SBS 2008 64 Bit causing excessive Internet traffic
|
From: SuperGumby [SBS MVP] on 12 Apr 2010 17:39 7GB is my 45 day 'allowance' and your attitude STINKS TO HIGH HEAVEN!!! "Leythos" <spam999free(a)rrohio.com> wrote in message news:MPG.262cf5e01c4adfb998a2c1(a)us.news.astraweb.com... > In article <1003C547-0A62-4845-9024-4F05D94FCC29(a)microsoft.com>, > mecerrato(a)discussions.microsoft.com says... >> >> I have a Windows 2008 small business server 64 bit edition which comes >> bundled with exchange server 2007 64 bit. Everything is working fine as >> far >> as resources, shares, AD, and Exchange. The problem is that the server >> is >> causing a lot of internet activity and is slowing internet access for >> everyone on the network (5 users) what could be causing the activity? I >> have >> a 6gb adsl cap which is just being chewed up by the server. I know it is >> the >> server because while the internet activity light is going crazy on my dsl >> router I have systematically unplugged each PC to see if the traffic >> stops. >> After disconnecting each PC the traffic was still there, once in >> unplugged >> the server 2008 from the netowrok the activity ceases immediatly. I have >> a >> hardware firewall and my router is using NAT with most ports closed >> except >> for the necessary ones (25, 110, etc...). I only have 5 to 7 users at >> any >> one time, not sure what to check for - please help >> >> Here is what i have already done: checked for virsuses, installed all >> updates and checked exchange queues >> >> Here is what I am running on the server: exchange 2007, symantec endpoint >> antivirus client, ORF spam filter (by VAMSOFT), DNS server, DHCP server > > 6GB is nothing, you should get a better service. > > Have you considered Windows Updates, Antivirus Updates, DNS queries, > WSUS updates, etc...? > > I can do 6GB in a single day, from just one workstation. > > -- > You can't trust your best friends, your five senses, only the little > voice inside you that most civilians don't even hear -- Listen to that. > Trust yourself. > spam999free(a)rrohio.com (remove 999 for proper email address)
From: Cliff Galiher - MVP on 12 Apr 2010 17:41 A couple of educated guesses and observations: Since you are asking and you mention NAT, I'm guessing you have a simple consumer-grade router at your network edge. This is insufficient in any business. Sure, it is one of my pet peeves, and I could write about how they are horrible from a security perspective, but I'm going to shove all that down for the moment and focus on YOUR problem. Business class devices log bandwidth use and traffic patterns. If you have a business-class device at your network's edge, you'd not need to unplug cables and rely on blinking lights to *guess* (and it is guessing, considering all machines generate traffic that would cause a light responsive enough to blink faster than the eye can see) which machines are using more than their fair share. You need to *know* what your network is doing, not guess based on cheap LEDs. Once you can see your bandwidth usage, you can view the lgos and see *why* it is being used. A machine is getting disconnects from Symantec every time it tries to download updates? Of course it is going to retry and that'll chew up bandwidth. A rogue workstation is infected with a bot and is sending mail via your Exchange server? That *looks* like your server burning all that traffic, but the server is just relaying mail (as it is configured to do) because a workstation is at fault. Since the workstation is not connecting to the net directly, that would only show up as LAN blinky LEDs. See why relying on blinky LEDs is more like soothsaying yet? In short, to be effective in any IT position, you have to be able to accurately monitor and control your network. That starts with having the right tools. Business-class firewall. Business-class router. Business-class monitoring. These can be separate appliances, but many times they are combined. Knowledge of Windows performance monitors, wireshark, and your software's control panels (Antivirus, Exchange management, etc) is also key to identifying problems once the tools above have helped you narrow the scope. I realize that my above answer probably doesn't seem helpful at first, but the point I'm trying to make is that you came here without enough information, and from the sounds of it, you don't have the abiity to *get* that information...which means our hands are tied trying to help you. Once you've resolved problems with your underlying infrastructure, solving specific sore points is much easier. -Cliff "mecerrato" <mecerrato(a)discussions.microsoft.com> wrote in message news:1003C547-0A62-4845-9024-4F05D94FCC29(a)microsoft.com... > I have a Windows 2008 small business server 64 bit edition which comes > bundled with exchange server 2007 64 bit. Everything is working fine as > far > as resources, shares, AD, and Exchange. The problem is that the server is > causing a lot of internet activity and is slowing internet access for > everyone on the network (5 users) what could be causing the activity? I > have > a 6gb adsl cap which is just being chewed up by the server. I know it is > the > server because while the internet activity light is going crazy on my dsl > router I have systematically unplugged each PC to see if the traffic > stops. > After disconnecting each PC the traffic was still there, once in unplugged > the server 2008 from the netowrok the activity ceases immediatly. I have > a > hardware firewall and my router is using NAT with most ports closed except > for the necessary ones (25, 110, etc...). I only have 5 to 7 users at any > one time, not sure what to check for - please help > > Here is what i have already done: checked for virsuses, installed all > updates and checked exchange queues > > Here is what I am running on the server: exchange 2007, symantec endpoint > antivirus client, ORF spam filter (by VAMSOFT), DNS server, DHCP server >
