Conduct an Investigation
-
Afternoon
How does one start investigating an event like this and ultimately which client/network it originated from: -
Thanks
Pops -
Several solution.
Goto Status >Traffic Graph, select an interface, and observe ...
Or have the system do all the work for you ( this works as soon as you know how to ask the system ) : goto System >Package Manager > Available Packages
and see what bandwidthd and / or ntopng - maybe others.
Keep in mind : these could use huge quantityies of RAM and/or disk space, so don't leave home and stay on the task while you run these ;). -
@gertjan, hi
Bandwidthd had long been installed but it never appeared to be accurate in discovering all the peers and so logging what passes between them. The server is a VPN box with several subnet networks connecting into it. Some services hosted on remote networks also traverse the tunnel to use it as their gateway. Nothing overly complicated...yet bandwidthd struggles to log what should be quite a bit of traffic to/from these networks.
Do people packet log all their traffic between the subnets to build a picture of what is traversing the gateway?
-
See: https://docs.netgate.com/pfsense/en/latest/monitoring/graphs/bandwidth-usage.html
For long term full details you want to be exporting netflow data to a external collector.
Steve
-
There isnt any package other than netflow that would give you that historical data you need to diagnose. All the other packages would give you real-time data which wont help you.
-
ntop-ng and bandwidthd keep historical data. It may not be sufficiently detailed for this though.
-
@stephenw10 I have the same issue with bandwidthD as the OP. It doesn’t capture all hosts and in my case some top talkers aren’t graphed.
Ntopng has heavy r/w’s on my ssd. Maybe for in the moment kind of snooping but I don’t think it’s recommended to keep enabled all the time.Is there a way to log a session at close and know how many bytes was sent and received? That’s good data.
-
Use netflow if you really need that sort of detail.
-
@stephenw10 Ive seen nfsen but are you aware of any other open source collectors ?
-
ive personally have issues with bandwidthd not reporting data on top talkers.
https://forum.netgate.com/topic/177849/bandwidthd-not-capturing-any-toptalkersntopng always works but its hard on the ssd with lots of flows happening.
