Sophos Firewall

Discussions find out who caused traffic peak some minutes ago

Sophos Firewall requires membership for participation - click to join

Thread Info

State Suggested Answer
Locked Locked
Replies 5 replies
Answers 1 answer
Subscribers 38 subscribers
Views 1093 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

find out who caused traffic peak some minutes ago

LHerzog over 3 years ago

Hello,

it seems to be an impossible task to find out who caused this peak in bandwith usage.

Please correct me if I'm wrong and tell me how.

I have an idea about the cause but others may have not.

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 3 years ago +1 suggested

Try CFR (Central Firewall Reporting). Should be an easy task to get this done.

Parents

0 LuCar Toni over 3 years ago

Try CFR (Central Firewall Reporting). Should be an easy task to get this done.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 LuCar Toni over 3 years ago

Try CFR (Central Firewall Reporting). Should be an easy task to get this done.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 LHerzog over 3 years ago in reply to LuCar Toni

Thank for your suggestion with Central Management Logging LuCar Toni.

So it "should" work in Central.

Before I try and find out it does not provide the desired log - can you please confirm that you can find out who (user or IP) caused a traffic peak that has just stopped and is no longer ongoing?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to LHerzog

You have 7 Days data for free in Central. So actually, if you have enable this feature, you can simply try this request.

Yes you can. Central gives you the option to filter what ever log you want.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 3 years ago in reply to LuCar Toni

Hi,

so it's not possible to confirm that specific example?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to LHerzog

You can filter to bytes, you can filter to application, you can filter to port and interface and date/time.

So actually this should be possible.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel