isa 2006 max connections

I get this error message in ISA 2006 eventviewer logs quite often for machines that are no infected. How can I find out what is maxing out the connections. I am not seeing anything on the clients.

The number of HTTP requests per minute from the source IP address exceeded the configured limit. ISA Server will block new HTTP requests sent from this IP address.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CD, MVPOwnerCommented: exceeded the configured limit  -- check that device
Sid_FAuthor Commented:
As mentioned I am not seeing anything on the client. It comes up clean for AV.
Craig BeckCommented:
If you're sure there's no infection you can change the limit.  Have a look here...

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Acronis Data Cloud 7.8 Enhances Cyber Protection

A closer look at five essential enhancements that benefit end-users and help MSPs take their cloud data protection business further.

Sid_FAuthor Commented:
Ok but that still doesn't tell me what is in the traffic. It just allows me to up the limit. Thanks. I want to find out where the log file is for the traffic before I can say its safe or not.
David Johnson, CD, MVPOwnerCommented:
then use wireshark to analyse the network traffic
Sid_FAuthor Commented:
Wireshark would work if if it was happening every few minutes but this might not happen for another 5-7 days. Wireshark files would be too many plus I would be taking a performance hit monitoring all traffic.
Sid_FAuthor Commented:
Request to close.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.