2

I noticed this strange pattern on the bandwidth graph of the pfsense firewall on my work network:

enter image description here

If I'm reading it righ, there is a constant stream of 6 Mbps data going from the local network into the LAN port, but it doesn't seem to be going anywhere.

I first noticed it 10:30 am and it's still ongoing as of now, 14:45 pm.

Curious as to what could be causing it, I inspected the bandwidthd logs, but couldn't find any apparently suspicious host on the daily logs (with 4 min intervals).

I then tried to obtain more information using ntopng, and this stands out:

enter image description here

These two hosts are the only ones identified by MAC address instead of IP address. Both are using nearly 6 Mbps. One of them is only sending and the other is only receiving. One of them seems to be an invalid MAC address. The other one, according to online databases, seems to be a TP-Link device.

enter image description here

I performed arp -a both on my workstation and on the pfsense root account, and checked the "Diagnostics: ARP Table" section on the pfsense dashboard. There are no entries starting with 64:70:02.

What could be going on here?

2
  • 1
    MAC address FF:FF:FF:FF:FF:FF is the Ethernet Layer 2 broadcast address. It's typically associated with ARP requests/traffic. When one device wants to communicate with another device it sends an ARP request to resolve the ip address of the destination host to it's ip address. If you can identify the source of that ARP traffic you can inspect that device.
    – joeqwerty
    Jun 1, 2015 at 19:28
  • Yeah forgot to mention this. The all Fs is in hex, and as joe said is this is a broadcast address. Not familiar with pfsense but that might all be broadcast traffic from that TP router. Setting up some VLANs can bring that number down if that's what you're looking to do. Are there a ton of hosts on the same broadcast domain as the TP router?
    – demiAdmin
    Jun 4, 2015 at 22:33

2 Answers 2

1

You should mirror the port showing this symptom and perform a packet capture. That'll give you some more details as to exactly what's going on.

When this happens on our network it's usually a compromised router, but it cripples our gigabit switches, so it's more than 6mbps of throughput.

it's a bit dated but read this article

Update the firmware of the TP device and I would personally factory reset it and set it back up. Before doing that maybe check to see if the DNS settings have been changed. If it's a customer's router then just shut off their port until they get a new router.

Hope that helps.

2
  • How do I find out what port is being affected? Jun 1, 2015 at 18:46
  • It depends on your network topology. Check your MAC address tables, that would associate a MAC with an interface on one of your switches.
    – demiAdmin
    Jun 1, 2015 at 19:13
0

Packet capture of the traffic is the way to figure out what that traffic is. You can do it right on the firewall, no need to setup a span port in this case. Just go to Diagnostics>Packet Capture, choose interface LAN, set count to 1000, and click Start. A couple seconds or so later, browse back to that page and you'll be able to download the capture. Open it up in Wireshark and you should be able to see what's happening.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.