Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Data parasites

    Scheduled Pinned Locked Moved General pfSense Questions
    46 Posts 9 Posters 9.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee @jrey
      last edited by

      @jrey YEAH load high men,

      Also RAM disk that was fun the precursor to VMs

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • J
        jrey @SamR 0
        last edited by

        @SamR-0

        The transfer seems to always happen on my PC

        So what OS is on your PC ?

        IF windows 10 for example, under

        Settings -> Network & Internet -> Status
        what does this report?

        Screen Shot 2023-11-13 at 1.02.19 PM.png

        Does it match the data volume, believed to be from the this device (+66gb)

        Then click, "Data usage" is something with that much data "the offender" listed ?

        all the fun banter aside, please provide some more information.

        johnpozJ 1 Reply Last reply Reply Quote 2
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @jrey
          last edited by johnpoz

          @jrey said in Data parasites:

          Then click, "Data usage" is something with that much data "the offender" listed ?

          Yeah that would be a great idea.. And prob if saying its happening every night, maybe reset it..

          Scroll to the bottom

          reset.jpg

          Say do that before you go to bed, and then check it in the morning.

          Also knowing the IP this data is being exchanged with and what port would be helpful in figuring out what it could be.

          I like the darkstat package for looking to see who is moving data at any given time.. Its really lightweight compared to say ntop..

          https://docs.netgate.com/pfsense/en/latest/monitoring/graphs/bandwidth-usage.html#monitoring-bandwidth-usage

          or get on pfsense when its happening and use say iftop or pftop or trafshow

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          J 1 Reply Last reply Reply Quote 0
          • J
            jrey @johnpoz
            last edited by

            @johnpoz said in Data parasites:

            Say do that before you go to bed, and then check it in the morning.

            yup -- assuming it is a windows PC, not really stated unless I missed it while I was reformatting my MSDOS virtual -- LOL

            I just assumed it might be because of "PC" - could be off. All the OP has basically said so far is "A lot of data - it is broken can you make it go?"

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @jrey
              last edited by

              @jrey said in Data parasites:

              assuming it is a windows PC

              Yeah we are all assuming a lot of stuff to be honest, because there is really nothing concrete to go on..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              J 1 Reply Last reply Reply Quote 0
              • J
                jrey @johnpoz
                last edited by

                @johnpoz

                Once I removed the "fluff" this is what I was left with from a technical "how can I help out here point of view."

                ISP is cranky because of data usage

                Friday the 10th; transferred about 66 GB over 4 hours

                sort of implies not every day?
                and

                pfTop logging reports the data as going from my WAN to my PC's LAN address

                might identify that culprit.

                We just now have to wait for the OP to fill in the blanks. more coffee

                1 Reply Last reply Reply Quote 0
                • S
                  SamR 0
                  last edited by

                  Hey all,

                  Thanks for the feedback, sorry it's taken me long to reply - I'm still at work.
                  Let me try and clear it up a little more. I'm the only one using my internet; or should be. DHCP leases in PFSense show all my equipment only, and the transfer is reported by PFSense to be going to my PC from my public IP. The port that pfTop reported I believe was 1194, which was what the OpenVPN was running over. I have sense removed that though. It also hasn't happened since I removed the OpenVPN configuration. I don't have a packet capture of it happening, it usually doesn't happen when I'm home and up. It'll be overnight & when I'm at work.
                  This won't impact HIPAA at all, this is not a device I access work material from. In fact I rarely bring my work laptop home. To clarify it moved 66 Gigabytes over about 4 hour hours, that was not a mistype.
                  PC OS is 10, the latest updates are applied; I believe 22H2 now. I have checked the Windows data usage - again when it happened with OpenVPN it reported 66 - well actually about 70 GB went over.... OpenVPN.exe, so that didn't really help.

