High network activity on one of my IP cams. Should I be concerned?

[Cljs]

I have 6 IP cams on my LAN, managed by a Ubiquiti USG 3P/Cloud Key router and running a Blue Iris server on my PC.

One of my IP cams has high network traffic that I can see on the Unifi console, showing typically 3-5 Mbps 'network traffic' continuously. It is an old Hikvision DS-2CD2342WD-I, firmware V5.3.8 build 151224. Other cams, including other Hikvisions and Dahuas are only showing 20 bps or so.

Is this a sign of a problem? What is this high network traffic indicating?

I do intend to make a separate VLAN for the cameras on my network to isolate any security problems that might occur, am reading and watching instructional videos on that currently.

 

[wittaj]

Could that camera have a higher MP and bitrate and CBR and FPS than the other cameras?

 

[Cljs]

I don't think it's very different. Specs are 4 MP, etc

https://www.securityinformed.com/hikvision-ds-2cd2342wd-i-ip-camera-technical-details.html

The difference in network traffic magnitude is nearly 1000 times higher.

 

[SpacemanSpiff]

where is the traffic going?

 

[Cljs]

where is the traffic going?

I don't know, how could I find out? I am not very sophisticated about this obviously...

 

[Cljs]

I don't know, how could I find out? I am not very sophisticated about this obviously...

OK, I just did a 'deep packet inspection' on my network homepage and it says traffic is to 'Unknown'

 

[Sparkey]

OK, I just did a 'deep packet inspection' on my network homepage and it says traffic is to 'Unknown'

Be afraid, be very afraid.

 

[Mike A.]

Not necessarily afraid but there should be somewhere that Unifi shows you the active connections. Don't know it well enough to tell you where to look.

 

[SpacemanSpiff]

Similar to @Mike A., I am not Ubiquiti USG savvy. I would like to think it offers the options to see which device on your LAN is talking, and who it is talking to. Hopefully the ubiquity fans here will chime in.

 

[Cljs]

OK, I figured it out.

The cam in question gets quite a bit more activity than the other ones, and the traffic is it sending video clips back to the server PC.

I don't know how to distinguish between traffic within the network and traffic in and out of then network, I am sure there is a way, but in this scenario it must be intranet traffic and nothing going to China or wherever.

 

[TechieTech]

Check the destination IP of the traffic.

192.168.0.0 to 192.168.255.255,
10.0.0.0 to 10.255.255.255,
and
172.16.0.0 to 172.32.255.255
are all private IPs not routable over the open Internet.