unknown Source Consuming bandwidth

[Dyop_Geop]

May I ask, what could be this “viewpaulbusinezs.no-ip.org (0.0.0.0)” mentioned in the screenshot below? In the screenshot also is the configuration of the widget for your reference. How can I trace what is this or who is this?

[Dyop_Geop]

AFTER2 :

[Dave_Hall]

Hi Dyop. Your final screenshot of TOP users doesn' t appear to be sorted by anything meaningful, but I assume it is sorted by session count, which doesn' t appear to be added to the visible columns. If some device on your network is gobbing up bandwidth you will want to sort the list by Bytes Sent/Received. (Your first screenshot shows the device in question as using up one session anyway.)

[Dyop_Geop]

ORIGINAL: Dave Hall Hi Dyop. Your final screenshot of TOP users doesn' t appear to be sorted by anything meaningful, but I assume it is sorted by session count, which doesn' t appear to be added to the visible columns. If some device on your network is gobbing up bandwidth you will want to sort the list by Bytes Sent/Received. (Your first screenshot shows the device in question as using up one session anyway.)

Hi Sir Dave, Thanks for the response. I' ve attached how this is sorted, this is sorted by Bytes. I also agree that the previous screenshots doesn' t help at all. hahaha. I dunno if this snip will also help. Anyway, I' m just showing you guys what I see. I can' t seem to isolate the problem. or I can' t find what causes this paulbussines blah blah to show in top sources.

[Dave_Hall]

I' m using firmware 5.0.9 but your Top Sessions (or Top users) list should look something similar to this...

[netmin]

After testing a bit further I can find ways to create/show 0.0.0.0->255.255.255.255 traffic. However, it won' t disappear when changing filters or views. Also, without bending a DNS server it does not resolve by reverse lookup to an fqdn and not by DNS forward lookup caching to any name (and it should not). This does not happen regardless of secondary addresses, hostnames looking like ip addresses or vips listening on 0.0.0.0. I didn' t try to duplicate MAC addresses on the network though. So maybe you are experiencing a bug (what FortiOS version are you using?). You should also do reverse DNS lookups from an internal PC (using the same DNS service as your FGT) to 0.0.0.0, to your VIP(s)/external IP address(es) to determine what your DNS service actually returns for each of them. Wireshark & Co might help to determine where this traffic originates on the port1 network.