by evansit » Sat Oct 27, 2012 10:22 am
We just noticed the same thing . We were installing a new firewall and noticed a HUGE amount of UDP traffic from one of our internal ip addresses.
When we took a closer look we saw hundreds close to 800 UDP connections attached to the QNAP 259.
There has never and is not a route into that machine through the firewall, so we could not figure out what could be reaching it. It was not until we created the firewall rule to explicitly block connections from the WAN to this box that we realized the QNAP was initiaiting the connection !! Wrote another rule to not allow the QNAP to reach the WAN interface and the traffic stopped what we do notice now is hundreds of UDP connections banging against our firewall.
I have to jump on a different machine to post the network results. But we without a doubt proved that the QNAP was making these connections. Now for the really strange piece we only use it for file storage, ALL of the other features and applications are disabled on the box . I double checked and then had someone else check my work. Also all of the traffic was against just one of the two interfaces on this box , we added firewall rules to block both but there was never any traffic on the second NIC.
The impact to our bandwidth was in a word.. HUGE .
The only thing this box is supposed to access the internet for is updates which it is up to date.