Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 399
  • Last Modified:

MS Exchange 2003/Server 2003 - Pulling large amounts of data from Internet

Hi Experts.  I have a MS Exchange Server 2003 on Server 2003nthat is pulling about 500MB an hour from the internet even when there is no mail coming in.   If I reboot the server the problem goes away for about 3 to 4 hours then starts again.   I have virus scanned (Symantec and Eset)  and scanned with malwarebytes but nothing shows up.   I've used Wireshark to try and see packet details but theres nothing unusual.   Anyone got any ideas?
0
PNRT
Asked:
PNRT
  • 4
  • 3
  • 2
2 Solutions
 
Tony GiangrecoCommented:
Check to see if any servers or Pc's are downloading updates like Adobe, Microsoft, RealPlayer, Apple.. There must be someting causing that traffic.

Check to see what ports are getting the most hits.
0
 
PNRTAuthor Commented:
I've narrowed it down to this one server and have moved everything else on to other lines.  This is the only thing that now goes out through that line.  I've also disabled updates.
0
 
DLeaverCommented:
Wire shark is the best tool for getting to the bottom of this, you must be able to see a consistent source from the output....

Are you running this on the server?
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
PNRTAuthor Commented:
No, I was running it on the network.   I'll try it on the server
0
 
DLeaverCommented:
Yes that would be better

Alternatively, depending on your switches, you can set up a monitoring port and run the wires hark from your laptop

If you want more details on that setup then let me know
0
 
PNRTAuthor Commented:
That would be apprecaited, thanks.  In the meantime I'll start with wireshark on the server
0
 
Tony GiangrecoCommented:
Is that server a DC?

Is it just replicating?

What apps are loaded that may pull down periodic updates?

Do any users have access to it that may be downloading or uploading files to their user share?
0
 
PNRTAuthor Commented:
Hi
Yes it is a DC
There should be no other connectivity other than the local network (except for mail of course)
No other apps other than AV and Exchange
No users have access to this server
Thanks for the reply
0
 
Tony GiangrecoCommented:
You might want to run this script. It generates a report of mail sent and received. With the weekend and holiday, their might have been a ton of email that caused this situation.

http://gallery.technet.microsoft.com/scriptcenter/bb94b422-eb9e-4c53-a454-f7da6ddfb5d6
0

Featured Post

Granular recovery for Microsoft Exchange

With Veeam Explorer for Microsoft Exchange you can choose the Exchange Servers and restore points you’re interested in, and Veeam Explorer will present the contents of those mailbox stores for browsing, searching and exporting.

  • 4
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now