net traffic

Hi Aresh,

Greetings.

Top Client will give you report for the total traffic consumed by internal clients through UTM. Alongside, Top Server will give you report for the incoming server traffic.

Please note that the labels IN and OUT for traffic may vary depending on the point of view. When running in proxy mode, the client connects to port 8080 on UTM, so data sent by the client (the request) is seen as incoming traffic and the data sent to the client (the response) is seen as outgoing traffic on the internal interface.

The total traffic the daily report reflects is the total consumption of data IN and OUT.

As of now, there is no provision to check the data consumption individually i.e., IN and OUT separately.

Hope that helps:)

Thanks

Sachin Gurung

Hi Sachin,

Thank you for explaining the net usage,

I really like to know how network usage works. We are an hosting company, security and data usage is very important to us. As security point of view we are very happy with the utm.

You said "Top Client will give you report for the total traffic consumed by internal clients through UTM"

But when we check the top clients I can see the external IP of one of our customers that access our FTP server to upload daily data to our FTP server!! I also see more external IP's that thier destnation is to the servers at our LAN.

Also I dont undrestand the network usage of the NICs in daily Reports,

The report shows the Total trafiic is 45.8GB, but when I check the graphs of all the NICs I dont understand how Sophos comeup with this number, this is my graph of a daily report:

Total eth0 (LAN):57.95

Total eth1 (WAN): 23.99

Total eth 3: 2.53

is there some good documantion on this subject?

Another way to think of it is to consider that the client makes requests and the server responds.  So, you can have servers and clients both internally and externally.

Cheers - Bob

Hi Bob,

Thank you as alwyay for your reply,

Any idea why in the report the totaal net traffic is not the same as totaal intern en extern traffice?

Thanks

Without a picture, I'm not sure to which items you're referring, Aresh.  Maybe the following will help - when a client goes to Google, the browser sends packets to the Internal interface where they are counted as incoming, when the packets are sent to Google, they are counted as outgoing from the External interface, thus appearing to count the traffic twice.  Was that your question?

Cheers - Bob

Hi Bob,

Thank you for the reply,

Your explanation regarding the double couning is helpful.

I upload the graph of yesterday daliy report, why the traffice processed said 24.4 gb? how utm come to this number?

the report says:

network usage:

Traffic process: 24..4 Gb

eth0(lan): 30.45 gb

eth1(wan) : 15.80

eth3: 2.42

Hi Aresh,

I checked the screenshots you shared. I am unable to figure out where did you discovered traffice processed said 24.4 Gb ?

Thanks

Sachin Gurung

Hi Sachin,

Thank you for the update,

I see the 24.4 in the same daily Report that see the graphs:

If you like I can send you the that daily Report

Hi Aresh,

Yes, please share it!

Thanks

Sachin Gurung

Hi Sachin,

Please let me know if I can mail it to you, because it has information that we dont want to become public.

Thanks