Network packets send and receive more on exchange server

Dear Experts,
We have MS Exchange  Server 2003 SP 2 on Windows server 2003 R2 SP 2,
mostly users microsoft exhange server option to configue outlook and some remote users they use POP3 settings,just i will give some breif information about our e-mail flow, if users sends e-mails to external it come to exchange and exchange forwards to our ISP mail server and from there it reach to external reciepients.incomming of e-mails from outside if some sends e-mail from out side it will comes to our SMTP Filtering server we are using Trend Micro IMSS Software after it filters our policy if it is legitimate e-mail it will forward exchange.
now we have issue on our exchange server , the network packets send and recieve is very high due to that our server gets hang and every time we have to restart the server than it will work for next 2 days
for your referene i attache the snapshot of Network status, and if you need any more information please let me know.please help us to resolve this issue.
exchange.JPG
LVL 5
thabashAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

shauncroucherCommented:
Check your queues are not full of SPAM, you may have an open relay or authenticated relay (where someone from outside has found username\password they can use to relay mail using your server).

Check on mxtoolbox.com --> queues that you are not blacklisted.

Use wireshark or network monitor 3.3 to see what traffic is occuring on your server network card.

Shaun
0
shauncroucherCommented:
Also make sure you have recipient filtering enabled and tarpitting configured.

See http://support.microsoft.com/default.aspx/kb/895853?p=1 and http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html
Shaun
0
thabashAuthor Commented:
Dear Shaun,
i checked the queues are not full of spam,in our Relay settings we allowed hole network 192.168.1.0 255.255.255.0 and ip address of our exchange is the correct way to allow the relaying,for your reference i attached the snapshot of relay settings.
i Check on mxtoolbox.com and our exchange external ip is not blacklisted.
we another smtp server which we are using for POP3 Users.on this server only SMTP Service enable and in isa server we published as smtp server.this server only we are using to send e-mail for POP3 Users.
so shall we remove from relay setting the network 192.168.1.0 255.255.255.0 and keep only our exchange server ip address and other 2 smtp servers ip.




exchange1.JPG
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

shauncroucherCommented:
it would be best to limit relay but you may have devices configured on lan that requires relay? use wireshark to see network activity - best thing you can do.

shaun
0
thabashAuthor Commented:
i dont know how to use the wireshark, and i downloaded it and i dont want to spend a lot of time studying it

pls let me know the steps i should do on the wireshark to know exactly where is my problem
0
shauncroucherCommented:
you just select network card and it will start scrolling through list of packets being sent or received. take a look and see if there are lots of smtp conversations being had? if so right click a smtp packet and right click and select follow tcp stream to see more of the smtp conversation.
this will give you a feel for 'realtime' activity on the server.

shaun
0
thabashAuthor Commented:
we are able to run wireshark software ,we caputred the network traffic and we didn't understand from where the traffic is generating,here i attached file captured file can you please check this file and let us know from where traffic is generating.please the extension from .txt to .pcap to open this file.
28-03-2010.txt
0
shauncroucherCommented:
You have captured on average 10packets per second, thats not huge.

I don't see any SMTP conversation happening at all in those 5 minutes so you aren't looking at a relay issue here or anything like that.

The traffic is mostly local ARP, STP, LDAP and a few normal broadcasts so nothing I can see that would show a problem.

When was the last time you rebooted your server? The count you have provided a picture for will keep incrementing until a reboot occurs. It may not be iindicative of a fault, but rather that the server has not been rebooted for a while.

Shaun
0
thabashAuthor Commented:
latest captured file.
0
thabashAuthor Commented:
we didn't restart the server since 3 days today we disable the network card and enabled,now i am capturing again i will send you updated capture file.
0
thabashAuthor Commented:
please find the attached updated captured file & snap shot send & receive packets.
networkexchg.JPG
Latest2.txt
0
shauncroucherCommented:
Do you see any problems on this connection? There are 18packets per sec on average with latest results.

Again, very little SMTP traffic

Shaun
0
thabashAuthor Commented:
here i attached the today (29-03-2010)captured file and network status snapshot,
currently we don't  see problem with this connection but after may be 1 day outlook stops working,
is the send and receive packets which shows is it normal or abnormal ?
29.03.2010.txt
29-03-2010.JPG
0
shauncroucherCommented:
I don't think it is abnormal, you have avg packets per second at around 10-20per second, thats within acceptable limits.

What happens with Outlook?

Shaun
0
thabashAuthor Commented:
just outlook gets hang when we do send and recieve and at taskbar it popups message retreving data from the server and that's it,even tried to restart the MS Exchnage information store service but it fails it gives message service didn't start in timely fashion and close.so i have to restart the server to restart the service and after restart outlook works fine.
0
shauncroucherCommented:
What size is th database? Any errors/warnings in the event log on the Exchange server?

Shaun
0
thabashAuthor Commented:
Database Size is 29.7 GB and some times these errors occured in eventlog , Event id:1194,1023,9665,2104
0
shauncroucherCommented:
What else is on the server? How much memory / CPU do you have?

Could you post the full event error messages, not just ID's.

Shaun
0
thabashAuthor Commented:
atatched to you the application log file
pls rename the ext to *.evt

for memory i have 4 gb, 2 dual core xeon processor (pls see the photo)

for installed application, there is nothing. only exchange server + CA backup client + normal sw
pls see the photo
app-03-04-2010.txt
exchange-memory.JPG
exch-prog.JPG
0
shauncroucherCommented:
Can you make sure that your anti virus software has the exchange database location excluded from on-access and any scheduled full scans.

Also ensure the server is completely up to date with Service Packs and any patches, both OS and Exchange.

Shaun
0
thabashAuthor Commented:
we are using Trend Micro Office scan 10.0 and exchange logs,Exchange Database and other exchange files excluded in Real Time scan and scheduled scan.
Windows server pack 2 with all windows security updates and exchange service pack 2.
0
thabashAuthor Commented:
Dear Shaun,
any thing else to check ?
0
shauncroucherCommented:
You might want to download the Exchange best practices analyser and run this, see if anything crops up?

Shaun
0
thabashAuthor Commented:
yes we run the Exchange best practices analyzer and it found 3 errors ,SystemPages' value is set too high ,3GB not set,'HeapDeCommitFreeBlockThreshold' not set and some other warnings,we followed the instructions and fixed errors now there are no errors,
but still sending packets are more than receiving.
0
thabashAuthor Commented:
seems its not s problem and this how it works
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Smartphone Programming

From novice to tech pro — start learning today.