Data parasites

[michmoor]

This smells like some sort of backup job running but heres a question.

How do we track down top talkers over time on pfSense? That would help in the analysis.
This is a feature that i have been asking for since forever considering a firewall/router sits at the core of your network and would be extremely helpful to see what flows go through your core device...thats just me tho..who wouldnt want visibility?

[SteveITS]

@michmoor Bandwidthd or I think a couple of other packages can track by LAN IP. Bandwidthd does not track type of traffic IIRC, or destination.

[michmoor]

@SteveITS
The only tool that works on multiple interfaces is ntopng but it doesn’t do reporting on the free edition.
The OP will need to see the flow in real time to determine what the application is and where it’s going.

But let’s not jump to conclusions that it’s threat actors from RU who’s intent is to steal Netflix passwords…

[johnpoz]

@michmoor said in Data parasites:

threat actors from RU who’s intent is to steal Netflix passwords…

But what about my amazon prime login - then they can get free shipping ;)

[michmoor]

@johnpoz
ahh well thats a ..."Prime" target

[jrey]

@michmoor said in Data parasites:

The OP will need to see the flow in real time to determine what the application is and where it’s going.

But the OP has said that:

is the only user on the network with

my PC, the switch, the AP, my cell phone, TV & an old laptop I put Kali on.
has further identified the application as on the PC

the PC is on Windows 10

PC OS is 10,
again when it happened with OpenVPN
and since removed

There is a perfect way in the thread to verify which application on a single PC is causing the data usage. There is only 1 PC, nothing to monitor

but then goes on to say

My question is how I can more accurately monitor what's going on

but the app has been removed and is now only interested in:

I don't want to incur charges for overages
and
I am mainly at this point interested in just making myself a little more anonymous online

which now has nothing to do with monitoring and the application was clearly identified cause the data overage has been removed.

So if you know that OpenVPN was the culprit was and then removed it
that makes it harder to be a "little more anonymous online."

One thing that could work is simple -- unplug the WAN which then can make the claim that you are 100% anonymous.
anything else is something less than 100% or more precisely in the range of 0% to 99%

The better choice, for lack of another might have been to troubleshoot the OpenVPN traffic usage issue. We didn't even get to understand how the VPN was being used or it's intended use. So everything regarding the data usage is off the table in that regard as it has been removed.

@johnpoz asked

So this is a openvpn server you run on pfsense so you can remote into your network when away, or a client vpn session and your PC was pulling data through the vpn because you route your pc traffic through the vpn?

and the reply was:

I had it configured on the pfsense, I am mainly at this point interested in just making myself a little more anonymous online. It didn't do that though, it just ran through a separate VNIC and got a different IP subnet. My public IP was unaffected. As said though I've since removed it.

[johnpoz]

@jrey said in Data parasites:

I had it configured on the pfsense

Yup wasn't that clear ;)

Mechanic: so is the car a manual or automatic transmission?
User: Yeah it's a car.. It had a full tank of gas, and it's red..

[bmeeks]

I think most VPN client setups have you alter the default gateway to be an IP of the VPN provider. When configured that way, it is possible (or even likely) that all traffic from the host to any other subnet heads first to the VPN gateway. That would be through the ISP's network. The VPN gateway might have not properly routed said traffic, but it would have gone out through the ISP anyway and counted towards the data cap.

I still lean towards a backup job of some sort. Nothing else would accumulate that amount of traffic so quickly except maybe being a Bittorrent host.

[JonathanLee]

You can always use Snort with AppID enabled, you can have my text rules to use..

https://forum.netgate.com/topic/183210/guide-snort-s-appid-custom-rules-quick-guide-to-blocking-example-shows-openai-chatgpt-or-itunes?_=1699909924927

Check it out if you can run inline mode you can block down to application level with pfSense.

Or use it to for visibility to isolate the issue.

textrules2.txt

[jrey]

@bmeeks said in Data parasites:

all traffic from the host to any other subnet heads first to the VPN gateway

we'll never know, the OP removed the offending application. OpenVPN

[johnpoz]

@jrey said in Data parasites:

removed the offending application. OpenVPN

There is no possible way "openvpn" was the offending application - the whatever that was using 66GB in 4 hours might have flowed through it ;) But openvpn itself was not going to use really any data.. I mean other than maybe keep alives to the server it was connected to if it was a client setup.

[bmeeks]

@johnpoz said in Data parasites:

@jrey said in Data parasites:

removed the offending application. OpenVPN

There is no possible way "openvpn" was the offending application - the whatever that was using 66GB in 4 hours might have flowed through it ;) But openvpn itself was not going to use really any data.. I mean other than maybe keep alives to the server it was connected to if it was a client setup.

Yep! This ^^^

OpenVPN was simply a conduit for the traffic (at least that's how I interpret the OP's original post and follow-up).

I don't think it was anything nefarious. I suspect a configuration issue (like how things were connected and what IP addresses were assigned where) was the root cause. VPN providers love to tell you to change the default gateway so all traffic is routed to them instead of just the traffic that really "needs" to be routed to them.

[jrey]

@bmeeks said in Data parasites:

Yep! This ^^^

I never said it was..

The OP came to that conclusion and removed it. Before anyone could even find out how it was set up or the intended use case.

[johnpoz]

@jrey ^ yup this ;) hehehe

Very entertaining thread so far, zero info and nothing learned - but entertaining

Other that learning that RU hackers are after my netflix and prime accounts - hehehe

I mean you would think they would be busy trying to do bad stuff to Ukraine.. But hey maybe netflix accounts they sell on the black market is what is keeping their economy afloat? ;)

[jrey]

@johnpoz said in Data parasites:

zero info and nothing learned - but entertaining

Right !?

Actually a lot of "Bad traffic" that hits my FW, is actually (apparently? more likely spoofed) from AS7922. Not sure it amounts to 66GB over 4 hours however, I should check that. LOL ;-)

[SamR 0]

Alright, so apologies, for taking so long and not being more clear. Like I said I'm not exactly a network guy. Someone suggested I said OVPN was the issue, it wasn't. I knew it wasn't. I just got rid of it because it wasn't configured how I wanted. Red herring.
I came home from work today to a massive ongoing download -- about 55 GB by the time I got it stopped.
Checked the Perf monitor, it was svchost.exe (NetworkService -p) which tied to the service "Delivery Optimization" in the Task Manager. Stopped that service & the transfer petered out to nothing.
It's delivery optimization. It's apparently a Windows service for updating.... stuff. Thanks Windows.

Checked the activity monitor under Settings > Update & Security > Delivery Optimization > Activity Monitor.... 185.3 GB since 11/1/2023, 100% from MS Servers. There you go. That tracks pretty close with what Comcast says my usage is. Powershell, get-deliveryoptimizationstatus agrees with that, too. In fact it has more it wants to download. I don't get anything from the MS store besides what comes bloatware with Windows, so it merits some further investigation. I'll keep an eye on it.

I'm going to try and reinstall Windows to see if maybe that Service is just borked. There could still be some other Tomfoolery at work here, but I think I can pretty conclusively say what's consuming my data. I suppose I could just block that on PFSense, Microsoft might not like that though, and it may even be useful, sometimes. But 185 GB of usage for "Delivery Optimization" (how much did someone get paid to come up with that word?) is way too much.

Want to thank everyone for the input, I got some good ideas where to look in the future & tools I can use. I'll be in touch again soon I'm sure -- I still haven't figured out how to get VLANs working right ;)

[bmeeks]

@SamR-0 said in Data parasites:

Checked the Perf monitor, it was svchost.exe (NetworkService -p) which tied to the service "Delivery Optimization" in the Task Manager. Stopped that service & the transfer petered out to nothing.
It's delivery optimization. It's apparently a Windows service for updating.... stuff. Thanks Windows.

Delivery Optimization is a process that Microsoft introduced some time back to help spread update files to other discoverable PCs in your local network. That traffic probes your local network to find other receptive Windows machines and they share Windows Update files they have much like Bittorrent clients share pieces of a full download. Here is Microsoft's description: https://support.microsoft.com/en-us/windows/windows-update-delivery-optimization-and-privacy-bf86a244-8f26-a3c7-a137-a43bfbe688e8. Normally it stays local and does not search for PCs on the Internet, but that is a configurable option. Sounds like yours is configured to look on the Internet for partners to share Windows Update files with. Here is how that page should look on your Windows PC:

Restricting this to only PCs on the local subnet can be a good thing, but probably not so good if it also attempts to find other PCs to share with out on the Internet. Sounds like probably your configuration has that bottom radio button checked.

[AndyRH]

@bmeeks said in Data parasites:

Restricting this to only PCs on the local subnet can be a good thing, but probably not so good if it also attempts to find other PCs to share with out on the Internet.

This is likely. I found one of mine sharing with the internet. There are articles to make it local only or turn it off.
There are also options in Windows for metered Internet that may help you.

[jrey]

@AndyRH said in Data parasites:

There are also options in Windows for metered Internet that may help you.

Yup: per the note on the dialog shown above. Your PC won't upload content to other devices on the internet when Windows detects you're on a metered network.

But with only one PC in the network -- "Allow downloads from other PCs" in your own network is likely a moot point.

[AndyRH]

@jrey said in Data parasites:

Yup: per the note on the dialog shown above.

Too bad that image was added after I posted.

There are actual metered internet options that do not have to do with Windows patching.