Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Data parasites

    General pfSense Questions
    9
    46
    6.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      SamR 0
      last edited by

      Starting in June or July I started getting notified virtually every month by my ISP (Comcast) that I'm getting close to, and in one instance exceeding, my data cap of 1.2 TB. I started off thinking maybe the Roku was parasitic, maybe the VPN was using a lot of traffic - they are known to add some girth to packet payload for the encryption - and ditched both of them.

      The issue kept happening so, got a Netgate firewall and have been using PFSense. Now just to give a little personal background, I work in desktop support for a hospital system and am not a Network guy - although I got the Firewall to help me learn some of the concepts while I'm working on Network+. Bear that in mind, that while I understand the concepts by and large, my well of practical knowledge is rather shallow.
      What I discovered was that at odd hours; almost always when I'm not home or overnight there will be large, multi-hour data transfers happening. The most recent one was Friday the 10th; transferred about 66 GB over 4 hours; about 16 G/hr or approximately 4 MBps, while I was at work. It happens enough that I approach my data cap almost every month. For reference the most data intensive thing I do is streaming services, which I do nominally at 720p - there's almost not enough hours in the month to use 1.2 TB that way. Also, these large data transfers happen when I'm not using my computer.
      pfTop logging reports the data as going from my WAN to my PC's LAN address, it doesn't seem to be able to be more verbose than that. I can pcap the transfers when they're happening if I'm using the computer at the time, but they seem to happen when I'm not home. Just leaving it running all the time seems like it'll consume all my storage pretty quickly.

      Some technical info I use a Netgate 1100 and a tp-link 5 port managed switch. I have an old tp-link router that I have in AP mode for wireless. (been trying to figure out how to VLAN that but that's another story). The transfer seems to always happen on my PC; which is usually 10.68.69.10; the gateway is 10.68.69.1/24. I've checked DHCP leases, it shows my PC, the switch, the AP, my cell phone, TV & an old laptop I put Kali on.

      I ran virus check and did the offline scan for rootkits which turned up nothing. The transfers are pretty equal in terms of tx and rx bits. It's doing about the same in as out, which doesn't seem like, for example, botnet behavior. I had put OpenVPN on the Netgate but it wasn't working how I wanted - didn't disguise my public IP - so I took it off, but the most recent transfer happened while it was on there.
      I'm wanting some advice or ideas on how I can track what's going on and how I can prevent it. I was thinking there might be a way to catch it with firewall rules and when the offending process starts it'll log the packets.

      S J johnpozJ 4 Replies Last reply Reply Quote 0
      • JonathanLeeJ
        JonathanLee
        last edited by

        You might have an invasive container data marshaling your device. Format the device, or air gap it to see if that stops. You could also activate Snort AppID to see what application is doing this you would need text rules to use it.

        Make sure to upvote

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @JonathanLee
          last edited by johnpoz

          @JonathanLee said in Data parasites:

          invasive container data marshaling your device

          Do you people watch too many hacker movies or what?? Are you partaking of recreational drugs that get you paranoid while watching said shows? Why is that the first thing you would jump too? How about like what IP is actually talking before we start jumping to conclusions that he has some invasive container running.

          For all we know he set a full backup at night.. Which seems like a much more sane thing to jump too.

          @SamR-0 said in Data parasites:

          going from my WAN to my PC's LAN address,

          You mean your wan network? The internet, some public IP.. Why would your pc be moving loads of data to your pfsense WAN IP? that makes no sense at all.. Is your pfsense wan behind another router, so you have a wan network like where your running a nas or something?

          What port is the traffic on?

          Logical thing to jump to would you have a backup setup on your PC..

          Large move to your own "wan IP" or network wouldn't use up isp data - what IP is this traffic going to - who owns it? dropbox maybe or azure, aws, etc..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          JonathanLeeJ 1 Reply Last reply Reply Quote 2
          • JonathanLeeJ
            JonathanLee @johnpoz
            last edited by JonathanLee

            @johnpoz I have a degree in cyber security not a certification. You also understand I am sure containers are the number one the biggest issue in cyber security right now.

            The Roku device is in his home network and should not constitute that type of data transfer. It's his home network. His issue is occurring at his home not office.

            Air gapping the Roku to isolate the issues is a good starting place if he doesn't want to go over his data cap.

            The issue at hand is the data cap. "Dropbox" I agree, @johnpoz that's if his work laptop is at home. @SamR-0 is your work laptop or someone else's work laptop on your home network?

            Make sure to upvote

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @JonathanLee
              last edited by

              @JonathanLee said in Data parasites:

              I have a degree in cyber security not a certification

              Has zero to do with such paranoia -- What is more logical in some user hitting his data cap, his kid left netflix streaming 4k on his device over night... Or he has been hacked and this hacker decides to move "66 GB over 4 hours" and then not do anything..

              I have been in the infosec space for most of my career.. And jumping to that sort of conclusion - on what it could it be is just pure and utter scare mongering or you are maybe stoned??

              Why would you suggest first thing when user has a question about data usage is " Format the device"

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              JonathanLeeJ 1 Reply Last reply Reply Quote 2
              • S
                SteveITS Galactic Empire @SamR 0
                last edited by

                @SamR-0 said in Data parasites:

                The transfers are pretty equal in terms of tx and rx bits. It's doing about the same in as out

                That does seem odd, also since the upload would take significantly longer than the download for the same data, on an asynchronous cable connection.

                Backup seems like it would be 99% uploading. OneDrive sync? Windows Update would be 99% downloading.

                If it's registering on your pfSense then it isn't the Comcast Wi-Fi.

                You could turn on block rules overnight for your PC but seems like it would be hard to spot amongst the noise...

