Thread Info
  • Replies 31 replies
  • Subscribers 14 subscribers
  • Views 22171 views
  • Users 0 members are here
Options
Suggested

Excessive Up2Date Traffic

AlatarK

Recently (2-3 days) I've noticed regular periodic spikes of Up2Date traffic. Checking the flow monitor, I see a 5-6MB/s spike tagged  Sophos UTM Upd2Date every 25 seconds. The total (in Top Clients by Application) was 142GB just yesterday.

There's nothing unusual in the Up2Date log. Checks every 15 minutes with the occasional new pattern successfully installed. Nothing in the IPS log either except regular DNS Amplification Attacks every few minutes, but those have been happening for months.

I can't really see any way to debug this from within the firewall. Do I have to put a monitor on the outside interface and run a packet capture?

Thanks as always for suggestions,

Paul

Parents

  • I am having the same issue. It started immediately after updating to  9.706-9. It downloads over 150GB of updates per day and make my internet unusable. Setting pattern updates to manual stops this but that is not a valid solution. Interestingly when set to manual update and the patterns are up to date it still gives you the option to download and install the same version. 

    This makes me think the automatic update is just downloading the same patterns over and over again.

    The added bonus is that since the update to 9.706-9 not a single email has been detected as spam.

    This has to be the most fubar release Sophos has ever let loose, and I have been using UTM since the early days of Astaro.

    Simon

Reply

  • I am having the same issue. It started immediately after updating to  9.706-9. It downloads over 150GB of updates per day and make my internet unusable. Setting pattern updates to manual stops this but that is not a valid solution. Interestingly when set to manual update and the patterns are up to date it still gives you the option to download and install the same version. 

    This makes me think the automatic update is just downloading the same patterns over and over again.

    The added bonus is that since the update to 9.706-9 not a single email has been detected as spam.

    This has to be the most fubar release Sophos has ever let loose, and I have been using UTM since the early days of Astaro.

    Simon

Children
Unfiltered HTML