Bandwidth gets used to quickly

Posted on 2014-01-15
Medium Priority
Last Modified: 2014-01-20
Hi all

i got his mail from one of my clients. she is hoping that we can solve her problem...

Hi Steven

I wanted to chat about moving onto your companies ADSL as soon as possible in the hopes that we will finally get to the bottom of the mystery of the dissapearing bandwidth. Today is the 14th of the month and we have used 97% of our 100gigs. For example, on the 6th 21 gigs was used and we can’t figure out who is using it.


now we have taken over the contract of this client a little while ago from some random guy that use to stay in the backpackers that they own (this is the site where the problem is). he didn't do much for a living except abuse their internet and trying to hack everything he can.
he still comes there now and again and i'm sure he is up to no good.
is there some sort of software or something that we can capture the computer MAC address and computer name or any details to see whats happening. Obviously the ISP cant help us as they only see what we use from the single dynamic IP. It might not even be him, it might be some staff member as well....point is, we need to figure it out.

any help please...?

thank you
Question by:stevenvanheerden
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

by:Jon Snyderman
ID: 39783291
My first immediate thought is how this person is getting on the network.  Is the wireless secured?  Is there a firewall at the site?  I think that we may need a little more details about the site configuration and security.  There are many many ways to restrict the access, but much depends on the technology available with the client.


Author Comment

ID: 39783370
Yep one of those clients that doesn't want to spend "unnecessary" money if you know what i mean.
there isn't any firewall like pfsense of so if that's what you mean.
we haven changed all passwords (pretty complex) and Wi-Fi passwords as well.
only firewall is the built in one from the D Link ADSL router...
except for restricting it, i think we might need to first find out the cause if possible as i think this will help us decide the course of action as budget is always an issue...
hope this makes sense...

thanks so far

Accepted Solution

Jon Snyderman earned 668 total points
ID: 39783415
Unfortunately, without finding out how the user is breaching the system in the first place or without a higher end firewall, your hands are going to be pretty well tied.   Sorry.   If the passwords are good and have been changed, I would investigate each and every mac address in the dlinks dhcp range and determine what the ip is and who it belongs to.  He can be cheap about hardware all he wants, but i gaurantee that he will pay more for your time than he will on a decent firewall to protect his business.
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.


Author Comment

ID: 39783547
yes i totally agree with you on that...
but do you not know of any software in this case that can pick up what computer is using lots of bandwidth and the time its used?
something we can install on the server that handles the DHCP?
like i say, it might not even be him....also, the account is being used at two other residential addresses as well...could be there.
I'm just trying to find a real inexpensive way to see where its coming from.
i know if they move over to our company in terms of ISP, we can monitor to see what circuit number uses the most data...so that will cover that part....i just have a suspicion about the back packers....

Expert Comment

by:Jon Snyderman
ID: 39783576
Once the DHCP is picked up from the server and the DNS for the site is resolved, the only devices that see the packets between the user and the internet are the switch and the firewall.   ANything you do MUST somehow talk to one of those.   Because the switch is most likely unmanaged and the firewall is a DLink, you have absolutely no visibility in to the traffic.   If the switch was managed, you could sniff the line.  If the firewall were better, it's tools would likely help.

I have one crazy idea but I really dont know that it will work.  You could put an old hub between the switch and the firewall and then put a sniffer on the hub.   But then you will need to watch it happening.  I dont know any tool specifically that will do this for you.   You could check out Solarwinds, but that will also be expensive.

Assisted Solution

gbotts earned 668 total points
ID: 39784030
I agree with Jon, but I would also do the following:

Since you say he has a "hacking" mentality, I would scan each and every system on the network. You say this guy comes back every now and again?  That usually means the system he's using as a "back door" was either rebooted (which means he has to start the daemon again) or the log is full and he has to collect and purge.  Track  when systems go
"offline" and when he stops by.  That would narrow down your search possibly.
 Look at it from the outside as well. You should be able to get the Public IP used by the D-LINK that allows internal users to surf the web. Once you find that, do a scan on that IP to see  which ports are open if any.  If you find any open ports, go to the D-LINK and see if there's a "port forwarding" to a PC.  
If you have an internal web server, check to the sites to ensure he isn't running a "streaming" site on that server.

There are many other things to check but this should start you off .  

Let me know if this helps...
LVL 62

Expert Comment

ID: 39788993
Make them run netalyzr.icsi.berkeley.edu
Run one for you and make suggestions how they can fix.
LVL 24

Assisted Solution

by:Mohammed Hamada
Mohammed Hamada earned 664 total points
ID: 39793627
I would suggest placing a hub in their network and use Ming to monitor the bandwidth on all of the PCs.

Here's 3 options for supported typologies, I would go with the first one.  

If you don't like the above suggestion, I would recommend setting up a firewall/router that has a bandwidth monitor capability and place after the current router and configure it with NAT and in this way it would capture all the bandwidth and give u a clear statistics on which PC is using how much bandwidth.

there's two options in this case which I'm aware of and used before for such purpose.
1- Untangle (pretty much easy to install and configure).
2- Using Pfsense firewall with (BandwidthD plugin)

I have tried bandwidthD and it's very effective and will give you what you're looking for.

Author Closing Comment

ID: 39794847
Thanks guys. Appreciated.

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The well known Cerber ransomware continues to spread this summer through spear phishing email campaigns targeting enterprises. Learn how it easily bypasses traditional defenses - and what you can do to protect your data.
Check out the latest tech news, community articles, and expert highlights in August's newsletter.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Suggested Courses
Course of the Month14 days, 19 hours left to enroll

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question