high bandwidth between two machines on WAN

I have two machines on separate subnets (site to site WAN) that have a constant high send from one to receive at the other bandwidth usage. One is a server that is steadily sending at 3Mb and the workstation on the remote/other side of the wan is receiving.  No disk usage. No high CPU. I've run sysinternals ProcMon shows both machines normal, or rather, nothing is standing out.  Just finished full scan of both machines. Other than a couple of deleted cookie's both machines are clean.  I'm at a loss as to see "what" is being sent, if anything. No data is changing on the receiving (disk usage is not going up) end and the stream is steady sending from one side and steady receiving on the other.
I'm not sure where to post this question so if I need to repost, please tell me where it should go.
I'm open to all thoughts/suggestions.
David BirdPartnerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
Use WIreshark or CommView (Tamosoft) on the one of the machines and see what packets and ports are being used. It should tell the other IP address and what ports are in used. CommView can display the packets or information about them.
Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
As John said, use a network protocol analyzer to see what is going on.  Also ensure that there no drives mapped and if there are, ensure indexing service is not trying to index mapped drives.
David BirdPartnerAuthor Commented:
I was collecting with Capsa demo and  I have port mirroring on to the NIC I'm collecting from. It found the two IP's and showed port 445 as the culprit.  Commview did not show remote IP, just local.  However, on the collection machine that Commview is running on, steady and constant traffic is reporting from the Sending server to the Commview machine on port 445.  Maybe a virus or exploit on that machine, but scanner didn't find it.
I changed the IP on the remote machine for giggles.  Traffic stopped for about 4 or 5 minutes and then it started sending again the new IP on the remote.  
Am I not following your instructions properly or something deeper I can look at?
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

David BirdPartnerAuthor Commented:
no Mapped drives or portable drives attached.  Still high send/receive.
JohnBusiness Consultant (Owner)Commented:
Port 445 is Microsoft-DS Active Directory, Windows shares. So it is probably just chatting activity between systems. Possibly a database on one end and a client on the other. It may be nothing to be concerned about.

Check what applications are on the machines.
David BirdPartnerAuthor Commented:
I looked up MS-DS and agree but what application(s) would I be looking for? Process monitor is not helping. Nothing appears "out" of line.  transmission is too steady and never ends.  I can't imagine any application needing to chat at 3Mbps constantly.
David BirdPartnerAuthor Commented:
Should my focus be on the sending or receiving machine?
JohnBusiness Consultant (Owner)Commented:
QuickBooks could cause this kind of traffic. Any client - server database.
JohnBusiness Consultant (Owner)Commented:
You might put a packet sniffer in each machine and see if you can determine traffic patterns.
David BirdPartnerAuthor Commented:
I'll put commview on both machines and take a looksey.
David BirdPartnerAuthor Commented:
Same information. microsoft-ds screaming "something" at the receiving machine.  Zooming in just shows SMB host to destination.
JohnBusiness Consultant (Owner)Commented:
I don't know your applications but it sure looks like one is talking to the other.

Is one machine having difficulty getting Windows Updates or Anti Virus updates? Your server could be sending these out.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
David BirdPartnerAuthor Commented:
Sir, you must be correct.  When I log out of the machine, traffic is normal. Login and 15 - 45 seconds later, heavy traffic.  I'll low tech it, and go one application at a time. Thank you. I will let you know what I find.
David BirdPartnerAuthor Commented:
Offline files service is/was the culprit.  You were spot on sir!  Thank you.  I'll figure out why/what is causing the service to run amuck.
JohnBusiness Consultant (Owner)Commented:
@davebird  - Thank you for the update. I was happy to help and I am glad you found the culprit.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Analysis

From novice to tech pro — start learning today.