SBS 2011 downloading 10-15GB per day.

So I tried to isolate which PC was using the bandwidth, and basically shut them all down, and its still a problem.  I have disabled the VPN and FTP, and constant download spikes continue all day.

This has gone on for 2 months, but the weird thing is sometimes it starts at 8 am and goes until 4:30pm, other times its 24 hours a day.

The server has no exchange on it, only Microsoft Dynamics and the network has 10PCs and 8 VPNs and a server 2012 terminal server (which I have shut down, and downloading continued).

Whats the best way to determine the culprit?  I have included a file showing the ISPs monitoring of the usage.
savethehumansAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
Try CommView (tamos.com) which is a Packet Sniffer. It can show bytes transferred for a given IP address and port name amongst other things.

It is not free, but not expensive and probably will do what you need. I use it myself.

WireShark is free but not as comprehensive as CommView. It may do what you need also, but I do not use WireShark.

... Thinkpads_User
0
Emmanuel AdebayoGlobal Windows Infrastructure Engineer - ConsultantCommented:
Check to ensure that no application is schedule to be running from the task scheduler.

Do you do a backup to another location or you are replicating files to another server in another location?

You will need to install bandwith and network usage monitoring as highlighted by thinkpads_users

You might want to try
http://www.paessler.com/packet_sniffing
http://www.paessler.com/bandwidth_monitoring
http://www.paessler.com/server_monitoring_software

You have a small network, you can use the software for 10 sensors for free with full functionality
0
Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
Start with the basics:

1. Run netstat -aon and see what connections are active (it will give you the IP and the port number)
2. Run wireshark and take a capture
3. Ensure anti-virus is enabled, updated and there are no malwares on the server
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

savethehumansAuthor Commented:
This is what I pulled from a couple of minutes of WS

wireshark
0
JohnBusiness Consultant (Owner)Commented:
You want to re-capture and see if you can separate the data by IP address. CommView does that by default (which is why I like it).

.... Thinkpads_User
0
Larry Struckmeyer MVPCommented:
First thought is to check the settings in WSUS and or stop its services.  Then examine Task Man to see what is running, and lastly use Windirstat or TreeSizePro to see what file locations are expanding at the rate you describe.

Is there any corresponding upload?
0
savethehumansAuthor Commented:
Could this be caused from the server IP being 192.168.1.2, and with all the VPNs, regardless of if they are set to remote gateway?
0
savethehumansAuthor Commented:
I have ran comm view, and it shows almost nothing consuming bandwidth, yet my ISP is showing 10mb a minutes through the day.
0
JohnBusiness Consultant (Owner)Commented:
In CommView, in the Latest IP Connection tab, number of bytes is over on the right side. I am sure you have seen that.

Now click on the logging tab, set up logging and log for 30 minutes.

Check the log and then ask your ISP what is going on.

If your modem or modem/router from the ISP includes a wireless component, someone may be accessing your internet without attaching to your network.

... Thinkpads_User
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JohnBusiness Consultant (Owner)Commented:
@savethehumans - Thanks, and I was happy to help.

... Thinkpads_User
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.