From: Jim Behning SBS MVP on 12 Apr 2010 18:08 You could install Wireshark on the server to see what it is doing. But start with Chris' idea. On Mon, 12 Apr 2010 15:41:20 -0600, "Cliff Galiher - MVP" <cgaliher(a)gmail.com> wrote: >A couple of educated guesses and observations: > >Since you are asking and you mention NAT, I'm guessing you have a simple >consumer-grade router at your network edge. This is insufficient in any >business. Sure, it is one of my pet peeves, and I could write about how >they are horrible from a security perspective, but I'm going to shove all >that down for the moment and focus on YOUR problem. Business class devices >log bandwidth use and traffic patterns. > >If you have a business-class device at your network's edge, you'd not need >to unplug cables and rely on blinking lights to *guess* (and it is guessing, >considering all machines generate traffic that would cause a light >responsive enough to blink faster than the eye can see) which machines are >using more than their fair share. You need to *know* what your network is >doing, not guess based on cheap LEDs. Once you can see your bandwidth >usage, you can view the lgos and see *why* it is being used. A machine is >getting disconnects from Symantec every time it tries to download updates? >Of course it is going to retry and that'll chew up bandwidth. A rogue >workstation is infected with a bot and is sending mail via your Exchange >server? That *looks* like your server burning all that traffic, but the >server is just relaying mail (as it is configured to do) because a >workstation is at fault. Since the workstation is not connecting to the net >directly, that would only show up as LAN blinky LEDs. See why relying on >blinky LEDs is more like soothsaying yet? > >In short, to be effective in any IT position, you have to be able to >accurately monitor and control your network. That starts with having the >right tools. Business-class firewall. Business-class router. >Business-class monitoring. These can be separate appliances, but many times >they are combined. Knowledge of Windows performance monitors, wireshark, >and your software's control panels (Antivirus, Exchange management, etc) is >also key to identifying problems once the tools above have helped you narrow >the scope. > >I realize that my above answer probably doesn't seem helpful at first, but >the point I'm trying to make is that you came here without enough >information, and from the sounds of it, you don't have the abiity to *get* >that information...which means our hands are tied trying to help you. Once >you've resolved problems with your underlying infrastructure, solving >specific sore points is much easier. > >-Cliff > > >"mecerrato" <mecerrato(a)discussions.microsoft.com> wrote in message >news:1003C547-0A62-4845-9024-4F05D94FCC29(a)microsoft.com... >> I have a Windows 2008 small business server 64 bit edition which comes >> bundled with exchange server 2007 64 bit. Everything is working fine as >> far >> as resources, shares, AD, and Exchange. The problem is that the server is >> causing a lot of internet activity and is slowing internet access for >> everyone on the network (5 users) what could be causing the activity? I >> have >> a 6gb adsl cap which is just being chewed up by the server. I know it is >> the >> server because while the internet activity light is going crazy on my dsl >> router I have systematically unplugged each PC to see if the traffic >> stops. >> After disconnecting each PC the traffic was still there, once in unplugged >> the server 2008 from the netowrok the activity ceases immediatly. I have >> a >> hardware firewall and my router is using NAT with most ports closed except >> for the necessary ones (25, 110, etc...). I only have 5 to 7 users at any >> one time, not sure what to check for - please help >> >> Here is what i have already done: checked for virsuses, installed all >> updates and checked exchange queues >> >> Here is what I am running on the server: exchange 2007, symantec endpoint >> antivirus client, ORF spam filter (by VAMSOFT), DNS server, DHCP server >> See what SBS support is working on http://blogs.technet.com/sbs/default.aspx Check your SBS with the SBS Best Practices Analyzer http://blogs.technet.com/sbs/archive/tags/BPA/default.aspx
From: Leythos on 12 Apr 2010 18:31 In article <#G6pkio2KHA.1016(a)TK2MSFTNGP02.phx.gbl>, not(a)your.nellie says... > > 7GB is my 45 day 'allowance' and your attitude STINKS TO HIGH HEAVEN!!! What? 6GB is nothing in many environments. Asking if he's considered all those things is 100% valid, as they often consume large amount so of bandwidth: Windows Updates, Antivirus Updates, DNS queries,WSUS updates.... How is my "Attitude" bad in that? -- You can't trust your best friends, your five senses, only the little voice inside you that most civilians don't even hear -- Listen to that. Trust yourself. spam999free(a)rrohio.com (remove 999 for proper email address)
From: Susan Bradley on 12 Apr 2010 19:04
Leythos wrote: > In article <#G6pkio2KHA.1016(a)TK2MSFTNGP02.phx.gbl>, not(a)your.nellie > says... > >> 7GB is my 45 day 'allowance' and your attitude STINKS TO HIGH HEAVEN!!! >> > > What? > > 6GB is nothing in many environments. > > Asking if he's considered all those things is 100% valid, as they often > consume large amount so of bandwidth: Windows Updates, Antivirus > Updates, DNS queries,WSUS updates.... > > How is my "Attitude" bad in that? > > It's unlimited bandwidth attitude not Australian metered. |