Traffic Data Discrepancy in SoftEther VPN Server?
Posted: Mon Apr 14, 2025 5:18 pm
Hi All.
Today, my very first day of use of SoftEther VPN Server, essentially a day of some test and only one real user connected, I've noticed a significant discrepancy in the traffic data displayed in my SoftEther VPN Server Manager that's causing security concerns. As shown in the attached screenshot, the server reports 368,358,199,207 bytes (368 GB) of data transferred, which seems abnormally high for our limited usage pattern.
Observed Issue:
- Server reports 368 GB of transfer bytes
- Only a few employees have connected, with minimal actual usage
- One employee connected for a few hours, plus myself for testing only
Analysis of VPN Logs:
I've analyzed the session logs for today, which show:
- SID-ONE-24: ~160 MB out + ~75 MB in
- SID-TWO-27: ~220 MB out + ~32 MB in
- SID-THREE-11: ~88 MB out + ~43 MB in
- SID-FOUR-30: ~61 MB out + ~12 MB in
The total traffic from logs sums to approximately 300 MB, nowhere near the 368 GB displayed in the screenshot.
Possible Explanations?
1. Could this be a unit display error showing GB instead of MB?
2. Potential server misconfiguration causing traffic to be counted incorrectly?
3. Security concern: Is there unauthorized access occurring outside logged sessions?
I'm particularly concerned about potential security implications if this traffic data is accurate.
Has anyone encountered similar issues or can provide guidance on determining the source of this discrepancy?
Thank you for any assistance.
Marco
Today, my very first day of use of SoftEther VPN Server, essentially a day of some test and only one real user connected, I've noticed a significant discrepancy in the traffic data displayed in my SoftEther VPN Server Manager that's causing security concerns. As shown in the attached screenshot, the server reports 368,358,199,207 bytes (368 GB) of data transferred, which seems abnormally high for our limited usage pattern.
Observed Issue:
- Server reports 368 GB of transfer bytes
- Only a few employees have connected, with minimal actual usage
- One employee connected for a few hours, plus myself for testing only
Analysis of VPN Logs:
I've analyzed the session logs for today, which show:
- SID-ONE-24: ~160 MB out + ~75 MB in
- SID-TWO-27: ~220 MB out + ~32 MB in
- SID-THREE-11: ~88 MB out + ~43 MB in
- SID-FOUR-30: ~61 MB out + ~12 MB in
The total traffic from logs sums to approximately 300 MB, nowhere near the 368 GB displayed in the screenshot.
Possible Explanations?
1. Could this be a unit display error showing GB instead of MB?
2. Potential server misconfiguration causing traffic to be counted incorrectly?
3. Security concern: Is there unauthorized access occurring outside logged sessions?
I'm particularly concerned about potential security implications if this traffic data is accurate.
Has anyone encountered similar issues or can provide guidance on determining the source of this discrepancy?
Thank you for any assistance.
Marco