We help IT Professionals succeed at work.
Get Started

New install of SBS 2008 continuously downloads 2.5GB per day (WSUS disabled)

1,170 Views
Last Modified: 2013-12-07
Hi All, My first EE post. So be gentle.

I installed my first SBS 2008 server a few weeks ago, and since the install the server has been downloading approx 2.5GB per day (100MB per hour). My first thought was WSUS so I disabled the WSUS Download Service - but the downloading continued.

I have no idea what is doing it and why. It is chewing through my monthly download limit and I am hitting my 35GB cap half way through the month. I purchased a 20GB data block to buy me some more time to figure out what the heck was going on, but just hit that too. 55GB of downloads this month and climbing.

Weird thing is, the data is not being written to anywhere. I.e. my hard drives are not filling up at all.

So I installed wireshark and noticed continual traffic of a similar sort throughout every hour of every day. But I am not clever enough to figure out exactly what it is, where it is coming from, or more importantly how to stop it.

Below is a series of 6 packets which is 2 groups of a series of 3 packets that Wireshark is capturing over and over and over again:

I will type in the column headings, the may not line up, but you should be able to figure it out...

Size | Time | Source | Destination | Protocol | Information | Number
======================================================
54 | 57.169983 | 192.168.1.2 | 150.101.98.79 | TCP | 56403 > http [ACK] Seq=1 Ack=3481993 Win=16685 Len=0 | 3999
======================================================
1466 | 57.174653 | 150.101.98.79 | 192.168.1.2 | HTTP | Continuation or non-HTTP traffic | 4000
======================================================
1466 | 57.179092 | 150.101.98.79 | 192.168.1.2 | HTTP | Continuation or non-HTTP traffic | 4001
======================================================
54 | 57.179107 | 192.168.1.2 | 150.101.98.79 | TCP | 56403 > http [ACK] Seq=1 Ack=3484817 Win=16685 Len=0 | 4002
======================================================
1466 | 57.174653 | 150.101.98.79 | 192.168.1.2 | HTTP | Continuation or non-HTTP traffic | 4003
======================================================
1466 | 57.179092 | 150.101.98.79 | 192.168.1.2 | HTTP | Continuation or non-HTTP traffic | 4004

I did a lookup on the 150.101.98.79 address and it seems to be some sort of Proxy for the Akamai network of servers.

That is about all the info I can think of for now. If you have any questions, please ask and I will respond as soon as possible.

Thanks in advance!

Mark
Comment
Watch Question
This problem has been solved!
Unlock 1 Answer and 12 Comments.
See Answer
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE