Data parasites
-
@jrey said in Data parasites:
I had it configured on the pfsense
Yup wasn't that clear ;)
Mechanic: so is the car a manual or automatic transmission?
User: Yeah it's a car.. It had a full tank of gas, and it's red.. -
I think most VPN client setups have you alter the default gateway to be an IP of the VPN provider. When configured that way, it is possible (or even likely) that all traffic from the host to any other subnet heads first to the VPN gateway. That would be through the ISP's network. The VPN gateway might have not properly routed said traffic, but it would have gone out through the ISP anyway and counted towards the data cap.
I still lean towards a backup job of some sort. Nothing else would accumulate that amount of traffic so quickly except maybe being a Bittorrent host.
-
You can always use Snort with AppID enabled, you can have my text rules to use..
https://forum.netgate.com/topic/183210/guide-snort-s-appid-custom-rules-quick-guide-to-blocking-example-shows-openai-chatgpt-or-itunes?_=1699909924927
Check it out if you can run inline mode you can block down to application level with pfSense.
Or use it to for visibility to isolate the issue.
-
@bmeeks said in Data parasites:
all traffic from the host to any other subnet heads first to the VPN gateway
we'll never know, the OP removed the offending application. OpenVPN
-
@jrey said in Data parasites:
removed the offending application. OpenVPN
There is no possible way "openvpn" was the offending application - the whatever that was using 66GB in 4 hours might have flowed through it ;) But openvpn itself was not going to use really any data.. I mean other than maybe keep alives to the server it was connected to if it was a client setup.
-
@johnpoz said in Data parasites:
@jrey said in Data parasites:
removed the offending application. OpenVPN
There is no possible way "openvpn" was the offending application - the whatever that was using 66GB in 4 hours might have flowed through it ;) But openvpn itself was not going to use really any data.. I mean other than maybe keep alives to the server it was connected to if it was a client setup.
Yep! This ^^^
OpenVPN was simply a conduit for the traffic (at least that's how I interpret the OP's original post and follow-up).
I don't think it was anything nefarious. I suspect a configuration issue (like how things were connected and what IP addresses were assigned where) was the root cause. VPN providers love to tell you to change the default gateway so all traffic is routed to them instead of just the traffic that really "needs" to be routed to them.
-
@bmeeks said in Data parasites:
Yep! This ^^^
I never said it was..
The OP came to that conclusion and removed it. Before anyone could even find out how it was set up or the intended use case.
-
@jrey ^ yup this ;) hehehe
Very entertaining thread so far, zero info and nothing learned - but entertaining
Other that learning that RU hackers are after my netflix and prime accounts - hehehe
I mean you would think they would be busy trying to do bad stuff to Ukraine.. But hey maybe netflix accounts they sell on the black market is what is keeping their economy afloat? ;)
-
@johnpoz said in Data parasites:
zero info and nothing learned - but entertaining
Right !?
Actually a lot of "Bad traffic" that hits my FW, is actually (apparently? more likely spoofed) from AS7922. Not sure it amounts to 66GB over 4 hours however, I should check that. LOL ;-)
-
Alright, so apologies, for taking so long and not being more clear. Like I said I'm not exactly a network guy. Someone suggested I said OVPN was the issue, it wasn't. I knew it wasn't. I just got rid of it because it wasn't configured how I wanted. Red herring.
I came home from work today to a massive ongoing download -- about 55 GB by the time I got it stopped.
Checked the Perf monitor, it was svchost.exe (NetworkService -p) which tied to the service "Delivery Optimization" in the Task Manager. Stopped that service & the transfer petered out to nothing.
It's delivery optimization. It's apparently a Windows service for updating.... stuff. Thanks Windows.Checked the activity monitor under Settings > Update & Security > Delivery Optimization > Activity Monitor.... 185.3 GB since 11/1/2023, 100% from MS Servers. There you go. That tracks pretty close with what Comcast says my usage is. Powershell, get-deliveryoptimizationstatus agrees with that, too. In fact it has more it wants to download. I don't get anything from the MS store besides what comes bloatware with Windows, so it merits some further investigation. I'll keep an eye on it.
I'm going to try and reinstall Windows to see if maybe that Service is just borked. There could still be some other Tomfoolery at work here, but I think I can pretty conclusively say what's consuming my data. I suppose I could just block that on PFSense, Microsoft might not like that though, and it may even be useful, sometimes. But 185 GB of usage for "Delivery Optimization" (how much did someone get paid to come up with that word?) is way too much.
Want to thank everyone for the input, I got some good ideas where to look in the future & tools I can use. I'll be in touch again soon I'm sure -- I still haven't figured out how to get VLANs working right ;)
-
@SamR-0 said in Data parasites:
Checked the Perf monitor, it was svchost.exe (NetworkService -p) which tied to the service "Delivery Optimization" in the Task Manager. Stopped that service & the transfer petered out to nothing.
It's delivery optimization. It's apparently a Windows service for updating.... stuff. Thanks Windows.Delivery Optimization is a process that Microsoft introduced some time back to help spread update files to other discoverable PCs in your local network. That traffic probes your local network to find other receptive Windows machines and they share Windows Update files they have much like Bittorrent clients share pieces of a full download. Here is Microsoft's description: https://support.microsoft.com/en-us/windows/windows-update-delivery-optimization-and-privacy-bf86a244-8f26-a3c7-a137-a43bfbe688e8. Normally it stays local and does not search for PCs on the Internet, but that is a configurable option. Sounds like yours is configured to look on the Internet for partners to share Windows Update files with. Here is how that page should look on your Windows PC:
Restricting this to only PCs on the local subnet can be a good thing, but probably not so good if it also attempts to find other PCs to share with out on the Internet. Sounds like probably your configuration has that bottom radio button checked.
-
@bmeeks said in Data parasites:
Restricting this to only PCs on the local subnet can be a good thing, but probably not so good if it also attempts to find other PCs to share with out on the Internet.
This is likely. I found one of mine sharing with the internet. There are articles to make it local only or turn it off.
There are also options in Windows for metered Internet that may help you. -
@AndyRH said in Data parasites:
There are also options in Windows for metered Internet that may help you.
Yup: per the note on the dialog shown above. Your PC won't upload content to other devices on the internet when Windows detects you're on a metered network.
But with only one PC in the network -- "Allow downloads from other PCs" in your own network is likely a moot point.
-
@jrey said in Data parasites:
Yup: per the note on the dialog shown above.
Too bad that image was added after I posted.
There are actual metered internet options that do not have to do with Windows patching.
-
@SamR-0 Strange it’s downloading though; I’d expect the sharing to be upload traffic. Perhaps the SoftwareDistribution directory is borked and it’s continually redownloading. If you want, tomorrow I can find MS’s instructions to reset it, or you can search for “reset Windows Update components” IIRC.
We decided to turn off DO for all our clients so long ago I’d forgotten it existed. :) We just script it out. It’s just P2P to offload MS servers.
-
@SteveITS Actually, the graph showed equal tx & rx transfer, which must be a component of how DO works. I'm really not sure, but even talking to my colleagues at work, they thought that was strange behavior too.
I refreshed Windows last night & checked the DO settings to see; didn't check it before the refresh so I can't comment on what the settings were. It's now on "devices on my local network" and you can also impose data caps rather than rate limiting the bandwidth usage. The lowest you can put it on is 5 GB a month, which I did. I'll continue to monitor it. -
@SamR-0 said in Data parasites:
Actually, the graph showed equal tx & rx transfer, which must be a component of how DO works
When you are in "devices on the internet and my local network" mode
you will be sharing whatever other internet PC are requesting. So yes that's how it works, in that mode.Easy to monitor
"Find out what you’re getting from other PCs—and what your PC is contributing—with Activity Monitor. "https://support.microsoft.com/en-us/windows/delivery-optimization-in-windows-10-0656e53c-15f2-90de-a87a-a2172c94cf6d
However since you are a single PC and and have no other PC's on your local network to actually share updates with or spread downloads to, the appropriate setting is to turn it off.
"As always, you decide whether you want Delivery Optimization to share parts of downloads between your PC and others on your local network or the Internet. "
It's Microsoft's "Fun" way of saying here use your computer to help us offload demand from our servers. We’ll even tell you how much of a boost your PC is getting from other PCs on the Internet.
Notice when the DO is off you will still get updates (but only directly from Microsoft) in a single PC environment there is zero benefit to having any of it turned on.