                  My topology is like this: Modem > Netgate 1100 > tpLink 5 port managed switch and from there it breaks off to my AP; the old tpLink router put in AP mode and my PC. This problem was happening before I got the netgate though; or at least I think it was because I was getting notified by Comcast about data usage as early as June. Didn't get the Netgate until October. As far as the configuration of the Netgate it is more or less default, my home network uses a 10.x.x.x range vs. the default 192.168.x.x, and I pass it through the switch.
                   
                  I did have it turned off when I was out of town recently for a few days; I checked with Comcast when I got back to see what they said I was using - right around the first of the month, it was well under 50 GB.

                  I had darkstat running for a bit, and now use - I can't remember the name of the package but it graphs data usage and you can break it down hourly, daily, monthly. It doesn't really give information beyond wan rx, lan rx, etc etc and the amount. It doesn't break it down to actual traffic.

                  @jrey - it's not that I'm particularly concerned with what Comcast is saying, I don't want to incur charges for overages but I know I personally am not consuming that much data. The transfers don't happen every day but they do seem to happen enough to nearly max out my data. The pfTop report showed UDP (I think 1194, the OpenVPN server port, since removed), Public IP > Desktop PC IP, and the amount 70-something billion bytes, or about 70 Gigs. That's all it showed. My question is how I can more accurately monitor what's going on, either with pcap or maybe Firewall logging rules.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @SamR 0
                    last edited by johnpoz

                    @SamR-0 said in Data parasites:

                    again when it happened with OpenVPN

                    So this is a openvpn server you run on pfsense so you can remote into your network when away, or a client vpn session and your PC was pulling data through the vpn because you route your pc traffic through the vpn?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SamR 0 @johnpoz
                      last edited by

                      @johnpoz I had it configured on the pfsense, I am mainly at this point interested in just making myself a little more anonymous online. It didn't do that though, it just ran through a separate VNIC and got a different IP subnet. My public IP was unaffected. As said though I've since removed it.

                      1 Reply Last reply Reply Quote 0
                      • M
                        michmoor LAYER 8 Rebel Alliance
                        last edited by

                        This smells like some sort of backup job running but heres a question.

                        How do we track down top talkers over time on pfSense? That would help in the analysis.
                        This is a feature that i have been asking for since forever considering a firewall/router sits at the core of your network and would be extremely helpful to see what flows go through your core device...thats just me tho..who wouldnt want visibility?

                        Firewall: NetGate,Palo Alto-VM,Juniper SRX
                        Routing: Juniper, Arista, Cisco
                        Switching: Juniper, Arista, Cisco
                        Wireless: Unifi, Aruba IAP
                        JNCIP,CCNP Enterprise

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @michmoor
                          last edited by

                          @michmoor Bandwidthd or I think a couple of other packages can track by LAN IP. Bandwidthd does not track type of traffic IIRC, or destination.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            michmoor LAYER 8 Rebel Alliance @SteveITS
                            last edited by

                            @SteveITS
                            The only tool that works on multiple interfaces is ntopng but it doesn’t do reporting on the free edition.
                            The OP will need to see the flow in real time to determine what the application is and where it’s going.

                            But let’s not jump to conclusions that it’s threat actors from RU who’s intent is to steal Netflix passwords…

                            Firewall: NetGate,Palo Alto-VM,Juniper SRX
                            Routing: Juniper, Arista, Cisco
                            Switching: Juniper, Arista, Cisco
                            Wireless: Unifi, Aruba IAP
                            JNCIP,CCNP Enterprise

                            johnpozJ J 2 Replies Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @michmoor
                              last edited by

                              @michmoor said in Data parasites:

                              threat actors from RU who’s intent is to steal Netflix passwords…

                              But what about my amazon prime login - then they can get free shipping ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                michmoor LAYER 8 Rebel Alliance @johnpoz
                                last edited by

                                @johnpoz
                                ahh well thats a ..."Prime" target 😬

                                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                                Routing: Juniper, Arista, Cisco
                                Switching: Juniper, Arista, Cisco
                                Wireless: Unifi, Aruba IAP
                                JNCIP,CCNP Enterprise

                                1 Reply Last reply Reply Quote 1
                                • J
                                  jrey @michmoor
                                  last edited by jrey

                                  @michmoor said in Data parasites:

                                  The OP will need to see the flow in real time to determine what the application is and where it’s going.

