I don't know what the explanation is. I'll try to find out.
The probes from Switzerland were noticeable but not enough to explain all the difference in traffic that you are seeing.
There is also a lot of SIP probing going on. It doesn't account for all the increase in traffic either.
No, I don't have a tool to tell me what the increased traffic is. Perhaps I'll have to write one.
Mostly I look at the usage statistics, the firewall counters, and the graphs that are on the web site. I find out a lot by capturing traffic and looking at it by eye. I've only been looking at UDP traffic so far today. - Brian
On Mon, Jul 03, 2017 at 11:03:33AM +0000, R P wrote:
So if the storm Stopped what is the explain for the raise of the inbound denied traffic noise (first graph) from about 15MB/S to about 35MB/S ? May it be the Swiss probe ? do you have any kind of tool to check or all have to be done by looking into the logs ? Ronen - 4Z4ZQ