Data parasites

[johnpoz]

@SamR-0 said in Data parasites:

I work in desktop support for a hospital system and am not a Network

And who says that has anything to do with hipa? For all you know he desktop support for the lighting system.. Or the AC..

Not sure where you think hospital instantly means he is dealing with hipa requirements.. And how would he support that remotely if he was air gapped? ;)

[JonathanLee]

@jrey YEAH load high men,

Also RAM disk that was fun the precursor to VMs

[jrey]

@SamR-0

The transfer seems to always happen on my PC

So what OS is on your PC ?

IF windows 10 for example, under

Settings -> Network & Internet -> Status
what does this report?

Does it match the data volume, believed to be from the this device (+66gb)

Then click, "Data usage" is something with that much data "the offender" listed ?

all the fun banter aside, please provide some more information.

[johnpoz]

@jrey said in Data parasites:

Then click, "Data usage" is something with that much data "the offender" listed ?

Yeah that would be a great idea.. And prob if saying its happening every night, maybe reset it..

Scroll to the bottom

Say do that before you go to bed, and then check it in the morning.

Also knowing the IP this data is being exchanged with and what port would be helpful in figuring out what it could be.

I like the darkstat package for looking to see who is moving data at any given time.. Its really lightweight compared to say ntop..

https://docs.netgate.com/pfsense/en/latest/monitoring/graphs/bandwidth-usage.html#monitoring-bandwidth-usage

or get on pfsense when its happening and use say iftop or pftop or trafshow

[jrey]

@johnpoz said in Data parasites:

Say do that before you go to bed, and then check it in the morning.

yup -- assuming it is a windows PC, not really stated unless I missed it while I was reformatting my MSDOS virtual -- LOL

I just assumed it might be because of "PC" - could be off. All the OP has basically said so far is "A lot of data - it is broken can you make it go?"

[johnpoz]

@jrey said in Data parasites:

assuming it is a windows PC

Yeah we are all assuming a lot of stuff to be honest, because there is really nothing concrete to go on..

[jrey]

@johnpoz

Once I removed the "fluff" this is what I was left with from a technical "how can I help out here point of view."

ISP is cranky because of data usage

Friday the 10th; transferred about 66 GB over 4 hours

sort of implies not every day?
and

pfTop logging reports the data as going from my WAN to my PC's LAN address

might identify that culprit.

We just now have to wait for the OP to fill in the blanks. more coffee

[SamR 0]

Hey all,

Thanks for the feedback, sorry it's taken me long to reply - I'm still at work.
Let me try and clear it up a little more. I'm the only one using my internet; or should be. DHCP leases in PFSense show all my equipment only, and the transfer is reported by PFSense to be going to my PC from my public IP. The port that pfTop reported I believe was 1194, which was what the OpenVPN was running over. I have sense removed that though. It also hasn't happened since I removed the OpenVPN configuration. I don't have a packet capture of it happening, it usually doesn't happen when I'm home and up. It'll be overnight & when I'm at work.
This won't impact HIPAA at all, this is not a device I access work material from. In fact I rarely bring my work laptop home. To clarify it moved 66 Gigabytes over about 4 hour hours, that was not a mistype.
PC OS is 10, the latest updates are applied; I believe 22H2 now. I have checked the Windows data usage - again when it happened with OpenVPN it reported 66 - well actually about 70 GB went over.... OpenVPN.exe, so that didn't really help.

My topology is like this: Modem > Netgate 1100 > tpLink 5 port managed switch and from there it breaks off to my AP; the old tpLink router put in AP mode and my PC. This problem was happening before I got the netgate though; or at least I think it was because I was getting notified by Comcast about data usage as early as June. Didn't get the Netgate until October. As far as the configuration of the Netgate it is more or less default, my home network uses a 10.x.x.x range vs. the default 192.168.x.x, and I pass it through the switch.
 
I did have it turned off when I was out of town recently for a few days; I checked with Comcast when I got back to see what they said I was using - right around the first of the month, it was well under 50 GB.

I had darkstat running for a bit, and now use - I can't remember the name of the package but it graphs data usage and you can break it down hourly, daily, monthly. It doesn't really give information beyond wan rx, lan rx, etc etc and the amount. It doesn't break it down to actual traffic.

@jrey - it's not that I'm particularly concerned with what Comcast is saying, I don't want to incur charges for overages but I know I personally am not consuming that much data. The transfers don't happen every day but they do seem to happen enough to nearly max out my data. The pfTop report showed UDP (I think 1194, the OpenVPN server port, since removed), Public IP > Desktop PC IP, and the amount 70-something billion bytes, or about 70 Gigs. That's all it showed. My question is how I can more accurately monitor what's going on, either with pcap or maybe Firewall logging rules.

[johnpoz]

@SamR-0 said in Data parasites:

again when it happened with OpenVPN

So this is a openvpn server you run on pfsense so you can remote into your network when away, or a client vpn session and your PC was pulling data through the vpn because you route your pc traffic through the vpn?

[SamR 0]

@johnpoz I had it configured on the pfsense, I am mainly at this point interested in just making myself a little more anonymous online. It didn't do that though, it just ran through a separate VNIC and got a different IP subnet. My public IP was unaffected. As said though I've since removed it.

[michmoor]

This smells like some sort of backup job running but heres a question.

How do we track down top talkers over time on pfSense? That would help in the analysis.
This is a feature that i have been asking for since forever considering a firewall/router sits at the core of your network and would be extremely helpful to see what flows go through your core device...thats just me tho..who wouldnt want visibility?

[SteveITS]

@michmoor Bandwidthd or I think a couple of other packages can track by LAN IP. Bandwidthd does not track type of traffic IIRC, or destination.

[michmoor]

@SteveITS
The only tool that works on multiple interfaces is ntopng but it doesn’t do reporting on the free edition.
The OP will need to see the flow in real time to determine what the application is and where it’s going.

But let’s not jump to conclusions that it’s threat actors from RU who’s intent is to steal Netflix passwords…

[johnpoz]

@michmoor said in Data parasites:

threat actors from RU who’s intent is to steal Netflix passwords…

But what about my amazon prime login - then they can get free shipping ;)

[michmoor]

@johnpoz
ahh well thats a ..."Prime" target

[jrey]

@michmoor said in Data parasites:

The OP will need to see the flow in real time to determine what the application is and where it’s going.

But the OP has said that:

is the only user on the network with

my PC, the switch, the AP, my cell phone, TV & an old laptop I put Kali on.
has further identified the application as on the PC

the PC is on Windows 10

PC OS is 10,
again when it happened with OpenVPN
and since removed

There is a perfect way in the thread to verify which application on a single PC is causing the data usage. There is only 1 PC, nothing to monitor

but then goes on to say

My question is how I can more accurately monitor what's going on

but the app has been removed and is now only interested in:

I don't want to incur charges for overages
and
I am mainly at this point interested in just making myself a little more anonymous online

which now has nothing to do with monitoring and the application was clearly identified cause the data overage has been removed.

So if you know that OpenVPN was the culprit was and then removed it
that makes it harder to be a "little more anonymous online."

One thing that could work is simple -- unplug the WAN which then can make the claim that you are 100% anonymous.
anything else is something less than 100% or more precisely in the range of 0% to 99%

The better choice, for lack of another might have been to troubleshoot the OpenVPN traffic usage issue. We didn't even get to understand how the VPN was being used or it's intended use. So everything regarding the data usage is off the table in that regard as it has been removed.

@johnpoz asked

So this is a openvpn server you run on pfsense so you can remote into your network when away, or a client vpn session and your PC was pulling data through the vpn because you route your pc traffic through the vpn?

and the reply was:

I had it configured on the pfsense, I am mainly at this point interested in just making myself a little more anonymous online. It didn't do that though, it just ran through a separate VNIC and got a different IP subnet. My public IP was unaffected. As said though I've since removed it.

[johnpoz]

@jrey said in Data parasites:

I had it configured on the pfsense

Yup wasn't that clear ;)

Mechanic: so is the car a manual or automatic transmission?
User: Yeah it's a car.. It had a full tank of gas, and it's red..

[bmeeks]

I think most VPN client setups have you alter the default gateway to be an IP of the VPN provider. When configured that way, it is possible (or even likely) that all traffic from the host to any other subnet heads first to the VPN gateway. That would be through the ISP's network. The VPN gateway might have not properly routed said traffic, but it would have gone out through the ISP anyway and counted towards the data cap.

I still lean towards a backup job of some sort. Nothing else would accumulate that amount of traffic so quickly except maybe being a Bittorrent host.

[JonathanLee]

You can always use Snort with AppID enabled, you can have my text rules to use..

https://forum.netgate.com/topic/183210/guide-snort-s-appid-custom-rules-quick-guide-to-blocking-example-shows-openai-chatgpt-or-itunes?_=1699909924927

Check it out if you can run inline mode you can block down to application level with pfSense.

Or use it to for visibility to isolate the issue.

textrules2.txt

[jrey]

@bmeeks said in Data parasites:

all traffic from the host to any other subnet heads first to the VPN gateway

we'll never know, the OP removed the offending application. OpenVPN