                                  But the OP has said that:

                                  is the only user on the network with

                                  my PC, the switch, the AP, my cell phone, TV & an old laptop I put Kali on.
                                  has further identified the application as on the PC

                                  the PC is on Windows 10

                                  PC OS is 10,
                                  again when it happened with OpenVPN
                                  and since removed

                                  There is a perfect way in the thread to verify which application on a single PC is causing the data usage. There is only 1 PC, nothing to monitor

                                  but then goes on to say

                                  My question is how I can more accurately monitor what's going on

                                  but the app has been removed and is now only interested in:

                                  I don't want to incur charges for overages
                                  and
                                  I am mainly at this point interested in just making myself a little more anonymous online

                                  which now has nothing to do with monitoring and the application was clearly identified cause the data overage has been removed.

                                  So if you know that OpenVPN was the culprit was and then removed it
                                  that makes it harder to be a "little more anonymous online."

                                  One thing that could work is simple -- unplug the WAN which then can make the claim that you are 100% anonymous.
                                  anything else is something less than 100% or more precisely in the range of 0% to 99%

                                  The better choice, for lack of another might have been to troubleshoot the OpenVPN traffic usage issue. We didn't even get to understand how the VPN was being used or it's intended use. So everything regarding the data usage is off the table in that regard as it has been removed.

                                  @johnpoz asked

                                  So this is a openvpn server you run on pfsense so you can remote into your network when away, or a client vpn session and your PC was pulling data through the vpn because you route your pc traffic through the vpn?

                                  and the reply was:

                                  I had it configured on the pfsense, I am mainly at this point interested in just making myself a little more anonymous online. It didn't do that though, it just ran through a separate VNIC and got a different IP subnet. My public IP was unaffected. As said though I've since removed it.

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @jrey
                                    last edited by

                                    @jrey said in Data parasites:

                                    I had it configured on the pfsense

                                    Yup wasn't that clear ;)

                                    Mechanic: so is the car a manual or automatic transmission?
                                    User: Yeah it's a car.. It had a full tank of gas, and it's red..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • bmeeksB
                                      bmeeks
                                      last edited by bmeeks

                                      I think most VPN client setups have you alter the default gateway to be an IP of the VPN provider. When configured that way, it is possible (or even likely) that all traffic from the host to any other subnet heads first to the VPN gateway. That would be through the ISP's network. The VPN gateway might have not properly routed said traffic, but it would have gone out through the ISP anyway and counted towards the data cap.

                                      I still lean towards a backup job of some sort. Nothing else would accumulate that amount of traffic so quickly except maybe being a Bittorrent host.

                                      J 1 Reply Last reply Reply Quote 1
                                      • JonathanLeeJ
                                        JonathanLee
                                        last edited by JonathanLee

                                        You can always use Snort with AppID enabled, you can have my text rules to use..

                                        https://forum.netgate.com/topic/183210/guide-snort-s-appid-custom-rules-quick-guide-to-blocking-example-shows-openai-chatgpt-or-itunes?_=1699909924927

                                        Check it out if you can run inline mode you can block down to application level with pfSense.

                                        Or use it to for visibility to isolate the issue.

                                        textrules2.txt

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jrey @bmeeks
                                          last edited by

                                          @bmeeks said in Data parasites:

                                          all traffic from the host to any other subnet heads first to the VPN gateway

                                          we'll never know, the OP removed the offending application. OpenVPN

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @jrey
                                            last edited by

                                            @jrey said in Data parasites:

                                            removed the offending application. OpenVPN

                                            There is no possible way "openvpn" was the offending application - the whatever that was using 66GB in 4 hours might have flowed through it ;) But openvpn itself was not going to use really any data.. I mean other than maybe keep alives to the server it was connected to if it was a client setup.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            bmeeksB 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.