Network monitor shows huge traffic spike, but can't find traffic details

[darren_g]

Hey folks.

I had a situation today whereby one of my PA's was responding really slowly across IPSec tunnels and for Global protect clients - so once I could get onto it I started digging into the network monitor to see if I could find out if there was a link/network load issue.

I found a huge spike in traffic in the period concerned - much, much more than normal - but when I tried to check the traffic logs for matching application type, I can;t find anything which would come even close  to matching this level of load

The above shows the spike from the traffic monitor - you can see the increase plainly - and it lists as ms-ds-smbv3 - but when I go looking for that app in the traffic logs - there's minimal amounts - and none of it is in the period indicated by the network traffic monitor.

Does anyone know where I can dig to try and find out where this traffic was from/to?

Thanks

[aleksandar.astardzhiev]

Hi @darren_g ,

Note that traffic log will be generated at the session end (by default) so if you filter your logs with timeframe you will be looking at the timeframe when the log was created. You may need to filter based on session start - which is available field in the log entry.

Also look at the amount of total bytes (column that summarize the sent and receive). You may also  try to apply filter to should only logs for SMB app that has total bytes greater than X