Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Small Business Server 2008 box that is using up way too much internet traffic according to some very simple reports on our SonicWall TZ-210 router. The router shows that we have used 3 gigabytes of SMTP traffic in a 24 hour period but I believe this number far exceeds our actual usage.

We are using Exchange Server 2007 on this server as well as hMailServer for some simple email relay.

I think I need a way to see the IP's, port numbers, and protocols related to our server traffic. What is a simple way to do this?

What various logging could I setup or what default logs might already exist to help me troubleshoot this problem?

share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

SMTP logs on Exchange are a good way to start. You can spend some quick time going through those looking to see if your outbound messages are legit, or if you have some zombies on the network blasting out.

http://technet.microsoft.com/en-us/library/bb124531(EXCHG.80).aspx

Also the message tracking tool in the Exchange Console, and set the desired results to a date, and leave all other fields blank, and see what is going in/out of Exchange of the course of a day.

I dont have one in front of me right now, but I'm pretty sure you can view a report in TZs to see the collective protocol traffic (not per client though), and if your server is a large percent of the traffic in general, and you see SMTP, or HTTP eating up a healthy % of the collective protocol traffic out of that device, you can assume the server is the source and that would give you some starting clues.

All starters that won't cost a dime.

share|improve this answer
1  
I believe I may have resolved this issue now. I used Microsoft's Network Monitor 3.4 to find out that there was lots of traffic bound for {x}.mx.mail.yahoo.com. I found an 8MB email in the queue that had been there over the last 24 hours. I deleted the email and changed my incorrect setting in the FQDN section of my Outgoing SMTP connectors to be "mail.mydomainname.com" instead of the incorrect "remote.mydomainname.com" that was in there. Traffic levels in the SonicWall now appear to be normal, with HTTP exceeding SMTP (Saturday, no one here except me). –  HK1 Feb 12 '11 at 19:42
    
nice! good job. forgot about netmon, it's a solid tool –  Malnizzle Feb 12 '11 at 19:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.