topic Re: Monitoring traffic in Network Security

Monitoring traffic

timothy_MTS — Tue, 22 Aug 2023 23:12:36 GMT

Hello,

I recently got a complain on the internet streaming through our internal network going out to Youtube or Facebook.

In the normal hours, we are working fine, no one complain about the traffic or the streaming, smooth on everything.

But during some time in the afternoon, we noticed that the traffic of our internet spike to over 500MB. It affects our streaming. And becoming choppy.

Is there any way we can find out the where are the inbound / outbound traffic? I have the Zabbix monitoring server, and now can only show the traffic being burst. But can I find out what is inside?

The graph below shows the spike in the afternoon the day before. The one in the morning is also doing the same thing, but we don't experience any choking on the networks/streaming. Both time we do the streaming.

Can give me some idea on how to find the traffic out?

We have C2960XR as the switches, and ASA5516 as the firewall.

Re: Monitoring traffic

Flavio Miranda — Tue, 22 Aug 2023 23:21:50 GMT

Hi @timothy_MTS

In order to see traffic you can enable netflow on the switch. Send the flow to a server. You can use free tools like Grafana in order to graphic the output.

There are others alternative on the internet, this is just an example.

Another thing to check is if the firewall is able to handle all the connections properly. UDP traffic like streaming can saturate firewall easily. Check firewall capacity.

Re: Monitoring traffic

timothy_MTS — Wed, 23 Aug 2023 02:33:29 GMT

Thanks @Flavio Miranda

ok. True that we need something to monitor / analyze on what's going on.

But from the Firewall itself, does it have anything that I can check besides the CPU, Memory. What I am thinking, if traffic going through the interfaces of the firewall, no matter just a short period of time, not those history.

Re: Monitoring traffic

Marvin Rhoads — Wed, 23 Aug 2023 05:55:32 GMT

I agree with @Flavio Miranda - Netflow is your friend here. You can setup a free PTRG instance to collect Netflow exported from the ASA and easily see the top sources/destinations of traffic. Looking at the ASA directly won't show you that sort of info. You can certainly see CPU, memory, connections, etc. but mostly only a a point in time for connections/ flows and that's what you need in this case.

Re: Monitoring traffic

Flavio Miranda — Wed, 23 Aug 2023 07:59:10 GMT

@timothy_MTS

Asa support netflow, you can enable in both devices although they will see the same information.

Re: Monitoring traffic

timothy_MTS — Thu, 24 Aug 2023 22:43:03 GMT

@Flavio Miranda @Marvin Rhoads

Having successfully plot the Netflow information to the PRTG analyze tool. It gives a great picture on it.

Next will fine tune it to have 24 7 monitoring. Thank you for the great help.

Cheers,

Timothy

Re: Monitoring traffic

Flavio Miranda — Thu, 24 Aug 2023 23:31:43 GMT

that´s great @timothy_MTS glad to hear you suceeded