In my home network I have a UniFi Dream Router connected to an EdgeRouter X. The UDR is not being used as designed - I'm using it as a combo WiFi access point and 4 port switch. It also runs my UniFi Network application to manage my other UniFi APs. It complains that it has no internet access, but still does the job I need it to do.
I'm seeing fairly consistent 1Mbps traffic being generated by the UDR. I say it's generated by the UDR because when I look at the ethernet ports and connected WiFi devices I can't see it coming from anywhere - I can see it going out the port connected to the EdgeRouter X, and on the EdgeRouter I can see it coming in from the UDR but I can't see where it goes from there - it's into my main Cisco switch and mixed with all my other traffic.
I was hoping to be able to identify it by turning on Traffic Analysis on ERX, but I see nothing at all. I suspect because the ERX is not routing - it's configured as a switch? Similarly, when I ssh into the ERX and run tcpdump, I only see the broadcast and multicast traffic from the UDR - I can't see anything that might be this 1Mbps.
As I was typing this I thought maybe it's the UniFi Network application updating the browser page I have open to it all the time so I closed that and it made no difference.
Any suggestions what this traffic might be or suggestions for how to identify it?
I've been using various versions of keepass for ever. Until recently I had the database on Google drive. It's now local and sync'd with syncthing. It's a bit "different", but once you get used to it, it works very well.