Security

Ask something
Discussion Locked

Excessive and Suspicious Bandwidth Usage

0 helpful
5 replies

by mswight

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a wireless connection to our ISP which has been fine for the past few months. Over the last two months, however, our bandwidth has increased 500% resulting in extra charges from our ISP. I can't figure it out - we have a linux gateway and firewall - doesn't show any hacking - lots of outgoing activity on a Sunday's though when our plants are closed.

I suspect either someone is stealing our signal or a user has downloaded Kazza or something like it. We have an internet monitor, but nothing has been detected.

Anyone have any suggestions?

5 replies

by cactus pete

Is your wireless network the only network you have? If it's not necessary to have online on Sunday, turn it off...

What type of security are you using for the wireless access point?

Can you view logs to see where activity originates?

Are you using DHCP on the access point? Passwords? encryption? MAC list?

Give a little more insight, I'm sure there are lots of us who can give you suggestions where to look...

by mswight

The wireless cannot be turned off - its used for EDI to an AS400. Besides, we usually run 24/7 anyway on the production side.

We are using Clarke Connect for our gateway with a secure VPN. The only ones who use the VPN are myself and one other IT individual.

What worries me is that I can't see the outgoing activity on the logs.

Our internal network is NT with a wireless (2 buildings point of site)/ethernet/fibre (three buildings) mix over a couple of industrial blocks. IPS are static. I thought we were locked down pretty tight.

Looking outside, there's a lot of antennas out here ...

by joseph moore

Start doing your own bandwidth logging.
First off, get MRTG and run it against your router. (www.mrtg.org) Run it for a while, and compare it against what your ISP bills you, to see if things match. And also having the MRTG logs, you will be able to see when the bandwidth spikes.
Next, set up a span port on your switch, and run a sniffer on it (on a PC plugged into the "span port" technically). Sniff the traffic running on your network, and you will see anything weird like KaZaa or IP addresses you don't recognize.
Basically, go beyond the sever/proxy/firewall loggging level to see what is REALLY going on.

by funinalaska

A friend who runs Wireless had a same problem. Seems you can go to Radio Shack for the supplies and not only log into the connection, but find out what others are doing. Pretty scary out there for Wireless, and he is running Linux. So he set up a Honey Pot (one hard drive) routes into that so he can see what is going on, plus it stops any virus from sneeking in. You might consider that approach also.
Kim

by mswight

Thanks for all the help - obviously the problem is much more complicated than I thought and I'm going to have to do some real homework here. The bandwith seems to have dropped, but I still don't really know what's going on. Thanks for the tip on MRTG - It is definitely something I'm going to use. Appreciate your help!

This discussion is closed to new replies.