topic Re: Detect high bandwith consumption in Next-Generation Firewall Discussions

Detect high bandwith consumption

procom — Wed, 07 Aug 2024 21:08:57 GMT

Hello everyone!

I´m looking for a way to identify a user or IP when they have high bw consumption

Lets say a user is downloading something and is using all my ISP bw, how can I identify it in that moment?

I was able to do this but when the session was finished, in my scenario my user downloaded something for 2hs an I had to wait until that to identify, this is very frustrating.

Has anyone find a way to do this? it will be very very helpful

Thanks in advance!

Re: Detect high bandwith consumption

YEmreSeven — Thu, 08 Aug 2024 11:57:11 GMT

You can identify from ACC tab. Also you can use QoS policy to limit user's bandwidth or identify user.

Re: Detect high bandwith consumption

procom — Thu, 08 Aug 2024 15:45:37 GMT

Hello YEmereSeven,

Sadly ACC refresh every 15 minutes and if the session is still going it will not show until it ends.
QoS you can see real time traffic (with the graph) but can`t identify the user that is consuming at that time.

It is really disappointing and wierd that PA has no way to do this.

Regards!

Re: Detect high bandwith consumption

zGomez — Fri, 09 Aug 2024 08:11:13 GMT

Hi Procom,

You can try identify the sessions from the CLI that is above a certain amount of data.

show session all filter min-kb 1048576 ( will give you all session above 1 GB)

Take into account this will also include long running sessions.

But should give you a good indication.

You could also try using netflow.

For session that have already ended you can use the ACC dashboard.

I have asked ChatGPT for some python code that can help you print out the session that go above a certain througput.

10 Mbps in the example you can adjust the params to what you want.

Bandwidth Hogs - Pastebin.com

Re: Detect high bandwith consumption

YEmreSeven — Fri, 09 Aug 2024 21:55:22 GMT

Hi Procom, QoS without using the bandwidth limitation will show you to live traffic. But it will be show only offloaded traffic. We can't see the real throughput from SNMP or QoS.

Re: Detect high bandwith consumption

procom — Tue, 29 Jul 2025 18:23:42 GMT

Thank you all, I have confirm my suspicion that in Palo Alto you cant do this sadly.