active directory

like can you give example, there is none with ldap

there is ldap on 10.10.155.101

Sorry but can not understand you. What is happening? Why you say high ldap querys?? could you give us what servers are ldap and what not? I don´t have got access to your servers and of course don´t know about your architecture.

I am referring IP as per wire shark report that there is high ldap on that IP is that correct, this is all I want

I just want to know which ones you are referring to rdp , I saw 10.10.183.25
on ldap just kindly confirm so I can close this case

how come more of rdp trafiic

ldap uses tcp so how are u referring rdp

TCP may be anything. You must to check destination or origin ports to view what kind of traffic may be. On this case, 3389 TCP port is a well know port: RDP services.

Regards.