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote 👍 helpful posts!

                1 Reply Last reply Reply Quote 1
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  At least seems easy enough to confirm it's that desktop machine. Just disconnect it (or turn it off) overnight.

                  1 Reply Last reply Reply Quote 1
                  • J
                    jrey @SamR 0
                    last edited by

                    @SamR-0 said in Data parasites:

                    pfTop logging reports the data as going from my WAN to my PC's LAN address,

                    I don't see where you said what port the traffic is on, at both ends and also the traffic type. tcp udp etc

                    1 Reply Last reply Reply Quote 1
                    • JonathanLeeJ
                      JonathanLee
                      last edited by

                      I agree air gap it as you work under HIPA compliance at work.

                      Side Note: My kid steams all day and I never hit data limits like that. It is seldom he even reaches 15GB in a month with streaming movies from my smart phone AP hot spot.

                      Make sure to upvote

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • JonathanLeeJ
                        JonathanLee @johnpoz
                        last edited by JonathanLee

                        @johnpoz What would move that level of data 66gb in 4 hrs in a home network? Isn't that a bit off ??

                        Side note: I am from DOS 3.11 era I loved the old command...

                        format c: /s
                        

                        Make sure to upvote

                        J 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @JonathanLee
                          last edited by johnpoz

                          @JonathanLee said in Data parasites:

                          I agree air gap it as you work under HIPA compliance at work.

                          Are you in the wrong thread? Where did anyone mention hipa ?

                          data 66gb in 4 hrs in a home network

                          Simple backup.. But who said he even wrote it down correctly.. Could be 66MB -- jumping to he has some malicious container with really amount to zero credible anything other than he went over his data cap.. and he spotted something thinks, but provided zero actual info, like a screen shot or what IP it was going to.. And that tx and rx bites match exactly? Point to someone not reading something correctly if you ask me.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                          • JonathanLeeJ
                            JonathanLee @johnpoz
                            last edited by JonathanLee

                            @johnpoz HIPA: He said he is desktop support for a hospital.

                            "I work in desktop support for a hospital system and am not a Network guy - although I got the Firewall to help me learn some of the concepts while I'm working on Network+."

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • J
                              jrey @JonathanLee
                              last edited by

                              @JonathanLee said in Data parasites:

                              I loved the old command...

                              So you mean type that here? LOL

                              Screen Shot 2023-11-13 at 12.39.37 PM.png

                              Virtual vintages toys are fun (sometimes)

                              Grabbing some popcorn now..

                              JonathanLeeJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @SamR 0
                                last edited by

                                @SamR-0 said in Data parasites:

                                I work in desktop support for a hospital system and am not a Network

                                And who says that has anything to do with hipa? For all you know he desktop support for the lighting system.. Or the AC..

                                Not sure where you think hospital instantly means he is dealing with hipa requirements.. And how would he support that remotely if he was air gapped? ;)

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • JonathanLeeJ
                                  JonathanLee @jrey
                                  last edited by

                                  @jrey YEAH load high men,

                                  Also RAM disk that was fun the precursor to VMs

                                  Make sure to upvote

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jrey @SamR 0
                                    last edited by

                                    @SamR-0

                                    The transfer seems to always happen on my PC

                                    So what OS is on your PC ?

                                    IF windows 10 for example, under

                                    Settings -> Network & Internet -> Status
                                    what does this report?

                                    Screen Shot 2023-11-13 at 1.02.19 PM.png

                                    Does it match the data volume, believed to be from the this device (+66gb)

                                    Then click, "Data usage" is something with that much data "the offender" listed ?

                                    all the fun banter aside, please provide some more information.

                                    johnpozJ 1 Reply Last reply Reply Quote 2
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @jrey
                                      last edited by johnpoz

                                      @jrey said in Data parasites:

                                      Then click, "Data usage" is something with that much data "the offender" listed ?

                                      Yeah that would be a great idea.. And prob if saying its happening every night, maybe reset it..

                                      Scroll to the bottom

                                      reset.jpg

                                      Say do that before you go to bed, and then check it in the morning.

                                      Also knowing the IP this data is being exchanged with and what port would be helpful in figuring out what it could be.

                                      I like the darkstat package for looking to see who is moving data at any given time.. Its really lightweight compared to say ntop..

                                      https://docs.netgate.com/pfsense/en/latest/monitoring/graphs/bandwidth-usage.html#monitoring-bandwidth-usage

                                      or get on pfsense when its happening and use say iftop or pftop or trafshow

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      J 1 Reply Last reply Reply Quote 0
                                      • J
                                        jrey @johnpoz
                                        last edited by

                                        @johnpoz said in Data parasites:

                                        Say do that before you go to bed, and then check it in the morning.

                                        yup -- assuming it is a windows PC, not really stated unless I missed it while I was reformatting my MSDOS virtual -- LOL

                                        I just assumed it might be because of "PC" - could be off. All the OP has basically said so far is "A lot of data - it is broken can you make it go?"

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @jrey
                                          last edited by

                                          @jrey said in Data parasites:

                                          assuming it is a windows PC

                                          Yeah we are all assuming a lot of stuff to be honest, because there is really nothing concrete to go on..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            jrey @johnpoz
                                            last edited by

                                            @johnpoz

                                            Once I removed the "fluff" this is what I was left with from a technical "how can I help out here point of view."

                                            ISP is cranky because of data usage

                                            Friday the 10th; transferred about 66 GB over 4 hours

                                            sort of implies not every day?
                                            and

                                            pfTop logging reports the data as going from my WAN to my PC's LAN address

                                            might identify that culprit.

                                            We just now have to wait for the OP to fill in the blanks. more coffee

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.