What caused a huge amount network traffic via SSH?Intranet over SSHHow can I automate pulling files via putty's psftp?Debugging the VMware virtual network adapter vmxnet3 — packets received by the adapter never make it to that port's listenerHow to design the server access which allows ssh, ftp, db access, svn accessWhy isn't my SSH tunnel working?Copying over SSH via Putty tools is slower than via WinSCPNetwork error: Software caused connection abort (SSH & FTP) due to IP ban?Network error: Software caused connection abort(SSH)Connection reset/closed by server after SSH2_MSG_KEXINIT sent in SSHUnable to connect to ports via Linux but can with Windows
Why is it easier to balance a non-moving bike standing up than sitting down?
A word for delight at someone else's failure?
Why isn't my calculation that we should be able to see the sun well beyond the observable universe valid?
Can I enter the UK for 24 hours from a Schengen area, holding an Indian passport?
Greeting with "Ho"
"Correct me if I'm wrong"
What does it cost to buy a tavern?
What is the "ls" directory in my home directory?
Why does independence imply zero correlation?
What is the meaning of "понаехать"?
Why don't countries like Japan just print more money?
Has anyone come across the word 畸端?
Drawing a second weapon as part of an attack?
What are the current battlegrounds for people’s “rights” in the UK?
King or Queen-Which piece is which?
Is there official documentation on directories like ~/.config and ~/.cache?
Is there a way to build an app that can be used by people that don't have Salesforce?
Is there a difference between an NFC and RFID chip?
Designing a magic-compatible polearm
Counterfeit checks were created for my account. How does this type of fraud work?
Helping ease my back pain by studying 13 hours everyday , even weekends
Novel in which alien (Martian?) is trapped on Earth in prehistory
Subtract the Folded Matrix
Is "Busen" just the area between the breasts?
What caused a huge amount network traffic via SSH?
Intranet over SSHHow can I automate pulling files via putty's psftp?Debugging the VMware virtual network adapter vmxnet3 — packets received by the adapter never make it to that port's listenerHow to design the server access which allows ssh, ftp, db access, svn accessWhy isn't my SSH tunnel working?Copying over SSH via Putty tools is slower than via WinSCPNetwork error: Software caused connection abort (SSH & FTP) due to IP ban?Network error: Software caused connection abort(SSH)Connection reset/closed by server after SSH2_MSG_KEXINIT sent in SSHUnable to connect to ports via Linux but can with Windows
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.
There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.
Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.
While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.
I have a whole host of questions about this but right now I'll settle for:
- What could have caused this?
- Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?
- Has anyone ever had this happen to them at all?
Any clues gratefully received.
windows ssh ubuntu-18.04 winscp
asked Jun 3 at 13:13
CodePointCodePoint
946
|
show 7 more comments
I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.
There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.
Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.
While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.
I have a whole host of questions about this but right now I'll settle for:
- What could have caused this?
- Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?
- Has anyone ever had this happen to them at all?
Any clues gratefully received.
windows ssh ubuntu-18.04 winscp
asked Jun 3 at 13:13
CodePointCodePoint
946
3
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
2
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
1
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
1
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
1
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13
|
show 7 more comments
I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.
There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.
Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.
While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.
I have a whole host of questions about this but right now I'll settle for:
- What could have caused this?
- Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?
- Has anyone ever had this happen to them at all?
Any clues gratefully received.
windows ssh ubuntu-18.04 winscp
asked Jun 3 at 13:13
CodePointCodePoint
946
I have a virtual server running Ubuntu 18.04 from a well known hosting company. This morning our Fortigate Firewall logs shows that my Win10 computer transferred 3.5TB to and 6.5TB from my virtual server over 13 hours (over last night) via SSH.
There are a couple of issues with this; First we know the figures quoted by the Fortigate Firewall are not correct, because a) the connection speed isn't fast enough able to do this over that time period, perhaps a 10th of the required speed, and b) the VPS logs show that it received 35GB and sent 65GB... many times less than the Fortigate reports.
And secondly the only things that were open using SSH were Putty and WinSCP. Putty wasn't doing anything, and the bash history shows the only commands were related to starting and stopping Kestrel (dot net core server), it was doing nothing else. WinSCP wasn't doing anything either as far as I can tell. I'd moved a few folders around during the day.
Nothing came up with a virus scan on my local machine, there wasn't anything awry in the server logs, and the server has no third party packages other than the Microsoft .net core repos set up.
While the boss is OK that nothing sinister was going on I am not happy that something has ocurred that I can't even begin to answer.
I have a whole host of questions about this but right now I'll settle for:
- What could have caused this?
- Could it just have been an issue with the Fortigate as we know it's mis-reported the data transfer, or perhaps WinSCP in a loop?
- Has anyone ever had this happen to them at all?
Any clues gratefully received.
windows ssh ubuntu-18.04 winscp
windows ssh ubuntu-18.04 winscp
asked Jun 3 at 13:13
CodePointCodePoint
946
asked Jun 3 at 13:13
CodePointCodePoint
946
edited Jun 3 at 13:19
CodePoint
asked Jun 3 at 13:13
CodePointCodePoint
946
asked Jun 3 at 13:13
CodePointCodePoint
946
asked Jun 3 at 13:13
CodePointCodePoint
946
946
3
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
2
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
1
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
1
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
1
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13
|
show 7 more comments
3
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
2
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
1
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
1
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
1
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13
3
3
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
2
2
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
1
1
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
1
1
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
1
1
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13
|
show 7 more comments
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f969936%2fwhat-caused-a-huge-amount-network-traffic-via-ssh%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f969936%2fwhat-caused-a-huge-amount-network-traffic-via-ssh%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
Check with your VPS provider and see if they can verify the amount of traffic from your IP address as a sanity check.
– Tim Brigham
Jun 3 at 13:18
2
If you don't have authority to investigate the firewall, then there's very little more you can do at this point, but pass it on to whoever does have that authority.
– Michael Hampton♦
Jun 3 at 14:52
1
@CodePoint One of my (very) wild guesses was that something was sending some data that compressed very well, and the firewall reported the size before compression. Now, the numbers are too perfect for that and also it would probably have to be your firewall sending the data (unless it's set up to MITM SSH?), but I'm writing it just in case..
– Tomasz Zieliński
Jun 3 at 15:37
1
@CodePoint A quick search shows that Fortinet can do that, but that's beyond my expertise, so to speak. But even in case even if it can't MITM SSH (or is not configured to do so) it can send a lot of data to your VPS if only there's a bug or misconfiguration (and things happen..). But I admit it's just a total speculation on my part, and as Michael Hampton wrote above someone needs to investigate the firewall to say anything for sure..
– Tomasz Zieliński
Jun 3 at 16:11
1
@TomaszZieliński Thank you for your input. At least I've got some where to start looking now.
– CodePoint
Jun 3 at 16:13