• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 379
  • Last Modified:

Exchange 2003 SP2 High Bandwidth Use

We had our Exchange 2003 SP setup for quite a while now. Everything worked just fine until a few days ago. All of a sudden our Internet speeds started to drop very fast. I started up a network monitor (by PRTG) and ran the monitor with Exchange Information Store service running and without. With Exchange running the bandwidth is maxing out. With Exchange off the bandwidth runs normal.

Any suggestions?
0
datzent83
Asked:
datzent83
  • 20
  • 16
1 Solution
 
Alan HardistyCo-OwnerCommented:
Block TCP port 25 outbound on your firewall / router and then see what is sitting in your queues.

You might have a user who has sent large emails or you my be an authenticated relay / open relay and sending out spam.

Anything interesting in your queues?

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2556-Why-are-my-outbound-queues-filling-up-with-mail-I-didn't-send.html
0
 
datzent83Author Commented:
My queues are completely empty. There is no activity on Exchange at all at the moment.
0
 
datzent83Author Commented:
I stopped the SMPT service with no chance. I, again, stopped MS Info Store and again the bandwidth went nuts.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Alan HardistyCo-OwnerCommented:
Did you block port 25 outbound as I suggested?

Stopping the SMTP service means you can't see the queues.

Any mail being sent by the server doesn't show up in the queues.  Stopping port 25 from the server outbound means Exchange stops sending and the queues will fill up if there is anything being sent.
0
 
datzent83Author Commented:
Blocked port 25 from my FireWall. Will test and post back.
0
 
Alan HardistyCo-OwnerCommented:
Thanks.
0
 
datzent83Author Commented:
Blocking port 25 seems to have stopped the high bandwidth use. All Exchange services are running. However, Exchange queue is still empty.
0
 
Alan HardistyCo-OwnerCommented:
Okay - so is port 25 blocked just for the IP of the Exchange server or all internal IP's?

Is your IP popping up on any blacklists?

www.mxtoolbox.com/blacklists.aspx / www.blacklistalert.org
0
 
datzent83Author Commented:
Its blocked from the hardware FireWall (WatchGuard). We are not using the built in SBS FireWall.

MXToolbox.com came back clean for the domain name and IP address.
0
 
Alan HardistyCo-OwnerCommented:
Okay - but is it blocked for all IP's inside your LAN or did you just block the internal IP of your server?
0
 
datzent83Author Commented:
In the FireWall Outgoing Traffic I blocked port 25 only for the server's IP address. All the internal IP addresses are open to port 25.
0
 
Alan HardistyCo-OwnerCommented:
Okay - thanks.  Just as a side note, it would be safer to block port 25 outbound for all internal IP's apart from the server.

Do you normally send mail via a smarthost or via DNS?
0
 
datzent83Author Commented:
I send email from the DNS. We do not use a smarthost.
0
 
Alan HardistyCo-OwnerCommented:
Okay - now I am confused.

So are you outbound queues still empty?
0
 
datzent83Author Commented:
Yep, still empty.
0
 
datzent83Author Commented:
Here is a screenshot.
Capture.JPG
0
 
datzent83Author Commented:
I think I am missing something. I just sent an email through Exchange and it went through. I was also able to reply to it, which also came through.
0
 
Alan HardistyCo-OwnerCommented:
Okay.  Strange to say the least.

Can you log traffic outbound on your firewall for port 25?  If you can, please enable the logging, then open up port 25 for the server and check the logs.
0
 
Alan HardistyCo-OwnerCommented:
Eh?  Very odd.
0
 
datzent83Author Commented:
I am enabeling outbound log for port 25 now.
0
 
datzent83Author Commented:
Logs on the FireWall do not show anything for port 25.
0
 
Alan HardistyCo-OwnerCommented:
Okay - is your bandwidth being chewed up again?
0
 
datzent83Author Commented:
No... Its been steady ever since I blocked port 25 on the WatchGuard FireWall.
0
 
Alan HardistyCo-OwnerCommented:
Good - so what has changed?

If you blocked the port and now have opened it again and the traffic has not gone crazy again - something presumably has changed?
0
 
datzent83Author Commented:
Port 25 is still blocked from the FireWall.
0
 
Alan HardistyCo-OwnerCommented:
Blocked for what?
0
 
datzent83Author Commented:
Outgoing.
0
 
Alan HardistyCo-OwnerCommented:
Okay - I asked you to log port 25 outbound and then open the port.  Did you not do that?
0
 
datzent83Author Commented:
I just opened it. Lets see what the logs say.
0
 
datzent83Author Commented:
I am stumped! Outgoing port 25 enabled. Logs are clear of port 25. Bandwidth is steady.
0
 
datzent83Author Commented:
Outgoing port 25 opened*
0
 
Alan HardistyCo-OwnerCommented:
Well that's good and bad!

I would suggest monitoring it for 24 hours to see what, if anything, happens and at least if the bandwidth does increase, and it seems to be port 25 outbound, then you should be able to examine the logs to see the source / destination.

Of course if it suddenly starts going crazy, then I'm never too far away to assist.
0
 
datzent83Author Commented:
Thanks! I will monitor it until tomorrow evening and post back the results.
0
 
Alan HardistyCo-OwnerCommented:
Might also be worth logging all outbound traffic on the firewall in case it isn't port 25.

What anti-spam are you using on the server?  Does it have good logs?  Wondering if you are being hammered externally as it doesn't seem to be an issue outbound with SMTP traffic.
0
 
datzent83Author Commented:
Does SBS have any good port monitoring utilities?

I am using VIPRE Security for Exchange. Not sure if it had logging though.
0
 
Alan HardistyCo-OwnerCommented:
Nothing in SBS that I am aware of and I don't know VIPRE (yet).

You can download Wireshark and capture some traffic when your bandwidth is going crazy, assuming that it does again.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell┬« is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 20
  • 16
Tackle projects and never again get stuck behind a technical roadblock.
Join Now