Identifying odd network traffic

[Presler]

Network guru's, help 'n bosapie asb!

ISP called, let me know something on my network is chowing up 95% of the bandwidth causing packet loss etc.

They gave me an external IP the traffic is directed to/from. Quick WHOIS showed IP 205.185.216.10 belongs to Highwinds Network Group, a CDN. So the traffic could be anything really. Router screenshot shows it's own IP as destination, but traffic flow equals that external traffic sent through the LAN port to my USG.

Router shows the traffic is pushed to my firewall, however 176 lages of logs pulled from the USG mentions that IP only twice, both times showing the source as the ISP router, can't find anything in the logs identifying any device TX/RX traffic to that IP.

Any clever ways I can source the device that is responsible for said traffic?

My network is built with Ubiquiti AP's, USG 4 Pro, Unifi controller, D'Link switches.

Thanx

 

[Spaffy]

I'm no network guru but perhaps one of your neighbors is having a ball at your expense?

 

[Presler]

I'm no network guru but it perhaps one of your neighbors is having a ball at your expense?

Could be, but wondering who/what.

Trying to find a way to sniff out the device/IP responsible for that traffic

 

[shifttymike]

I've always found this useful for these kinds of investigations: NetBalancer - internet traffic control tool for Windows
That will show you if the culprit is on your PC (or any Windows machine you drop it on). I don't have an Ubiquiti UI handy right now, but surely there's a breakdown of usage/device?

 

[Spaffy]

Could be, but wondering who/what.

Trying to find a way to sniff out the device/IP responsible for that traffic

Maybe a bit obvious but have you tried any IP scanning software?

MyLanViewer, Angry IP Scanner etc

 

[DarkShadowZA]

Is this and the phone hacking perhaps related?

 

[Presler]

Is this and the phone hacking perhaps related?

Haha, was waiting for that.

No, this is a client network

 

[spydr97]

Can't be of much help with finding the actual device but according to Scamalytics it seems to be a VPN server from the IP address.

205.185.216.10 ( StackPath ) Fraud Risk

scamalytics.com

 

[∀Z‾soʇɐuɐɥ┴]

What about using Glasswire which Linus plugs in almost every video?

 

[rinners]

Wireshark?

Or get a Mikrotik

 

[Presler]

Wireshark?

Or get a Mikrotik

ISP router is a Mikrotik, shows nothing more than the external IP.

What about using Glasswire which Linus plugs in almost every video?

Don't watch much linus vids, the dude's voice annoys me

Going to check out glasswire, thanx

 

[dalion619]

Windows Update?

 

[∀Z‾soʇɐuɐɥ┴]

ISP router is a Mikrotik, shows nothing more than the external IP.

Don't watch much linus vids, the dude's voice annoys me

Going to check out glasswire, thanx

I feel the same way about that dude from Gamers Nexus xD

 

[Tsakie]

Switch it on and off

 

[rinners]

ISP router is a Mikrotik, shows nothing more than the external IP.

Going to check out glasswire, thanx

Wireshark is free

 

[pɐlΛ‾pɐq‾ƃᴉq]

ISP router is a Mikrotik, shows nothing more than the external IP.

Ask the ISP to make sure that their routerOS is up to date. Few weeks ago I got notified from SecOps that there are atleast 6 CVE's (Common Vulnerabilities and Exposures) on RouterOS before 6.44.6

 

[rinners]

Sorry been a while since I used wireshark, I'm sure you can configure it to push logs somewhere and get a nice graph, but maybe glasswire is the way to go in your case. Definitely less leg work.

Wireshark is a monitoring tool that is more a raw packet sniffer listening on the interface itself. Where GlassWire is more of a dashboard type monitoring software with some basic firewall rules and detection. GlassWire focuses more on ease of use and alerts for suspicious activity.

 

[PsyWulf]

ISP router is a Mikrotik, shows nothing more than the external IP.

What kind of access do you have? Because you should literally be able to Torch to track network traffic per device
*Ah hang on,you're using the USG WAN? So everything would be NATted
I thought USG had capability to view device/port traffic breakdowns?

 

[ovisser1]

ISP router is a Mikrotik, shows nothing more than the external IP.

I vote for brute force
Block that IP from all incoming/outgoing traffic, if something breaks you know what it was.
If nothing breaks, you fixed the issue

 

[Bippuu]

Mikrotik routers (generally) have an ass load of vulnerabilities, could be pwned with commands executing via the router from outside your network environment.

 

[Byakugan]

Best way to check this is to have something that monitors netflow traffic on the WAN/Outside interface on your router. If your device can do sflow get something like PRTG free version.

Otherwise, one easy thing to do is block everything on your network then allow 1 device. through Check it, if the traffic looks fine remove it from the network and keep doing this until you come across the device that has abnormal traffic. Do this with mac blocking, physical cable removing etc.

Trial and error the kak out of it

 

[IOPS]

Highwinds are also a huge Usenet provider group. The UniFi controller shows what client activity - both for the last few minutes as well as total downloaded/uploaded. You can try enabling DPI (Deep Packet Inspection) but if the traffic is encrypted it's not going to help much.

The easiest is probably going to be to narrow it down to a specific or handful of clients and start digging around there.

Also check your UniFI controller for any firewall rules and port forwarding.

 

[shifttymike]

Ask the ISP to make sure that their routerOS is up to date. Few weeks ago I got notified from SecOps that there are atleast 6 CVE's (Common Vulnerabilities and Exposures) on RouterOS before 6.44.6

lol. This is how I got into my neighbour's Mikrotik without signing those pesky Vox forms. Thanks to ancient RouterOS and CVE-2018-14847.
News to me about the more recent CVEs, should look into that.

Sorry been a while since I used wireshark, I'm sure you can configure it to push logs somewhere and get a nice graph, but maybe glasswire is the way to go in your case. Definitely less leg work.

Yeah, it's geared towards digging into the nitty-gritty. For broader-strokes, tools like glasswire/ntop/netbalancer are the way to go. That being said, if you grap a pcap of your network traffic, there are a variety of tools to analyse, including Wireshark. There are some summary views which are helpful.

 

[IOPS]

Ah, just seen you don't have a UniFi switch. Is the DLink managed? That may rule out detecting which device(s) are using the bandwidth. Still worth checking for any open ports and firewall rules which sit on the USG Pro 4. WiFi clients should show up activity.

Narrowing things down per client is still the best place to start.

 

[aiccc]

Look at my posts regarding vulnerabilities and bypassed that occur after firmware update.

MikroTik blog

MikroTik blog - latest news about our products, announcements and much more. MikroTik is a Latvian company which was founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for Internet connectivity in most…

blog.mikrotik.com

MikroTik blog

MikroTik blog - latest news about our products, announcements and much more. MikroTik is a Latvian company which was founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for Internet connectivity in most…

blog.mikrotik.com

We need more details to help

Usually a span port and software is needed to find all traffic. How ever certain prosumer routers have forwarding abilities.

 

[aiccc]

Some free tools (i posted this before)

my top pick based on your username

Discover the 3 Paessler PRTG monitoring solutions

Get to know all products of Paessler's PRTG monitoring software for every IT infrastructure. On premises and cloud-based.

www.paessler.com

Stay on top of bandwidth with PRTG Network Monitor

Professional bandwidth monitoring ➤ Prompt alarm in the event of bandwidth hogs ➤ Start your free trial of PRTG today and see for yourself!

www.paessler.com

Network Bandwidth Monitor - Monitoring Software | SolarWinds

NetFlow Traffic Analyzer (NTA) features a network bandwidth monitor to help you more easily see how bandwidth is used and help determine if you need more. Download free 30-day trial!

www.solarwinds.com

FREE Flow Tool Bundle | SolarWinds

Feel the flow with SolarWinds® free Flow Tool Bundle! Be able to quickly distribute, test, and configure flow traffic with these easy-to-install and easy-to-use tools.

www.solarwinds.com

ntopng

ntopng High-Speed Web-based Traffic Analysis and Flow Collection ntopng is a network traffic probe that provides 360° Network visibility, with its ability to gather traffic information from traffic…

www.ntop.org

Good luck

 

[aiccc]

BTW wrt to solarwinds.

DO not use ANY old versions. Download directly from solarwinds

 

[aiccc]

Check this out

205.185.216.10 | StackPath LLC | AbuseIPDB

www.abuseipdb.com