Interpret this netflow graph

[vortmax]

My company is running several CMTS's (cable modem head ends) at different properties around the US. We feed in a T1 connection through a firewall then into the CMTS which dishes out the service to the residents. We've been having bandwidth issues at one property, so I set up SNMP monitoring and pulled this graph off from last night

Green is inbound and the blue line is outbound. How do you all read this? I'm seeing a DOS attack between 6 and 8, but am not sure what to make of the elevated outbound traffic later on. Any thoughts?

 

[brianinms]

Thats not a DOS, you are merely running out of bandwidth. How many people do you have behind the t1?

 

[vortmax]

There are only 27 people behind the T1 and they are capped to:

I just double checked the QOS settings and it appears they were reset to the defaults:

10 Mbps down
2 Mbps up

Which I guess would explain running out of bandwidth.

Still don't understand why the outbound traffic would so much higher then the inbound for most of the day.

 

[LawnBoy]

Are you sure you've got the inbound and outbound set from the end users' perspective?



"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes

 

[vortmax]

Yea. Those are the subscriber QOS settings in the CMTS, so that's what is being applied to each cable modem that syncs with the CMTS.

 

[2ffat]

Is there some action on their machines that occur at this time, maybe a batch transfer, back up, etc?


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]

 

[vortmax]

no, this isn't a buisness network. It's a residential cable network. So there is a very high probability that at least one computer on the network is infected with something. We do have it firewalled, which blocks a lot of stuff, but it is mostly in place to keep the CMTS and other head end equipment safe.

 

[oisnds]

The timeline is pretty defined, I would look for an automated download or update process.

 

[Roadki11]

Probably some guy sharing mp3s on bittorrent or kaza or some other p2p application.