Data parasites
-
You might have an invasive container data marshaling your device. Format the device, or air gap it to see if that stops. You could also activate Snort AppID to see what application is doing this you would need text rules to use it.
-
@JonathanLee said in Data parasites:
invasive container data marshaling your device
Do you people watch too many hacker movies or what?? Are you partaking of recreational drugs that get you paranoid while watching said shows? Why is that the first thing you would jump too? How about like what IP is actually talking before we start jumping to conclusions that he has some invasive container running.
For all we know he set a full backup at night.. Which seems like a much more sane thing to jump too.
@SamR-0 said in Data parasites:
going from my WAN to my PC's LAN address,
You mean your wan network? The internet, some public IP.. Why would your pc be moving loads of data to your pfsense WAN IP? that makes no sense at all.. Is your pfsense wan behind another router, so you have a wan network like where your running a nas or something?
What port is the traffic on?
Logical thing to jump to would you have a backup setup on your PC..
Large move to your own "wan IP" or network wouldn't use up isp data - what IP is this traffic going to - who owns it? dropbox maybe or azure, aws, etc..
-
@johnpoz I have a degree in cyber security not a certification. You also understand I am sure containers are the number one the biggest issue in cyber security right now.
The Roku device is in his home network and should not constitute that type of data transfer. It's his home network. His issue is occurring at his home not office.
Air gapping the Roku to isolate the issues is a good starting place if he doesn't want to go over his data cap.
The issue at hand is the data cap. "Dropbox" I agree, @johnpoz that's if his work laptop is at home. @SamR-0 is your work laptop or someone else's work laptop on your home network?
-
@JonathanLee said in Data parasites:
I have a degree in cyber security not a certification
Has zero to do with such paranoia -- What is more logical in some user hitting his data cap, his kid left netflix streaming 4k on his device over night... Or he has been hacked and this hacker decides to move "66 GB over 4 hours" and then not do anything..
I have been in the infosec space for most of my career.. And jumping to that sort of conclusion - on what it could it be is just pure and utter scare mongering or you are maybe stoned??
Why would you suggest first thing when user has a question about data usage is " Format the device"
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@SamR-0 said in Data parasites:
The transfers are pretty equal in terms of tx and rx bits. It's doing about the same in as out
That does seem odd, also since the upload would take significantly longer than the download for the same data, on an asynchronous cable connection.
Backup seems like it would be 99% uploading. OneDrive sync? Windows Update would be 99% downloading.
If it's registering on your pfSense then it isn't the Comcast Wi-Fi.
You could turn on block rules overnight for your PC but seems like it would be hard to spot amongst the noise...
-
At least seems easy enough to confirm it's that desktop machine. Just disconnect it (or turn it off) overnight.
-
@SamR-0 said in Data parasites:
pfTop logging reports the data as going from my WAN to my PC's LAN address,
I don't see where you said what port the traffic is on, at both ends and also the traffic type. tcp udp etc
-
I agree air gap it as you work under HIPA compliance at work.
Side Note: My kid steams all day and I never hit data limits like that. It is seldom he even reaches 15GB in a month with streaming movies from my smart phone AP hot spot.
Make sure to upvote
-
@johnpoz What would move that level of data 66gb in 4 hrs in a home network? Isn't that a bit off ??
Side note: I am from DOS 3.11 era I loved the old command...
format c: /s -
@JonathanLee said in Data parasites:
I agree air gap it as you work under HIPA compliance at work.
Are you in the wrong thread? Where did anyone mention hipa ?
data 66gb in 4 hrs in a home network
Simple backup.. But who said he even wrote it down correctly.. Could be 66MB -- jumping to he has some malicious container with really amount to zero credible anything other than he went over his data cap.. and he spotted something thinks, but provided zero actual info, like a screen shot or what IP it was going to.. And that tx and rx bites match exactly? Point to someone not reading something correctly if you ask me.
-
@johnpoz HIPA: He said he is desktop support for a hospital.
"I work in desktop support for a hospital system and am not a Network guy - although I got the Firewall to help me learn some of the concepts while I'm working on Network+."
-
@JonathanLee said in Data parasites:
I loved the old command...
So you mean type that here? LOL
Virtual vintages toys are fun (sometimes)
Grabbing some popcorn now..
-
@SamR-0 said in Data parasites:
I work in desktop support for a hospital system and am not a Network
And who says that has anything to do with hipa? For all you know he desktop support for the lighting system.. Or the AC..
Not sure where you think hospital instantly means he is dealing with hipa requirements.. And how would he support that remotely if he was air gapped? ;)
-
@jrey YEAH load high men,
Also RAM disk that was fun the precursor to VMs
-
The transfer seems to always happen on my PC
So what OS is on your PC ?
IF windows 10 for example, under
Settings -> Network & Internet -> Status
what does this report?
Does it match the data volume, believed to be from the this device (+66gb)
Then click, "Data usage" is something with that much data "the offender" listed ?
all the fun banter aside, please provide some more information.
-
@jrey said in Data parasites:
Then click, "Data usage" is something with that much data "the offender" listed ?
Yeah that would be a great idea.. And prob if saying its happening every night, maybe reset it..
Scroll to the bottom
Say do that before you go to bed, and then check it in the morning.
Also knowing the IP this data is being exchanged with and what port would be helpful in figuring out what it could be.
I like the darkstat package for looking to see who is moving data at any given time.. Its really lightweight compared to say ntop..
or get on pfsense when its happening and use say iftop or pftop or trafshow
-
@johnpoz said in Data parasites:
Say do that before you go to bed, and then check it in the morning.
yup -- assuming it is a windows PC, not really stated unless I missed it while I was reformatting my MSDOS virtual -- LOL
I just assumed it might be because of "PC" - could be off. All the OP has basically said so far is "A lot of data - it is broken can you make it go?"
-
@jrey said in Data parasites:
assuming it is a windows PC
Yeah we are all assuming a lot of stuff to be honest, because there is really nothing concrete to go on..
-
Once I removed the "fluff" this is what I was left with from a technical "how can I help out here point of view."
ISP is cranky because of data usage
Friday the 10th; transferred about 66 GB over 4 hours
sort of implies not every day?
andpfTop logging reports the data as going from my WAN to my PC's LAN address
might identify that culprit.
We just now have to wait for the OP to fill in the blanks. more coffee
-
Hey all,
Thanks for the feedback, sorry it's taken me long to reply - I'm still at work.
Let me try and clear it up a little more. I'm the only one using my internet; or should be. DHCP leases in PFSense show all my equipment only, and the transfer is reported by PFSense to be going to my PC from my public IP. The port that pfTop reported I believe was 1194, which was what the OpenVPN was running over. I have sense removed that though. It also hasn't happened since I removed the OpenVPN configuration. I don't have a packet capture of it happening, it usually doesn't happen when I'm home and up. It'll be overnight & when I'm at work.
This won't impact HIPAA at all, this is not a device I access work material from. In fact I rarely bring my work laptop home. To clarify it moved 66 Gigabytes over about 4 hour hours, that was not a mistype.
PC OS is 10, the latest updates are applied; I believe 22H2 now. I have checked the Windows data usage - again when it happened with OpenVPN it reported 66 - well actually about 70 GB went over.... OpenVPN.exe, so that didn't really help.My topology is like this: Modem > Netgate 1100 > tpLink 5 port managed switch and from there it breaks off to my AP; the old tpLink router put in AP mode and my PC. This problem was happening before I got the netgate though; or at least I think it was because I was getting notified by Comcast about data usage as early as June. Didn't get the Netgate until October. As far as the configuration of the Netgate it is more or less default, my home network uses a 10.x.x.x range vs. the default 192.168.x.x, and I pass it through the switch.
I did have it turned off when I was out of town recently for a few days; I checked with Comcast when I got back to see what they said I was using - right around the first of the month, it was well under 50 GB.I had darkstat running for a bit, and now use - I can't remember the name of the package but it graphs data usage and you can break it down hourly, daily, monthly. It doesn't really give information beyond wan rx, lan rx, etc etc and the amount. It doesn't break it down to actual traffic.
@jrey - it's not that I'm particularly concerned with what Comcast is saying, I don't want to incur charges for overages but I know I personally am not consuming that much data. The transfers don't happen every day but they do seem to happen enough to nearly max out my data. The pfTop report showed UDP (I think 1194, the OpenVPN server port, since removed), Public IP > Desktop PC IP, and the amount 70-something billion bytes, or about 70 Gigs. That's all it showed. My question is how I can more accurately monitor what's going on, either with pcap or maybe Firewall logging rules.
