We help IT Professionals succeed at work.

Exchange server clogging bandwidth

econn31 asked
Our exchange server is accessing our internal DNS server about 1000 times a second to get name resolutions. Our internal DNS then turns to the external DNS to do the lookups (if the names aren't in our local DNS). This is clogging up our network. Denying our DNS server access to external DNS, means we lose mail  all together, but we do get the internet back. Does anyone know how to go into the exchange server and find what users are sending so much mail at a time? (I suspect there is a virus) I just want to see what user is causing all the traffic so i can disable that account (if that's what's going on).

Thanks, Eric
Watch Question

Top Expert 2011
You can freeze your queues on Exchange and then see the mail build up, then drill down into the queue and see who the sender is.  Then you can decide if you have a problem user or a problem computer with an unwelcome visitor : )
Open up Exchange System Manager, expand down to the queues, then right-click on a queue or two and freeze them.  If you send all mail out via a smart-host, then there will only be one queue to freeze.
Top Expert 2010

What firewall do you currently utilize?  They can typically indicate if there is a single host with several connections to the Internet.  Syslog data from your firewall could as well.

Also, if you have that much email going out, you could look at the SMTP queue on the Exchange server to see who the originator is of the email.  I'm sure if there is that much going out, then it's getting backed up in the queue.


Hey Thanks! I found the que and it is huge - it seems a virus has started to send a whole lot of spam from our server! I disabled outgoing mail temp (and we get our bandwidth back). I'm still having trouble pin pointing the source of the spam however. It says source is default SMTP server, but i can't seem to find the email address that is sending everything? Any suggestions as to how i can find the problem client?

Thanks again
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.