Bandwidth usage by IP address-foreign IP?

[jjtbt]

I have 3 Sonicwalls...2 are communicating to our main building via VPN. When checking the "Bandwidth usage by IP address" on the 2 remote sonicwalls, there is a foreign ip address that is using some bandwidth on each. There are a couple other strange IP's, but I'm not concerned about them because they are using 0.00mb of bandwidth. However, this one particular IP address is showing up on both sonicwalls and using at the moment 10mb of bandwidth on one and 8mb on the other. Would this most likely indicate they are somehow hacking into the VPN?

 

[joepc]

Is it a public IP or a local IP?

 

[jjtbt]

It is a public IP address: 213.35.101.4

I've tried changing the encryption key on all 3 sonicwalls for the VPN and restarted them, but it immediately shows up again.

 

[joepc]

Are you licensed for viewpoint? If so you could look a little further and see what ports it is using and where it is going and so forth.

You can also set a rule to block it. What OS are you running?

 

[jjtbt]

Unfortunately we are not licensed for Viewpoint currently...but we may have to invest in it soon if I can't block this IP.

I did try a rule: "Deny", "Any Service" from WAN source 213.35.101.0-213.35.101.255 to Destination "*", but that didn't seem to help.

So this morning, I put in 2 rules in each sonicwall: "Deny", "Any Service" from Source 213.35.101.0-213.35.101.255 to Destination "*" and "Deny", "Any Service" from Source "*" to Destination 213.35.101.0-213.35.101.255.

It hasn't shown up yet, but I won't know until later in the day if this helped.

 

[jjtbt]

The extra rules I entered yesterday seem to have stopped this IP from showing up as using any bandwidth, so "case-closed"...