high network usage

Aresh, try the 'Bandwidth Usage' tab in 'Logging & Reporting >> Network Usage' - "Top applications by client/server."

Cheers - Bob

Hi Balfson,
Thank you for the replay,

This customer access the Terminal server with a non default port and there is a NAT rule that change it back to the default port 3389.
I already tried what you mentioned and I can only choose uncalssified and then I can see that alot of data has been exchange between the customer IP and the server.
but I would like to find out what exectly has been exchange? because I did login to the customer session on the terminal server, but I couldn't see nothing there!!

How can we get more info on what exectly has been exchange between this 2 machine!

Thanks

In that case, I would try 'Top services by client/server'. Any luck with that?

Cheers - Bob

Hi

The same thing, it shows me that in the past 24 hours 15 gb on PXC-SPLR service, this service use port 4007 and our customer use this port to access our Terminal server. so still unable to see what kind of data.

maybe you can answer this question,

I am abit confuse with the Client and server in the network usage.
If I choose the top clients in the network usage I can see some external IP address and also some of my internal servers, also if I choose the top servers again I can see some extenal IP address and some of my internal server.

What is the IP address unders client? are these machine try to access resources behind the utm? then why I see my internal servers there as well?

Thanks

The "Client" is the device that starts the "conversation" with the "Server" as recorded by the Connection Tracker. Apparently, your internal servers are requesting things - probably updates, I guess?

Cheers - Bob

"alot of data has been exchange between the customer IP and the server.
but I would like to find out what exectly has been exchange" RDP traffic is encapsulated and encrypted within TCP. The UTM has no way to see the traffic within the session. You'll need to diagnose from the client and server to see the traffic shared between them. See serverfault.com/.../are-there-any-rdp-activity-logs-windows-server-2008-r2 for suggestions.

Thank you for the update,

Ok I think I undrestsnd why I see our internal server in the client section as well, we have a 3rd party app that when a web request from internet recieved by our web servers, that 3rd party app get the images of the page from other internal server.