You could always set a firewall rule to drop traffic to that Amazon address only from his address. You'll likely find out what broke or find that it was nothing that matters.
----- Original Message ----- From: Bill Prince To: [email protected] Sent: Monday, April 13, 2015 2:06 PM Subject: Re: [AFMUG] Amazon EC2 Reading about AWS EC2 (http://aws.amazon.com/ec2/), I don't get the impression that this is some sort of backup service. It looks like a compute service for lack of a better term. In any case, you'd think that the customer would know what they've signed up for, but in this case, the only thing the guy has that has any connection to "Amazon" is his Kindle. I don't think he's running his Kindle 24x7, and he has no clue. bp <part15sbs{at}gmail{dot}com> On 4/13/2015 11:54 AM, Glen Waldrop wrote: I'm not sure what the total was by the time they stopped it. I asked them about the upload, they told me and I told them what was going on and why their Internet was slow. A 200GB upload @ 1Mbps started every 24 hours never finishes. This system either didn't do incremental or never finished the initial upload to start incremental. It went on for months, then they *finally* took 200GB of personal pics out of their business computer and the upload takes about an hour now. ----- Original Message ----- From: Bill Prince To: [email protected] Sent: Monday, April 13, 2015 1:51 PM Subject: Re: [AFMUG] Amazon EC2 This is around 2.3 TB at this point. bp <part15sbs{at}gmail{dot}com> On 4/13/2015 11:49 AM, Glen Waldrop wrote: Could be like one of my customers. They had a online backup set to run every 24 hours. Well over 200GB of pictures. It never stopped. ----- Original Message ----- From: Bill Prince To: [email protected] Sent: Monday, April 13, 2015 1:10 PM Subject: Re: [AFMUG] Amazon EC2 I did a reverse name lookup, and they are all in the amazon cloud: 54.208.254.185 name = ec2-54-208-254-185.compute-1.amazonaws.com 54.174.193.49 name = ec2-54-174-193-49.compute-1.amazonaws.com 54.173.255.111 name = ec2-54-173-255-111.compute-1.amazonaws.com bp <part15sbs{at}gmail{dot}com> On 4/13/2015 10:37 AM, Ken Hohhof wrote: What port numbers? I have seen this with an infected router. The traffic was in and back out to Amazon cloud, as if it had been taken over for a proxy or something. Something else to look for is some Costco type security camera system with a cloud DVR. -----Original Message----- From: Bill Prince Sent: Monday, April 13, 2015 12:22 PM To: Motorola III Subject: [AFMUG] Amazon EC2 I was trouble shooting a problem on a connection this morning, and found that the client had three streams running to EC2 in the Amazon AWS cloud. It has been running for months, at a more-or-less constant upstream rate of about 300 Kbps per stream (all three streams together are less than 1 Mbps, but they are all constant, running 24x7 for at least the last 8 months). Is this a hijack of some sort? This particular customer is not sophisticated, and I can not imagine what sort of compute resource he might require. He barely knows how to boot up his computer.
