Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 3 subscribers
  • Views 8397 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Reporting shows WAN IP as top user

danodemano
Hey all!

Not sure what forum to put this in, starting with the reports one since that's where I'm seeing the "issue."  When I look at the reports for my top bandwidth users the WAN IP of my UTM is ALWAYS number 1.  And not by a little bit, usually by 100+ gbps.  Anyway a picture is worth 1000 words so here is my top users over the past 30 days (the 74. is my WAN IP):



Then if I click on that IP here are the specifics for it:



Since it says HTTP is the bulk the web reporting should have something, but it doesn't:



Is this simply a bug with the reporting cause it to essentially "double report" all traffic as it hits the WAN interface first then goes to a device?  Or am I missing something really obvious here?  Any insight would be appreciated.  I'm trying to better understand how much data I'm actually pulling each month and this seems like it might be skewing the results.  Thanks!


This thread was automatically locked due to age.
  • 0 in reply to Billybob
    Its web proxy traffic.


    So then why is it on the reports?  If it's normal proxy traffic it should still be tie d to a user/IP.  It's VERY misleading when looking at the top users as this is basically bogus traffic then....
  • 0

    The "Network Usage" report shows the traffic for every single IP/host which are attached to the UTM. A WWW request of a client from inside the LAN is shown as traffic on the LAN interface and also on the WAN interface where it goes through. If all clients in your network only or most time communicate to the WWW, then the WAN interface is of course the top user because it forwards the traffic of all IP/hosts in your LAN.

    The "Web Usage" report based on the WebProxy, and therefore it shows only the traffic which goes through the WebProxy. Normaly the WAN traffic doesn't.

    You can hide single IP address from different reports. To hide the WAN address from the "Network Usage" report, add the IP to

    Report Settings -> Exceptions -> Reporting Exceptions: Network Accounting

    Jas Man

Unfiltered HTML