Lync 2010 - Huge bandwidth usage
We've come across an issue where our Lync clients are transferring about 500 MB of data going to and from our EWS server in a "normal" day. It's having a huge impact on our remote sites but we can't figure out what it is.
We use it for IM, Lync audio, desktop sharing. We only have internal users so no edge servers and we have no telephony integration.
Our remote users are in facilities connected via VPN. Each facility only has a T1.
For the sampling of users we have, their normal 8 hour day consists of 1-2 audio calls totalling at most 60 minutes and a few IM conversations. Desktop sharing is used rarely (and not in our testing) so I don't know what kind of impact that would have on the data. On average, our users have 30-35 contacts each.
Our address book files total about 85 KB and look to only update first thing in the morning so I don't think they're the culprit.
Our firewall is showing the data going across port 443 but netstat -b is showing different port numbers (i.e. 17795 and 17636 for Lync, there are others).
I need to figure out why so much data is being transferred and how we correct it.
I haven't had any luck searching and I'm hoping someone here can help.
TIA
ps Sorry if I have the wrong forum, wasn't sure where to post this
We use it for IM, Lync audio, desktop sharing. We only have internal users so no edge servers and we have no telephony integration.
Our remote users are in facilities connected via VPN. Each facility only has a T1.
For the sampling of users we have, their normal 8 hour day consists of 1-2 audio calls totalling at most 60 minutes and a few IM conversations. Desktop sharing is used rarely (and not in our testing) so I don't know what kind of impact that would have on the data. On average, our users have 30-35 contacts each.
Our address book files total about 85 KB and look to only update first thing in the morning so I don't think they're the culprit.
Our firewall is showing the data going across port 443 but netstat -b is showing different port numbers (i.e. 17795 and 17636 for Lync, there are others).
I need to figure out why so much data is being transferred and how we correct it.
I haven't had any luck searching and I'm hoping someone here can help.
TIA
ps Sorry if I have the wrong forum, wasn't sure where to post this
The port 443 is used only for Lync Server Web Compatibility service. Need some more information about your setup -Lync is installed in same exchange server ? What firewall you are using ? and how is your site to Site VPN setup ?
ASKER
Thanks for your reply.
We have our web server (EWS and OWA), Exchange and Lync each on their own box. All are Server 2008 R2, Exchange is version 2010.
Our firewalls are all Sonicwall units, I'll have to check the exact model when I get into the office.
For the VPNs, we have them setup on the firewalls site to site. Some of our travelling users have a VPN client on their notebooks but I have only tested with clients at our facilities at this point.
This only started two weeks ago but we haven't made any changes to any of the servers, firewalls, VPN or Lync policies in over two months.
We have our web server (EWS and OWA), Exchange and Lync each on their own box. All are Server 2008 R2, Exchange is version 2010.
Our firewalls are all Sonicwall units, I'll have to check the exact model when I get into the office.
For the VPNs, we have them setup on the firewalls site to site. Some of our travelling users have a VPN client on their notebooks but I have only tested with clients at our facilities at this point.
This only started two weeks ago but we haven't made any changes to any of the servers, firewalls, VPN or Lync policies in over two months.
Fine . Can you restrict the port 443 traffic from the lync server ip through the firwall and see everything is working properly. I don't think the 500 MB data transferred throgh port 443 is from Lync server.
ASKER
Hi Nave,
Unfortunately the clients are at production facilities so I can't change the firewall settings unless I can show them as the source of the problem.
If I run netstat -b on the test PC it shows me that communicator.exe (Lync) is using port xxxx for it's connection to our EWS server. Nothing else is using that port on the test PC.
On our firewall it shows that the Init PC is using the same xxxx port from the PC to the firewall and that the same connection is using port 443 from the firewall to the EWS server. It's this connection that is showing about 250 MB/day transmitted and about 250 MB/day received.
If we close Lync on the client PC then the connection on the firewall closes and the data transfer stops immediately.
I found an MS article that matches the symptoms but the suggested workaround doesn't seem to resolve the issue (I do see the Lync folders recreated in Outlook when I rename the existing folders but traffic doesn't appear to decrease). The article is http://support.microsoft.com/kb/2621846
I don't know enough about how Lync works to confirm it's the search folder request that's causing it but I'm pretty sure it's Lync that is the culprit. Perhaps the issue is on the client side rather than the server.
If I look at the Lync Configuration Information screen, everything appears to be correct and EWS shows the correct server information and shows a status of OK.
I'm not sure where to look next.
Cheers
Unfortunately the clients are at production facilities so I can't change the firewall settings unless I can show them as the source of the problem.
If I run netstat -b on the test PC it shows me that communicator.exe (Lync) is using port xxxx for it's connection to our EWS server. Nothing else is using that port on the test PC.
On our firewall it shows that the Init PC is using the same xxxx port from the PC to the firewall and that the same connection is using port 443 from the firewall to the EWS server. It's this connection that is showing about 250 MB/day transmitted and about 250 MB/day received.
If we close Lync on the client PC then the connection on the firewall closes and the data transfer stops immediately.
I found an MS article that matches the symptoms but the suggested workaround doesn't seem to resolve the issue (I do see the Lync folders recreated in Outlook when I rename the existing folders but traffic doesn't appear to decrease). The article is http://support.microsoft.com/kb/2621846
I don't know enough about how Lync works to confirm it's the search folder request that's causing it but I'm pretty sure it's Lync that is the culprit. Perhaps the issue is on the client side rather than the server.
If I look at the Lync Configuration Information screen, everything appears to be correct and EWS shows the correct server information and shows a status of OK.
I'm not sure where to look next.
Cheers
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Found solution ourselves