<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="https://community.sophos.com/cfs-file/__key/system/syndication/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/"><channel><title>Understand network use</title><link>https://community.sophos.com/utm-firewall/f/utm-managed-endpoint/98815/understand-network-use</link><description>Hello, 
 I am currently analyzing the traffic of my network and I am not understanding this: 
 In the report by network use always guided me from the WAN interface. Is this fine? 
 According to the WAN report, my greatest use of bandwidth is in upload</description><dc:language>en-US</dc:language><generator>Telligent Community 12</generator><item><title>RE: Understand network use</title><link>https://community.sophos.com/thread/358959?ContentTypeID=1</link><pubDate>Wed, 13 Dec 2017 03:54:50 GMT</pubDate><guid isPermaLink="false">4be5eb7d-caa4-4ff5-8e60-8f9463545a35:1d4a21c8-fef1-491d-93f8-3d76ef6fc85a</guid><dc:creator>lna</dc:creator><description>&lt;p&gt;Hi Gerardo,&lt;/p&gt;
&lt;p&gt;first thing to mention is that the Table Heads in Bandwith Usage Report are a little bit missleading&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Numbers 4, 6, 8, 10&lt;/p&gt;
&lt;p&gt;are TOTAL Numbers not some average or peak value&lt;/p&gt;
&lt;p&gt;the %-Character is a new column&lt;/p&gt;
&lt;p&gt;therefore 5,7,9,11&lt;/p&gt;
&lt;p&gt;are percent values and show how many percent of traffic this line mades compared to the rest of the table.&lt;/p&gt;
&lt;p&gt;&lt;a href="/cfs-file/__key/communityserver-discussions-components-files/59/pastedimage1513157345508v1.png"&gt;&lt;img src="/resized-image/__size/320x240/__key/communityserver-discussions-components-files/59/pastedimage1513157345508v1.png" alt=" " /&gt;&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;IN=WAN to LAN&lt;/p&gt;
&lt;p&gt;OUT=LAN to WAN&lt;/p&gt;
&lt;p&gt;WAN=interfaces with default gateway&lt;/p&gt;
&lt;p&gt;LAN=all other interfaces&lt;/p&gt;
&lt;p&gt;5 refers to 4 (Percent IN)&lt;/p&gt;
&lt;p&gt;7 refers to 6 (Percent OUT)&lt;/p&gt;
&lt;p&gt;9 refers to 8 (Percent TOTAL (IN+OUT))&lt;/p&gt;
&lt;p&gt;11 refers to 10 (Percent Connections)&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;[quote user=&amp;quot;gerardo josic rodriguez paredes&amp;quot;]I do not understand why I have 29 GB of download and 1.5 GB of upload if in the network use report it indicates that I am using 6 Mbps in a stable way and the upload speed is totally unstable.[/quote]&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;6 MBps throughput 11 Hours Runtime ~= 29GB&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Your Network Usage Diagram is kind of confusing - let me interpret:&lt;/p&gt;
&lt;p&gt;i assume your Interfaces are labled correct&lt;/p&gt;
&lt;p&gt;timeframe is 19:30 to 11:25&lt;/p&gt;
&lt;p&gt;WAN Interface (eth1):&lt;/p&gt;
&lt;p&gt;nearly no inbound Traffic (quite rare for WAN Links if they are used for websurfing, only common if this wan link is only used to publish your Servers)&lt;/p&gt;
&lt;p&gt;lot of outbound Traffic (6Mbps)&lt;/p&gt;
&lt;p&gt;LAN Interface (eth0):&lt;/p&gt;
&lt;p&gt;Same ammount of inbound Traffic as outbound on WAN (6MBps)&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;do you have any internal client who use a NAT or WAF published Service hosted on an external IP which original destination resides in a DMZ connected to an internal Port which is not eth0?&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Yours Lukas&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item></channel></rss>