the traffic on?
Logical thing to jump to would you have a backup setup on your PC..
Large move to your own "wan IP" or network wouldn't use up isp data - what IP is this traffic going to - who owns it? dropbox maybe or azure, aws, etc..
-
@johnpoz I have a degree in cyber security not a certification. You also understand I am sure containers are the number one the biggest issue in cyber security right now.
The Roku device is in his home network and should not constitute that type of data transfer. It's his home network. His issue is occurring at his home not office.
Air gapping the Roku to isolate the issues is a good starting place if he doesn't want to go over his data cap.
The issue at hand is the data cap. "Dropbox" I agree, @johnpoz that's if his work laptop is at home. @SamR-0 is your work laptop or someone else's work laptop on your home network?
-
@JonathanLee said in Data parasites:
I have a degree in cyber security not a certification
Has zero to do with such paranoia -- What is more logical in some user hitting his data cap, his kid left netflix streaming 4k on his device over night... Or he has been hacked and this hacker decides to move "66 GB over 4 hours" and then not do anything..
I have been in the infosec space for most of my career.. And jumping to that sort of conclusion - on what it could it be is just pure and utter scare mongering or you are maybe stoned??
Why would you suggest first thing when user has a question about data usage is " Format the device"
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@SamR-0 said in Data parasites:
The transfers are pretty equal in terms of tx and rx bits. It's doing about the same in as out
That does seem odd, also since the upload would take significantly longer than the download for the same data, on an asynchronous cable connection.
Backup seems like it would be 99% uploading. OneDrive sync? Windows Update would be 99% downloading.
If it's registering on your pfSense then it isn't the Comcast Wi-Fi.
You could turn on block rules overnight for your PC but seems like it would be hard to spot amongst the noise...
-
At least seems easy enough to confirm it's that desktop machine. Just disconnect it (or turn it off) overnight.
-
@SamR-0 said in Data parasites:
pfTop logging reports the data as going from my WAN to my PC's LAN address,
I don't see where you said what port the traffic is on, at both ends and also the traffic type. tcp udp etc
-
I agree air gap it as you work under HIPA compliance at work.
Side Note: My kid steams all day and I never hit data limits like that. It is seldom he even reaches 15GB in a month with streaming movies from my smart phone AP hot spot.
Make sure to upvote
-
@johnpoz What would move that level of data 66gb in 4 hrs in a home network? Isn't that a bit off ??
Side note: I am from DOS 3.11 era I loved the old command...
format c: /s -
@JonathanLee said in Data parasites:
I agree air gap it as you work under HIPA compliance at work.
Are you in the wrong thread? Where did anyone mention hipa ?
data 66gb in 4 hrs in a home network
Simple backup.. But who said he even wrote it down correctly.. Could be 66MB -- jumping to he has some malicious container with really amount to zero credible anything other than he went over his data cap.. and he spotted something thinks, but provided zero actual info, like a screen shot or what IP it was going to.. And that tx and rx bites match exactly? Point to someone not reading something correctly if you ask me.
-
@johnpoz HIPA: He said he is desktop support for a hospital.
"I work in desktop support for a hospital system and am not a Network guy - although I got the Firewall to help me learn some of the concepts while I'm working on Network+."
-
@JonathanLee said in Data parasites:
I loved the old command...
So you mean type that here? LOL
Virtual vintages toys are fun (sometimes)
Grabbing some popcorn now..
-
@SamR-0 said in Data parasites:
I work in desktop support for a hospital system and am not a Network
And who says that has anything to do with hipa? For all you know he desktop support for the lighting system.. Or the AC..
Not sure where you think hospital instantly means he is dealing with hipa requirements.. And how would he support that remotely if he was air gapped? ;)
-
@jrey YEAH load high men,
Also RAM disk that was fun the precursor to VMs
-
The transfer seems to always happen on my PC
So what OS is on your PC ?
IF windows 10 for example, under
Settings -> Network & Internet -> Status
what does this report?
Does it match the data volume, believed to be from the this device (+66gb)
Then click, "Data usage" is something with that much data "the offender" listed ?
all the fun banter aside, please provide some more information.
-
@jrey said in Data parasites:
Then click, "Data usage" is something with that much data "the offender" listed ?
Yeah that would be a great idea.. And prob if saying its happening every night, maybe reset it..
Scroll to the bottom
Say do that before you go to bed, and then check it in the morning.
Also knowing the IP this data is being exchanged with and what port would be helpful in figuring out what it could be.
I like the darkstat package for looking to see who is moving data at any given time.. Its really lightweight compared to say ntop..
or get on pfsense when its happening and use say iftop or pftop or trafshow
-
@johnpoz said in Data parasites:
Say do that before you go to bed, and then check it in the morning.
yup -- assuming it is a windows PC, not really stated unless I missed it while I was reformatting my MSDOS virtual -- LOL
I just assumed it might be because of "PC" - could be off. All the OP has basically said so far is "A lot of data - it is broken can you make it go?"
-
@jrey said in Data parasites:
assuming it is a windows PC
Yeah we are all assuming a lot of stuff to be honest, because there is really nothing concrete to go on..
-
Once I removed the "fluff" this is what I was left with from a technical "how can I help out here point of view."
ISP is cranky because of data usage
Friday the 10th; transferred about 66 GB over 4 hours
sort of implies not every day?
andpfTop logging reports the data as going from my WAN to my PC's LAN address
might identify that culprit.
We just now have to wait for the OP to fill in the blanks. more coffee
