Paul Picazo

Probably a couple months ago I noticed that my bandwidth (using the 95th percentile measurement) was creeping up towards my account's upper limit (1 megabit), I didn't think much of it. But it quickly became clear that I would exceed my limit before the end of the month and even capping my boxes well below the limit didn't seem to have any noticeable effect. I sent an email to my colo's sales staff, and being a loyal customer was offered an upgrade (double the bandwidth) at no charge for committing to a year of service.

Doubling my bandwidth should have solved all my problems, but it continued to creep up faster until i was closing in on 2 megabits. I became a bit worried, suddenly the 100 megabit pipe to the internet was not my friend anymore.

I was out of easy options, so I decided to find out which pieces of my network were hogging the bandwidth. I setup Wireshark using a mirror of my switch's port to the outside world. I let it log for about a day, and then took a look. After a quick look I was shocked to see SIP packets that had neither a source or destination on my network were being piped in to my switch and being counted towards my allocation, so I sent an email to the colo NOC and quickly received a response confirming it and stating that they would take action immediately.

Now I'm back down to 77 kilobytes/sec 95th, and almost depressed that I don't get enough traffic to even warrant using pngcrush on the above image.