topic Traffic data in General Topics

Traffic data

akqaking — Wed, 11 Apr 2012 20:58:03 GMT

we are on 4.1.4, noticed some very odd traffic data from ACC.

1, some internal traffic happened at 9am - 930am, PA ACC showed it happened at 3pm afternoon.

2. about 35G data from one machine out to the facebook within one hour, but our connection is only 40M, shared with 300 people, I dont think it could send that kind amount data out?

wondering if anyone has the same 'issue'?

Thank you.

Re: Traffic data

ukhapre — Mon, 16 Apr 2012 18:40:04 GMT

Hello, The traffic logs are logged at end of the session. So the entry is logged only after the session was ended which could have taken some time (security policy -> last option 'option' -> Log at session end). Check if you have threat/av profile configured for that rule.

The same could be applicable for internal traffic however the difference seems to be high.

Re: Traffic data

mikand — Tue, 17 Apr 2012 20:33:12 GMT

Still sounds odd...

If you maximize 40Mbit/s to transmit 35GB of data you need approx at least 2hours 5minutes or so do accomplish this.

Even if the PAN logs at session end then the session start for that session should still be correct wouldnt it?

Could it be some NTP who malfunctioned or such?