How to find the culprit? Upload Use is Sky High

[Livin]

I went WAY over my normal Internet Allocation this month with a week to go... that never happened, or even close, before.

So, no my ASUS AC68U, I turned on traffic monitoring and fond my Synology NAS is sending a ton of data somewhere. In the past 24hrs alone I downloaded 12GB but uploaded 48GB.
... and this includes backing up 2 windows PCs so the download size is totally normal. Upload should be in the 3GB range given due to some file/doc viewing & music/video streaming on my LAN... definitely not anywhere near 48GB.


Using Darkstat (ntop), I found ports causing the traffic problem:

this host
445 microsoft-ds
In 16,061,606
Out 67,542,663
total 83,604,269

remote hosts
49231
In 67,542,663
Out 16,061,606
total 83,604,269

An external port scan (from the Internet) of the firewall shows both ports closed.

How do I find out exactly what is causing the uploads from the NAS?

thank you!

 

[NetworkError]

Getting useful information from an asus router ? Ya right ... I threw my AC87R in the trash last week. Upgraded to a linksys 1900ACS and installed Untangle NG. Someone farts on the network now and im gettin emails on how it smelt

 

[degrub]

is SMB V1 running on the NAS ?
There were additional hacks of synology in the wild if i remember correctly.
Do you allow remote access to the NAS ? \
just some ideas.

 

[Livin]

is SMB V1 running on the NAS ?
There were additional hacks of synology in the wild if i remember correctly.
Do you allow remote access to the NAS ? \
just some ideas.

SMB2 and Large MTU is enabled

 

[Cake]

Getting useful information from an asus router ? Ya right ... I threw my AC87R in the trash last week. Upgraded to a linksys 1900ACS and installed Untangle NG. Someone farts on the network now and im gettin emails on how it smelt

wait, so trend micro was of no real use? lol

 

[CaptainSTX]

Are you sure the upload traffic was real? I run a complicated network with two other routers double NATed behind my AC1900P. I also run VLANs on a couple of the routers.

The point being that when I enabled NAT acceleration some of my SlingBox traffic which was on a different subnet than the AC1900P and a VPN was reported as upload traffic even though the traffic was not passing out of my home just going from one LAN to another LAN

In looking at my traffic on my ISPs useage meter the uploads were not showing up there since the traffic was not passing through my modem and onto the ISP's network.

Turned off NAT acceleration, which didn't seem to have an impact on upload/download speeds, and misclassified traffic disappeared. With the router's CPU involved in routing traffic it is reported correctly. With NAT acceleration on and the CPU not involved some LAN to LAN traffice was misclassified as LAN to WAN traffic.