WAN interface maxed every morning at the same time?

[ealvar]

I've been noticing in my RRD logs that between 5:30am and 7:30am my WAN-In traffic is through the roof and is effectively maxed out during this window (avg 2.94Mb/s).  This is a 3mb down / 1mb up connection and is hitting about 4gb of WAN-In data during this timeframe.

There is little to no corresponding traffic on the LAN side.

90% of my WAN-In traffic during a 24 hour window is during this time.

The last two mornings I've disconnected the LAN completely so there is nothing on my internal network that could be causing this inbound traffic.  Still seeing the massive spike.

The Firewall system logs aren't terribly useful because with all the logging I can't go back far enough to get an idea of what's going on.

Any suggestions?

Seems strange that all this WAN traffic is coming in but apparently not going anywhere.  Could this be some type of DDOS or something?

Baffled…

Thanks,

E

[Guest]

install and start ntop , should tell you what´s hogging the line

/F

[cmb]

anything in your firewall logs at that time?

[familyguy]

@fredde:

install and start ntop , should tell you what´s hogging the line

/F

Do you mean installing ntop on the pfsense box?

[Guest]

@familyguy:

@fredde:

install and start ntop , should tell you what´s hogging the line

/F

Do you mean installing ntop on the pfsense box?

Yes, system -> packages -> ntop
that´s asumed you dont run embedded version

/f