I’ve recently noticed some unusual spikes in outbound traffic on one of our client’s networks, particularly around late evening hours. It’s raised some red flags about potential data exfiltration. Has anyone else encountered similar patterns or have suggestions on tools to monitor this type of traffic more effectively?
I’ve seen similar spikes in outbound traffic late at night too. One thing that helped us was implementing some flow analysis tools, like ntop, which provided clearer insights into traffic patterns. Have you looked into using something like that yet?
Those late evening spikes are so frustrating; it really makes you wonder what’s going on; have you considered setting up alerts for unusual traffic thresholds? It might help you catch any odd behavior in real-time.