Netflow V9 lot of traffic

[jirochaguerra]

Hi!

The last week I implemented Netflow on 4500 Cisco Core Switch

I can identify, that a host has a Top Connection, 100 GB in 15 minutes:

eze06s08-in-f3.1e100.net (172.217.173.227)

443

pc.domain.local (x.x.x.x)

59147

6

Have do you any idea about this traffic?

The nexts 100 PCs like a connection between 500 MB and 10 MB in 15 minutes

Thank you very much for your help!

[balaji.bandi]

First what is this IP address in the network - 172.217.173.227

i see most of the traffic 443, so i think this may be router IP which is offering NAT between network and PC

[andrewswanson]

The public IP address 172.217.173.227 is registered to Google if that helps.

Andy

[jirochaguerra]

Hi! Thanks a lot for your response!

Yes, I know, the public IP is from Google Cloud ISP

But I have not idea what is the services, because It's 100 GB every 15 minutes, at night It's reduce to 70 GB but If you use Zoom, Netflix, Youtube, with 4k, It's arround 700MB in 15 minutes

Source IP: 172.217.173.227 (Public)
Destination IP: 172.16.1.56 (Private)