This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Flow monitor inconsistencies between interfaces

DanielBarnes over 8 years ago

I was using flow monitor to try and identify traffic going over our internet link.

eth0 is wan, eth1 is lan.

I was monitoring some traffic in flow control,

I opened eth0 in flow control, and then opened eth1.

I viewed some HD youtube videos for about 5 minutes then checked to see if I could find the result.

One interface identifies some traffic as Soundcloud, and the other identifies around the same amount of traffic ~190mb as youtube:

Has anyone else seen this behaviour before? Is it simply the UTM misidentifying the traffic as Soundcloud?

Cheers

This thread was automatically locked due to age.

Parents

0 IgnacioRubial over 8 years ago

I have the same problem. UTM 9 takes Youtube as Soundcloud.
Cancel
Vote Up 0 Vote Down

Cancel
0 DanielBarnes over 8 years ago in reply to IgnacioRubial

Glad to know I am not alone!
This is just the traffic I have noticed is misidentified, and I havn't looked very hard. What else could also be misidentified?

This issue has prevented our company from using any Application based traffic control and throttling. I don't have enough trust in the Application identification to start limiting and throttling users traffic based on it...
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 DanielBarnes over 8 years ago in reply to IgnacioRubial

Glad to know I am not alone!
This is just the traffic I have noticed is misidentified, and I havn't looked very hard. What else could also be misidentified?

This issue has prevented our company from using any Application based traffic control and throttling. I don't have enough trust in the Application identification to start limiting and throttling users traffic based on it...
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 IgnacioRubial over 8 years ago in reply to DanielBarnes

I haven't identified other mistaken traffic, but now my entire report module just stopped working.....im waiting for the supports technicians to connect to my UTM
Cancel
Vote Up 0 Vote Down

Cancel
0 sachingurung over 8 years ago in reply to IgnacioRubial

Hi,

Please provide me the Case# in support. I want to followup on this issue.

Thanks

Sachin Gurung
Team Lead | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 8 years ago in reply to DanielBarnes

Daniel, most applications are correctly recognized, and avoiding making rules for those that you're not confidant of is easily done.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 IgnacioRubial over 8 years ago in reply to sachingurung

The support team repair my report module, but the youtube = soundcloud issue remains
Cancel
Vote Up 0 Vote Down

Cancel
0 sachingurung over 8 years ago in reply to IgnacioRubial

Hi,

Sounds great that support has a fix to this. As per my observation, there is traffic that is incorrectly recognized as SoundCloud. I want to check what TS steps did support took to resolve the categorization issue. Alongside, I will speak to the development team over this matter.

Thanks

Sachin Gurung
Team Lead | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel