Hi Sophos Experts, we have an crazy Problem at one of our Customer. In the Network we have ICMPv6 Multicast flooding the Network. When this happens thousends of packeges flood the Network. On the Servers i see in the Task Manager that permanently an 7Mbit Network traffic exist. It is curious that this occurs only irregularly. And it begins at 17:30 when the users are closing time and go home. But not every day and not on weekend. This is the reason why i think it comes from an Client. We use an Sophos XG Firewall and Sophos Endpoint (Central with Intercept X) at the Customer. Is there an way to find out which Client sent so much packages into the Network? Or can we blog this kind of traffic? But it is LAN internal and is not going over the Gateway. Maybe with Synchronised Security? With Wireshark i found an MAC but the MAC is from an Notebook which was at this time not in the Company. Thanks for ideas to solve this Problem :-)
↧