1

I have a SQL Server that is continuously sending data out the network interface. The data that is being sent is too high; about 7MB per second. I have scanned the server with anti-virus but haven't found anything.

How can I determine what is using so much bandwidth on my server?

Improve this question
3
  • What port is it sending data to? What process is sending the data? Start troubleshooting.
    – David Schwartz
    Apr 7, 2012 at 3:19
  • MsSQL port 1433 and w3wp.exe process sending the data continuosly.
    – Jagat Sheth
    Apr 9, 2012 at 5:46
  • I'd worry about an attack such as an SQL injection attack.
    – David Schwartz
    Apr 9, 2012 at 5:52

2 Answers 2

Reset to default
4

Scanning the server with anantivirus tool is useless if there is the chance of an existing infection. It could be that the infection is itself shielding itself from being discovered. If you are concerned that there is an infection, you will need to take the server offline and perform a scan on the hard drive. Consider using a boot CD with antivirus on it, such as the Kaspersky Rescue CD.

To see how much bandwidth a process is taking up, simply open up the built-in "Resource Monitor" tool and look at the network subsection:

enter image description here

You can also use perfmon to create a monitor, and then use counters in the Process class to determine the amount of IO that it is using. The IO will be a tally of both network and disk I/O, so you can still get a reasonable guess as to which processes are taking up bandwidth.

If you're up for installing third party software, look into NetLimiter.

If you want to go hardcore, use Network Monitor to capture packets or mirror the port that the server is on over to a sniffer server and try to reconstruct the data into something meaningful.

EDIT 1

In your case, you've narrowed it down to IIS and the worker process executable. You'll now want to examine which website is taking up so much bandwidth. IIS can create log files for each site that can be examined with LogParser. Someone has made a quickie free program that can examine the logs and display some statistics. It's fittingly called "IIS Trafic Monitor." Make sure to check the documentation for it.

There are also other, for-pay tools to determine IIS bandwidth usage, but I'll let you find them lest my linking to them seems to be an endorsement.

If you have any kind of gateway or firewall in front of the IIS server, it may have the ability to inspect packets that cross its boudaries and reconstruct statistics based on application layer traffic like HTTP (which means it could conceivably sort bandwidth usage by URL and directory).

Improve this answer
3
  • Thank your for your answer but the server is cloud server and I am not able to offline a server. I have stop the SQL,MySQL and IIS and check server but still the data going out from the server. I don't know how to stop this. Is there any way to stop from inbuilt windows firewall?
    – Jagat Sheth
    Apr 7, 2012 at 7:12
  • @JagatSheth If you check using resource monitor, you'll be able to see what process is sending the data. From there, you can uninstall the service or application that is sending the data. Yes, you could also block the application that is sending the data using the Windows Firewall, however you'll need to find that application first using the methods that I mention in my post.
    – Wesley
    Apr 7, 2012 at 7:14
  • I have check first SQL server and IIS workers process group w3wp.exe process used maximum data but when I stop the service SQL, IIS, Mysql still the data going out from server. This is my live server and websites are running from the box. Please guide me or if you have solution let me know. Thanks.
    – Jagat Sheth
    Apr 9, 2012 at 5:44
0

I would start browsing network traffic - http://www.wireshark.org/download.html

In MS SQL you can also run a profiler trace to view database activity. Perhaps MySQL has a similar feature?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .