Topic: How to Determine Data being sent and recieved.

[chris burnat]

pssl,

I had a similar problem a while back on my own network, 8 workstations in the house.  Ended up loading IPTRAF at the ready set for "detailed interface stats" - looking at the WAN interface. My ADSL router is adjacent to my monitor, easy to keep an eye on it as I do other work.  It has taken me a few days to identify the guilty workstation by correlating sustained activity on the router and IPTRAF outgoing rate stats - Ip addresses can be seen in the traffic monitor (select WAN).  Admittedly, this method would be a nightmare on a large network,  but I imagine that your setup is similar to mine.  Hope it helps.

[janet]

chris burnat

Ended up loading IPTRAF at the ready set for "detailed interface stats" - looking at the WAN interface. ..... It has taken me a few days to identify the guilty workstation by correlating sustained activity on the router and IPTRAF outgoing rate stats - Ip addresses can be seen in the traffic monitor (select WAN).

That is what I meant for pssl to do when I first suggested iptraf.
No one else had answered after nearly two weeks so it was time to give some advice, albeit brief.

I am busy with a big personal project at the moment so do not have too much time for details.

[pssl]

Thanks folks for the help.  This is going to very hard to trace because it is so intermittent.  I had a spike on 14 Jan then 3 consecutive spikes on 21, 22 and 23 Feb and haven't had anything since.  I watch vnstat closely see if I can observe a spike in progress.  It's clear this is going to take some work.

Mary, thanks for the advise on cloud file sharing.  My own cloud, interesting.  I'm going to take a look at that.  Might be an interesting project.

[piran]

It's clear this is going to take some work.

In the server-manager's collaboration area there is an
option to implement quota... Apparently it will even
email you when that user nears its limit and goes into
limit-with-grace. Set the limits appropriately and then
let SME take the strain while awaiting the email or just
simply eyeballing the reported quota high tide mark.
Never used this feature myself so YMMV.

[janet]

pssl

You could also look at your ISP's data usage reports, which for me show usage for every connection
It should be easy to see when large amounts of data flow out.
Using Vnstat, Sarg or other tools, you should then be able to correlate the ISP 's report with local reports ie date, time & user, and that then should steer you in the right direction of where on your network this outgoing data is being generated.

piran

pssl is referring to outgoing data sent to the Internet, not how much data is stored on the server per user (quotas).

[piran]

pssl is referring to outgoing data sent to the Internet, not how much data is stored on the server per user (quotas).

Granted. There 'may' be a correlation.
Looks easy to implement and monitor.

[piran]

The sme8admin contrib's network use area shows a
network load graph over time and records that Mb/s.
Surges are easy to spot and there may be some
intelligence to be derived from knowing the instant
or period. It does not show which IP did the deed.
http://wiki.contribs.org/Sme8admin
(granularity can be 5mins AOT the usual hour)

PostEdit: added granularity spec

[mmccarn]

If your network switch provides data statistics by port, you could at least identify the offending computer by looking there.

If your switch doesn't provide stats, you can buy a small managed netgear switch that does for not that much:
http://www.netgear.com/business/products/switches/smart-switches/smart-switches/GS108T.aspx#one

* Setup a managed or web-managed switch
* Reset the port stats each night or morning, wait for an event, then check the port stats to ID the culprit.

[pssl]

Hi folks.  Thanks a bunch for all the help.  I can't keep up with the suggestions.

I installed SARG last night.  Nice little tool and will be very useful once I observe a spike in progress. 

My ISP is rather lame and doesn't have a tracking function for their 3g service, only the sat and 4g services; this is because there's no data cap on 3g, so no need to have a monitor service.  I'm on 3g for now.  In fact that's reason I'm going through all this, because I want to upgrade my service, but I needed to know my data usage in order to know what level of service (i.e., data cap) I need.  My average, ignoring the spikes, is 12 gig a month, so a 20 gig service should be plenty.  But at $3.50 a gig overage charge, an overage of 15 gig would hurt.  To jump from 12 gig to 35 gig is concerning.  That's a lot of data, half of which is outbound...we don't upload a lot of data.  Sugarsync data is maybe .5 gig and it only uploads changes (as far as I'm aware).

So why not dump my ISP?  I live in a rural area and the availability of ISPs is very limited.  Ah, such fun to live with a monopoly.

My net switch has a stats capability showing data in/out for IP address and mac address.  Thanks for the suggestion mmccarn, I never thought of that.  Now all I need to do is get it working...looks like a call to manufacturer's help line.

Here's a sample of the output from vnstat.  As you can see on the 21-23 there's quite a jump, especially in the outbound data.

Code: [Select]

In Out Total
28 February 251.02 MB 31.92 MB 282.94 MB
27 February 215.26 MB 42.25 MB 257.51 MB
26 February 2.78 GB 57.91 MB 2.84 GB
25 February 351.05 MB 38.22 MB 389.26 MB
24 February 242.93 MB 31.13 MB 274.06 MB
23 February 1.98 GB 3.94 GB 5.92 GB
22 February 1.70 GB 3.92 GB 5.62 GB
21 February 1.76 GB 3.90 GB 5.66 GB
20 February 405.70 MB 32.08 MB 437.78 MB
19 February 564.21 MB 53.90 MB 618.11 MB
18 February 152.71 MB 15.63 MB 168.34 MB
17 February 65.52 MB 7.93 MB 73.46 MB
16 February 291.12 MB 20.92 MB 312.04 MB


[piran]

Here's a same of the output from vnstat.  As you can see on the 21-23 there's quite a jump, especially in the outbound data.

Over the three days the aberrations look quite steady.
One avenue you could consider is determining whether it's
a slow continuous bleed of data, a series of large spikes or
a single daily overload. The sme8admin net load graph would
probably be able to illustrate which of those three situations
occurred. Driving its accuracy down to a granularity of 5mins
would give you far fewer logs through which to wade:-) No
help as to the IP/s involved... hopefully that's for your switch.

[pssl]

piran,

I'm running sme7 right now.  I know I should upgrade...just haven't gotten around to it.  But thanks for the suggestion.  And your right, those three days are very consistent, uncannily so.  It's very suspicious.  I've been scanning the squid logs on those dates to see if I can see anything but so far nothing.

[janet]

pssl

Depending how your network & user logins are configured, you should be able to see which workstations & users are connected on those days, by looking in the messages log file on sme server for matching date (& maybe time).
That should give clues as to where to look for the source of the data surge if not already obvious.
Have you done recent virus scans on workstations ?

[piran]

I'm running sme7 right now.

I used to run with SME7 and sme7admin.
It's still available I believe. Though if you
have a switch which provides stats then
that should be the best vector as it ought
to identify busy periods *and* their IPs.

[piran]

No outgoing torrents? Don't use them here but they
'could' take up your outgoing capacity in those sorts
of volumes. A proper feed ought to have a rate limiter
for its own good and that of the capacity of its host.
Might explain those consistent heavy traffic days.

[pssl]

Mary,

My systems are set to scan once a week.  However, now that you mention it I haven't check that they are in fact doing so recently.  I could be wrong but I would have thought a virus would have been more active more regularly...but you never know.

I'm looking at the squid access log.  It shows the lan ip addresses, which tells me which machine is connected to the associated website.  Where can I find out what the different columns are in the log.  It looks like there are two columns showing numbers that could be data transmitted (packets? bits? bytes? In? Out?)  Here's a sample with the data in question highlighted.

"Sun Feb 17 07:52:35 2013    142 192.168.0.235 TCP_MISS/200 1777 GET http://..."

I don't know what these numbers are.  If they are data transmission info that would be useful I think.

piran,
I don't use torrents, at least not that I'm aware of; I've never set one up and I know my wife wouldn't; there's no one else here so unless it has been done subversively, it not torrents.  I don't watch movies online (don't have the service speed).  I youtube a fair bit but that would account for a spike in download data, not upload data and besides, even at my heaviest I never broke 13.5 gig in a month.

I'll keep digging.  I'd really like to know what caused the spike before I sign up for a data capped service.  However, at some point I'll have to just make a choice and go.  I'd keep on monitoring and eat the cost if need be.  Hopefully I'd find the cause eventually.

Thanks folks.
P