Small Business Server Eating Bandwidth

A client has a SBS 2008 server on a small network with two other pc's (most of the guys work remotely). They have been reaching their 50gb monthly bandwidth by half way through - for the last 4 years they never reached their bandwidth. I had a quick process of elimination and watched the stats on their router and mb's downloaded when i unplugged the newtork cable for the server. It stabilised. When i plugged it back in again the bandwidth started getting hammered again. I'd like some recommendations for tools to install so that i can get some visibility on what is being downloaded. I had a look at wireshark but digesting the information in this context is challenging. I essentially want to find out what is being downloaded and by what service or program. I used netstat but can't see how much mb's each process is responsible for downloading.
Who is Participating?
borkiConnect With a Mentor Commented:
I can think of two approaches: See if your router has support for Syslog or get a router that provides you with this information.

The other tool to use is SysInternals TCPView, it should show you what is going on on the server.

Have you looked at WSUS and what updates are being downloaded there? Even so, it should not consume 50GB / month or 10 GB in a week.

Good luck
I would rather recommend you do a good, proper AV scan on your server to eliminate that part of the issue.

Any chance they are doing mailshoot or anything like that as that would affect bandwidth usage on the server too.
Lee W, MVPTechnology and Business Process AdvisorCommented:
I'd suggest checking the Performance Tab in Task manager and clicking on the Resource Monitor button.  Then look at what, exactly, is using the network.
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

A few suggestions.

1. Install Microsoft Network Monitor on the server. Just filter for content going to the router.
2. Use Sysinternals Process Explorer. It has a TCP/IP tab once you've double clicked a process.
3. Use Sysinternals Process Monitor. It allows you see what network traffic is occuring.

PixelVoodooAuthor Commented:
Thanks for the replies, i'd already done a full av scan that came back clean. There have been no mailshots or any other unusual activity by staff. The task manager suggestion and reviewing processes does give rudimentary info but none with regards to how much traffic each process is creating. I had a look at TCPView which did give some further info with regards to edgetransport.exe. I ended up using wireshark to see if i could get any further info on exchange given the edgetransport.exe info from TCPView and saw that their exchange server was using a pop3 connector - one mailbox was generating a lot of traffic and when i had a look at that there were quite a few large emails which for some reason the pop3 connector was trying to download even although it should really have skipped them due to the size. The event log then shone some further light on this. I've deleted the suspect emails from the pop3 mailbox via webmail and ran the pop3 connector to pull the emails down whilst running wireshark again and so far the mailbox in question is acting as should and without additional network traffic. I'll be monitoring the situation and if the issue is resolved i'll accept solutions, else will be back to see if any other suggestions. Thanks for your input.
PixelVoodooAuthor Commented:
Wireshark really got me to the bottom of this issue but TCPView sent me in the right direction, so awarding points to that solution. Thanks for your help folks
PixelVoodooAuthor Commented:
TCPView sent me in the right direction but didn't give me all the info required to resolve the issue
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.