0

We have a Small Business Server 2008 box that is using up way too much internet traffic according to some very simple reports on our SonicWall TZ-210 router. The router shows that we have used 3 gigabytes of SMTP traffic in a 24 hour period but I believe this number far exceeds our actual usage.

We are using Exchange Server 2007 on this server as well as hMailServer for some simple email relay.

I think I need a way to see the IP's, port numbers, and protocols related to our server traffic. What is a simple way to do this?

What various logging could I setup or what default logs might already exist to help me troubleshoot this problem?

1 Answer 1

3

SMTP logs on Exchange are a good way to start. You can spend some quick time going through those looking to see if your outbound messages are legit, or if you have some zombies on the network blasting out.

http://technet.microsoft.com/en-us/library/bb124531(EXCHG.80).aspx

Also the message tracking tool in the Exchange Console, and set the desired results to a date, and leave all other fields blank, and see what is going in/out of Exchange of the course of a day.

I dont have one in front of me right now, but I'm pretty sure you can view a report in TZs to see the collective protocol traffic (not per client though), and if your server is a large percent of the traffic in general, and you see SMTP, or HTTP eating up a healthy % of the collective protocol traffic out of that device, you can assume the server is the source and that would give you some starting clues.

All starters that won't cost a dime.

2
  • 1
    I believe I may have resolved this issue now. I used Microsoft's Network Monitor 3.4 to find out that there was lots of traffic bound for {x}.mx.mail.yahoo.com. I found an 8MB email in the queue that had been there over the last 24 hours. I deleted the email and changed my incorrect setting in the FQDN section of my Outgoing SMTP connectors to be "mail.mydomainname.com" instead of the incorrect "remote.mydomainname.com" that was in there. Traffic levels in the SonicWall now appear to be normal, with HTTP exceeding SMTP (Saturday, no one here except me).
    – HK1
    Feb 12, 2011 at 19:42
  • nice! good job. forgot about netmon, it's a solid tool
    – Malnizzle
    Feb 12, 2011 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .