10-17-2022 10:36 AM
Hi!
The last week I implemented Netflow on 4500 Cisco Core Switch
I can identify, that a host has a Top Connection, 100 GB in 15 minutes:
eze06s08-in-f3.1e100.net (172.217.173.227) | 443 | pc.domain.local (x.x.x.x) | 59147 | 6 |
Have do you any idea about this traffic?
The nexts 100 PCs like a connection between 500 MB and 10 MB in 15 minutes
Thank you very much for your help!
10-17-2022 10:59 AM
First what is this IP address in the network - 172.217.173.227
i see most of the traffic 443, so i think this may be router IP which is offering NAT between network and PC
10-17-2022 12:07 PM
The public IP address 172.217.173.227 is registered to Google if that helps.
Andy
10-17-2022 12:41 PM
Hi! Thanks a lot for your response!
Yes, I know, the public IP is from Google Cloud ISP
But I have not idea what is the services, because It's 100 GB every 15 minutes, at night It's reduce to 70 GB but If you use Zoom, Netflix, Youtube, with 4k, It's arround 700MB in 15 minutes
Source IP: 172.217.173.227 (Public)
Destination IP: 172.16.1.56 (Private)
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide