How does FWA know sent traffic from received?
How does FWA know Sent traffic from Received?
Below is the Received statistics from FWA. I would have thought it would just show hosts on the Internal 192.168.0.0/24 subnet but it shows a lot of External IPs too
eg 203.3.166.2, 120.16.182.128, 120.17.204.227,120.17.57.83 etc
I defined Intranet settings in 'Settings' by listing 192.168.0.0/24 as the Intranet of the ASA and it didn't help.
Any ideas of how I can sort out the Received traffic to not include uploads to external addresses?
Host Hits% Hits Bytes Rvd MB %MB Rvd
192.168.0.104 2358 3.01 154.08 10.56
192.168.0.162 6925 8.83 83.32 5.71
192.168.0.109 2837 3.62 68.87 4.72
124.254.75.197 4329 5.52 68.75 4.71
mailserver 481 0.61 60.42 4.14
192.168.0.116 2162 2.76 58.27 3.99
192.168.0.253 13 0.02 39.38 2.7
moss1 602 0.77 35.62 2.44
192.168.0.101 1014 1.29 34.46 2.36
192.168.0.7 990 1.26 33.77 2.31
iscala 301 0.38 33.72 2.31
192.168.0.1 11 0.01 33.57 2.3
192.168.0.2 3 0 33.55 2.3
192.168.0.3 3 0 33.55 2.3
192.168.0.15 2 0 33.55 2.3
192.168.0.64 1631 2.08 30.39 2.08
120.16.21.52 1071 1.36 26.17 1.79
192.168.0.129 1572 2 24.45 1.68
192.168.0.123 1066 1.36 23.18 1.59
120.17.18.18 1569 2 21.88 1.5
220.245.242.55 1289 1.64 21.42 1.47
192.168.0.72 1783 2.27 20.76 1.42
192.168.0.80 724 0.92 19.16 1.31
122.106.183.229 492 0.63 17.08 1.17
192.168.0.242 635 0.81 16.98 1.16
120.17.190.242 734 0.94 16.93 1.16
192.168.0.122 1302 1.66 16.15 1.11
81.208.114.19 250 0.32 15.52 1.06
120.17.109.238 110 0.14 15.05 1.03
192.168.0.106 696 0.89 14.73 1.01
203.3.166.2 39 0.05 14.66 1
192.168.0.81 805 1.03 14.19 0.97
192.168.0.85 2873 3.66 13.32 0.91
192.168.0.82 60 0.08 12.21 0.84
192.168.0.207 1074 1.37 11.69 0.8
120.16.182.128 76 0.1 11.17 0.77
120.17.204.227 92 0.12 11.15 0.76
120.17.57.83 318 0.4 11.15 0.76
Below is the Received statistics from FWA. I would have thought it would just show hosts on the Internal 192.168.0.0/24 subnet but it shows a lot of External IPs too
eg 203.3.166.2, 120.16.182.128, 120.17.204.227,120.17.57.83 etc
I defined Intranet settings in 'Settings' by listing 192.168.0.0/24 as the Intranet of the ASA and it didn't help.
Any ideas of how I can sort out the Received traffic to not include uploads to external addresses?
Host Hits% Hits Bytes Rvd MB %MB Rvd
192.168.0.104 2358 3.01 154.08 10.56
192.168.0.162 6925 8.83 83.32 5.71
192.168.0.109 2837 3.62 68.87 4.72
124.254.75.197 4329 5.52 68.75 4.71
mailserver 481 0.61 60.42 4.14
192.168.0.116 2162 2.76 58.27 3.99
192.168.0.253 13 0.02 39.38 2.7
moss1 602 0.77 35.62 2.44
192.168.0.101 1014 1.29 34.46 2.36
192.168.0.7 990 1.26 33.77 2.31
iscala 301 0.38 33.72 2.31
192.168.0.1 11 0.01 33.57 2.3
192.168.0.2 3 0 33.55 2.3
192.168.0.3 3 0 33.55 2.3
192.168.0.15 2 0 33.55 2.3
192.168.0.64 1631 2.08 30.39 2.08
120.16.21.52 1071 1.36 26.17 1.79
192.168.0.129 1572 2 24.45 1.68
192.168.0.123 1066 1.36 23.18 1.59
120.17.18.18 1569 2 21.88 1.5
220.245.242.55 1289 1.64 21.42 1.47
192.168.0.72 1783 2.27 20.76 1.42
192.168.0.80 724 0.92 19.16 1.31
122.106.183.229 492 0.63 17.08 1.17
192.168.0.242 635 0.81 16.98 1.16
120.17.190.242 734 0.94 16.93 1.16
192.168.0.122 1302 1.66 16.15 1.11
81.208.114.19 250 0.32 15.52 1.06
120.17.109.238 110 0.14 15.05 1.03
192.168.0.106 696 0.89 14.73 1.01
203.3.166.2 39 0.05 14.66 1
192.168.0.81 805 1.03 14.19 0.97
192.168.0.85 2873 3.66 13.32 0.91
192.168.0.82 60 0.08 12.21 0.84
192.168.0.207 1074 1.37 11.69 0.8
120.16.182.128 76 0.1 11.17 0.77
120.17.204.227 92 0.12 11.15 0.76
120.17.57.83 318 0.4 11.15 0.76