Hi Experts & Friends,
I need your help in letting me know how to troubleshoot the Bandwidth choke issue. Internet has become very very slow today. By entering the "show interface" command I am seeing the RX Load as 255/255. However TX load is 6/255, Reliability as 255/255. I know tx load & Reliability in this case is very normal.
Since RX Load is very abnormal here i used "route cache flow" to find out the traffic passing thru my interfaces. I found my Internet proxy server (220.127.116.11) is making this traffic.But i am unable to find out wherther all the traffic i am seeing orginated from 18.104.22.168 are legitimate internet traffic or some DoS attack
I am worried to block /Disconnect the said Proxy server from the LAN as it is the gateway for all my users internet traffic
How to troubleshoot this issue safely
thanks in advance
The first step is to find out what's causing the traffic. If it's incoming traffic, it can be someone transmitting a lot of traffic from user traffic or a virus. You need to enable netflow on the outside interface ingress (ip flow ingress). I don't know what type router you have, but try this:
on your PUBLIC interface:
ip flow ingress
Then let it run for a few seconds, then look at the results:
sh ip flow top-talkers
It will show you the source and destination addresses. You shouldn't have any source and destination as the same. After you see what the incoming traffic source is, try to find out where it's going. If it's going to your proxy server, then try to correlate the proxy server to an address on the inside. I don't manage proxy servers so I can't help you there unfortunately, but I'm sure that there are log files stating destination addresses somewhere on the server. If you don't find anything, you may just try to block the source in an ACL. You shouldn't be seeing your proxy server as an incoming connection on the public side unless you enabled netflow in the wrong direction or the wrong interface. Then you'd see source being the proxy server to an outside destination.
** Edit ** I forgot to ask. Are you seeing the load on your LAN or WAN interface?