I suspect we have an application that's horribly written and using way more bandwidth than it should. The vendor is pushing back, so I need some definitive logging.
On the UTM, the bandwidth usage screen shows that this user has already used 10.4 GB today on port 54047. The vendor swears they don't use that port. I want to compare what the user is doing with the bandwidth usage. How do I create a log that shows the time, the user (or source ip), the quantity of data and the destination IP?
This thread was automatically locked due to age.
