High Traffic on Layer 2 Interface without IP - ntopng

  • I am trying to determine traffic usage by IP across 3 VLANs.  Initially it looked like WAN Traffic exceeded Host traffic by 24GB.  After checking again I found 24GB of usage for a physical interface without an IP.  This is confusing for several reasons.

    1. Physical interface without an IP, shouldn't be able to access internet.
    2. Why would pfsense/ntop use 24GB in 5 days?

    pfsense 2.42
    ntopng v3.0.171218

    cellular router
    igb0 WAN /
    igb1 LAN /
    igb2 OPT1 / no IP
    igb2.10 / MGMT
    igb2.20 / WIFIGUEST
    igb2.30 / WIFISTAFF

    Traffic Totals (from Host Tables)
    igb0 WAN  26GB
    igb1 LAN    0
    igb2 OPT1  0
    igb2.10      1GB
    igb2.20      0
    igb2.30      1GB

    Host traffic = 2GB vs WAN traffic 24GB, doesn't add up.  More checking, I found:

    Layer 2 Devices: MAC of igb2 = 24GB Traffic. 
    Traffic for WAN vs Host + Layer 2 are now equal but how, why?

    Possibly unrelated, I suspected a webcam as the cause of the traffic.  Searching for the webcam host in ntop returns host cannot be found and has probably expired.  This happens while I'm connected to the webcam and I can confirm it's regularly uploading.

    Thanks for your help.

Log in to reply