site-to-site VPN: identify traffic

[Miyo360]

Hello. 

I have a site-to-site VPN setup between two MX's very far apart. Only the necessary VLAN's on both sides are configured to be a part of this S2S. I expect very little traffic; some occasional AD replication perhaps, but not much else. 

Yet my usage shows a steady throughput thoughout the day, even overnight. Is there a way to identify what traffic, or type of traffic is being sent/received, and by what clients?

Thanks

Michael.

[PhilipDAth]

Do a packet capture and see what it is.

[cmr]

Some of it will be the VPN handshaking traffic and if you have a Windows network there is often quite a bit of 'chat' between domain members.  If you go to the VPN status page you can see what traffic is using what link at each end and why, even if you only have one link.  This should help you identify at least some of it.

[GreenMan]

YOu could also set up Netflow to an appropriate collector for flow data:   https://documentation.meraki.com/MX/Monitoring_and_Reporting/NetFlow_Overview

I'd go with running some packet captures as a starter...

[Miyo360]

Thanks all for the suggestions. They are all useful suggestions. For now, I have setup NetFlow to our PRTG platform and will leave that running overnight to collect more data. 

[Eric-Fretz]

Does your MX licensing level give you access to "Traffic Analytics" ?  If so, click on "Network-wide" -> "Monitor" -> Traffic Analytics and see what has been on your network for the past few hours.  You should be able to sort by the traffic type with most traffic since the network throughput seems to be pretty consistent and will be much higher volume than the normal background noise on the network.

[Miyo360]

Thanks for the tip. Unfortunately I don't see the 'Traffic Analytics' menu under my network. Is it a requirement to have Meraki switches for this to show up? If so, this might explain it - we only have the MX's.

[GreenMan]

Yes - switches are needed for Traffic Analytics:   https://documentation.meraki.com/MS/Monitoring_and_Reporting/Switch_Traffic_Analytics

[PhilipDAth]

Negative.  You can also have traffic analytics with just an MX in the network.

Under network wide/general, set "Traffic Analysis" to "Detailed".

BUT, I don't think tihs will help with what i consuming traffic over a site to site VPN.  Do a packet capture since the traffic is there all the time.  Load into Wire Shark.  Ask for a top conversations reports.