Otdfbt

Why is it easier to balance a non-moving bike standing up than sitting down?

A word for delight at someone else's failure?

Why isn't my calculation that we should be able to see the sun well beyond the observable universe valid?

Can I enter the UK for 24 hours from a Schengen area, holding an Indian passport?

Greeting with "Ho"

"Correct me if I'm wrong"

What does it cost to buy a tavern?

What is the "ls" directory in my home directory?

Why does independence imply zero correlation?

What is the meaning of "понаехать"?

Why don't countries like Japan just print more money?

Has anyone come across the word 畸端?

Drawing a second weapon as part of an attack?

What are the current battlegrounds for people’s “rights” in the UK?

King or Queen-Which piece is which?

Is there official documentation on directories like ~/.config and ~/.cache?

Is there a way to build an app that can be used by people that don't have Salesforce?

Is there a difference between an NFC and RFID chip?

Designing a magic-compatible polearm

Counterfeit checks were created for my account. How does this type of fraud work?

Helping ease my back pain by studying 13 hours everyday , even weekends

Novel in which alien (Martian?) is trapped on Earth in prehistory

Subtract the Folded Matrix

Is "Busen" just the area between the breasts?

What caused a huge amount network traffic via SSH?

Intranet over SSHHow can I automate pulling files via putty's psftp?Debugging the VMware virtual network adapter vmxnet3 — packets received by the adapter never make it to that port's listenerHow to design the server access which allows ssh, ftp, db access, svn accessWhy isn't my SSH tunnel working?Copying over SSH via Putty tools is slower than via WinSCPNetwork error: Software caused connection abort (SSH & FTP) due to IP ban?Network error: Software caused connection abort(SSH)Connection reset/closed by server after SSH2_MSG_KEXINIT sent in SSHUnable to connect to ports via Linux but can with Windows

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

6

1

I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.

There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.

Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.

While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.

I have a whole host of questions about this but right now I'll settle for:

• What could have caused this?


• Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?


• Has anyone ever had this happen to them at all?

Any clues gratefully received.

windows ssh ubuntu-18.04 winscp

share|improve this question

edited Jun 3 at 13:19

CodePoint

asked Jun 3 at 13:13

CodePointCodePoint

946

• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
  
  – Tim Brigham
  Jun 3 at 13:18
  

  
  
  
  


• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
  
  – Michael Hampton♦
  Jun 3 at 14:52
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
  
  – Tomasz Zieliński
  Jun 3 at 15:37
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
  
  – Tomasz Zieliński
  Jun 3 at 16:11
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
  
  – CodePoint
  Jun 3 at 16:13
  

  
  
  
  

 | 
show 7 more comments

6

1

I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.

There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.

Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.

While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.

I have a whole host of questions about this but right now I'll settle for:

• What could have caused this?


• Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?


• Has anyone ever had this happen to them at all?

Any clues gratefully received.

windows ssh ubuntu-18.04 winscp

share|improve this question

edited Jun 3 at 13:19

CodePoint

asked Jun 3 at 13:13

CodePointCodePoint

946

• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
  
  – Tim Brigham
  Jun 3 at 13:18
  

  
  
  
  


• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
  
  – Michael Hampton♦
  Jun 3 at 14:52
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
  
  – Tomasz Zieliński
  Jun 3 at 15:37
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
  
  – Tomasz Zieliński
  Jun 3 at 16:11
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
  
  – CodePoint
  Jun 3 at 16:13
  

  
  
  
  

 | 
show 7 more comments

I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.

There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.

Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.

While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.

I have a whole host of questions about this but right now I'll settle for:

• What could have caused this?


• Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?


• Has anyone ever had this happen to them at all?

Any clues gratefully received.

windows ssh ubuntu-18.04 winscp

share|improve this question

edited Jun 3 at 13:19

CodePoint

asked Jun 3 at 13:13

CodePointCodePoint

946

share|improve this question

edited Jun 3 at 13:19

CodePoint

asked Jun 3 at 13:13

CodePointCodePoint

946

share|improve this question

edited Jun 3 at 13:19

CodePoint

asked Jun 3 at 13:13

CodePointCodePoint

946

asked Jun 3 at 13:13

CodePointCodePoint

946

asked Jun 3 at 13:13

CodePointCodePoint

946