DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

Find out where traffic is being sent to

  • oliverm
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
08 Dec 2010 16:37 #65199 by oliverm
Hi,

We have found that one of our internal IPs is using up all of our TX bandwidth. We've put a cap on it for now using the traffic management features of our 2710.

The Data Flow Monitor shows the IP of the machine and that its using up all of its quota.

However what I'd like to know is where the traffic is being sent to. That is, rather than see the internal IP of the machines sending traffic I'd like to see the external IPs they are sending that to.

Is that possible at all with the 2710 ?

Olly

Please Log in or Create an account to join the conversation.

More
20 Dec 2010 13:37 #65320 by johntankard
Replied by johntankard on topic Re: Find out where traffic is being sent to

oliverm wrote: Hi,

We have found that one of our internal IPs is using up all of our TX bandwidth. We've put a cap on it for now using the traffic management features of our 2710.

The Data Flow Monitor shows the IP of the machine and that its using up all of its quota.

However what I'd like to know is where the traffic is being sent to. That is, rather than see the internal IP of the machines sending traffic I'd like to see the external IPs they are sending that to.

Is that possible at all with the 2710 ?

Olly



Hi Olly,

Yeah this is possible or at least with a 2820n it is, use the draytek syslog software and enable the syslog function on the router (if it has it), then create a firewall rule to block outgoing traffic from that internal IP (you could be loosing all types of data and sensitive information), tick the syslog option on the firewall rule and then when the specified IP attempts to send traffic the internet side IP will be shown in the syslog log. It will be up to you though to sift through the info and find what IP's are legit and which ones are not :)

Hope this helps..

John Tankard

Please Log in or Create an account to join the conversation.

Moderators: ChrisSami