Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Bandwidth gets used to quickly

Posted on 2014-01-15
Medium Priority
Last Modified: 2014-01-20
Hi all

i got his mail from one of my clients. she is hoping that we can solve her problem...

Hi Steven

I wanted to chat about moving onto your companies ADSL as soon as possible in the hopes that we will finally get to the bottom of the mystery of the dissapearing bandwidth. Today is the 14th of the month and we have used 97% of our 100gigs. For example, on the 6th 21 gigs was used and we can’t figure out who is using it.


now we have taken over the contract of this client a little while ago from some random guy that use to stay in the backpackers that they own (this is the site where the problem is). he didn't do much for a living except abuse their internet and trying to hack everything he can.
he still comes there now and again and i'm sure he is up to no good.
is there some sort of software or something that we can capture the computer MAC address and computer name or any details to see whats happening. Obviously the ISP cant help us as they only see what we use from the single dynamic IP. It might not even be him, it might be some staff member as well....point is, we need to figure it out.

any help please...?

thank you
Question by:stevenvanheerden
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

by:Jon Snyderman
ID: 39783291
My first immediate thought is how this person is getting on the network.  Is the wireless secured?  Is there a firewall at the site?  I think that we may need a little more details about the site configuration and security.  There are many many ways to restrict the access, but much depends on the technology available with the client.


Author Comment

ID: 39783370
Yep one of those clients that doesn't want to spend "unnecessary" money if you know what i mean.
there isn't any firewall like pfsense of so if that's what you mean.
we haven changed all passwords (pretty complex) and Wi-Fi passwords as well.
only firewall is the built in one from the D Link ADSL router...
except for restricting it, i think we might need to first find out the cause if possible as i think this will help us decide the course of action as budget is always an issue...
hope this makes sense...

thanks so far

Accepted Solution

Jon Snyderman earned 668 total points
ID: 39783415
Unfortunately, without finding out how the user is breaching the system in the first place or without a higher end firewall, your hands are going to be pretty well tied.   Sorry.   If the passwords are good and have been changed, I would investigate each and every mac address in the dlinks dhcp range and determine what the ip is and who it belongs to.  He can be cheap about hardware all he wants, but i gaurantee that he will pay more for your time than he will on a decent firewall to protect his business.
Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.


Author Comment

ID: 39783547
yes i totally agree with you on that...
but do you not know of any software in this case that can pick up what computer is using lots of bandwidth and the time its used?
something we can install on the server that handles the DHCP?
like i say, it might not even be him....also, the account is being used at two other residential addresses as well...could be there.
I'm just trying to find a real inexpensive way to see where its coming from.
i know if they move over to our company in terms of ISP, we can monitor to see what circuit number uses the most data...so that will cover that part....i just have a suspicion about the back packers....

Expert Comment

by:Jon Snyderman
ID: 39783576
Once the DHCP is picked up from the server and the DNS for the site is resolved, the only devices that see the packets between the user and the internet are the switch and the firewall.   ANything you do MUST somehow talk to one of those.   Because the switch is most likely unmanaged and the firewall is a DLink, you have absolutely no visibility in to the traffic.   If the switch was managed, you could sniff the line.  If the firewall were better, it's tools would likely help.

I have one crazy idea but I really dont know that it will work.  You could put an old hub between the switch and the firewall and then put a sniffer on the hub.   But then you will need to watch it happening.  I dont know any tool specifically that will do this for you.   You could check out Solarwinds, but that will also be expensive.

Assisted Solution

gbotts earned 668 total points
ID: 39784030
I agree with Jon, but I would also do the following:

Since you say he has a "hacking" mentality, I would scan each and every system on the network. You say this guy comes back every now and again?  That usually means the system he's using as a "back door" was either rebooted (which means he has to start the daemon again) or the log is full and he has to collect and purge.  Track  when systems go
"offline" and when he stops by.  That would narrow down your search possibly.
 Look at it from the outside as well. You should be able to get the Public IP used by the D-LINK that allows internal users to surf the web. Once you find that, do a scan on that IP to see  which ports are open if any.  If you find any open ports, go to the D-LINK and see if there's a "port forwarding" to a PC.  
If you have an internal web server, check to the sites to ensure he isn't running a "streaming" site on that server.

There are many other things to check but this should start you off .  

Let me know if this helps...
LVL 62

Expert Comment

ID: 39788993
Make them run netalyzr.icsi.berkeley.edu
Run one for you and make suggestions how they can fix.
LVL 24

Assisted Solution

by:Mohammed Hamada
Mohammed Hamada earned 664 total points
ID: 39793627
I would suggest placing a hub in their network and use Ming to monitor the bandwidth on all of the PCs.

Here's 3 options for supported typologies, I would go with the first one.  

If you don't like the above suggestion, I would recommend setting up a firewall/router that has a bandwidth monitor capability and place after the current router and configure it with NAT and in this way it would capture all the bandwidth and give u a clear statistics on which PC is using how much bandwidth.

there's two options in this case which I'm aware of and used before for such purpose.
1- Untangle (pretty much easy to install and configure).
2- Using Pfsense firewall with (BandwidthD plugin)

I have tried bandwidthD and it's very effective and will give you what you're looking for.

Author Closing Comment

ID: 39794847
Thanks guys. Appreciated.

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ransomware, the malware that locks down its victim’s files until they pay up, has always been a frustrating issue to deal with. However, a recent mobile ransomware will make the issue a little more personal… by sharing the victim’s mobile browsing h…
Let's take a look into the basics of ransomware—how it spreads, how it can hurt us, and why a disaster recovery plan is important.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question