WAN fully used but apparently no traffic

maxxer

Hi. I'm in a weird situation: my WAN is fully used, but apparently not IP is making that traffic (see homepage screenshot).
Even bandwidthd doesn't seem to find a culprit.

What could be generating such traffic? How to find it out?
thanks

P.S. on a side note CPU usage seems strangely high, load is ~1.4 with just few clients on the network and no proxy
![screenshot-10.22.22.1 10443 2015-06-04 17-36-32.png](/public/imported_attachments/1/screenshot-10.22.22.1 10443 2015-06-04 17-36-32.png)
![screenshot-10.22.22.1 10443 2015-06-04 17-36-32.png_thumb](/public/imported_attachments/1/screenshot-10.22.22.1 10443 2015-06-04 17-36-32.png_thumb)
![screenshot-10.22.22.1 10443 2015-06-04 18-04-30.png](/public/imported_attachments/1/screenshot-10.22.22.1 10443 2015-06-04 18-04-30.png)
![screenshot-10.22.22.1 10443 2015-06-04 18-04-30.png_thumb](/public/imported_attachments/1/screenshot-10.22.22.1 10443 2015-06-04 18-04-30.png_thumb)

cmb

Diag>Packet Capture, start a capture on WAN with count 0 and let it run for ~30 seconds or so, then stop it. Download the resulting pcap, open in Wireshark, go to Statistics, Conversations.

maxxer

I found out that one of my WAN had DHCP issues… pfSense didn't have the IP anymore and was doing weird things.
Since I couldn't wait more I had to restart the firewall and this fixed, but thank you very much for the suggestion I'll use next time!