Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I sometimes help a small office with a few issues. About two months ago, they were complaining of poor internet performance. Long story short, I found one person running Carbonite on a Mac that was pushing 2mb uploads all day. Shut down Carbonite and the problem -- which I saw as a 2mb consumption in a traffic graphic -- disappeared. I adjusted that user's Carbonite so that it would consume as much bandwidth as it could. (I forget the name of the setting.)

In that case, I went on-site and turned off everything until I found the problem workstation.

I think the problem is occurring again, indeed there is now a 2mb consumption hum in the traffic graph. I'd like to be a lot smarter about figuring out what's happening.

How would you approach identifying the workstation responsible?

(FWIW: Unless something has changed, Carbonite will not release enough information that would allow me to throttling those connections. Search Google and you'll see a whole lotta complainin' about this.)



share|improve this question
I'd check the switch. – HopelessN00b Jan 2 '13 at 20:47
From the main dashboard, there's 'top connections by source address' on the bottom right. – David Schwartz Jan 2 '13 at 21:57
Blocking one IP won't change the bandwidth usage because the software will just give that bandwidth to another connection. You should have looked at the session information to figure out which machine was responsible for the bandwidth usage. – David Schwartz Jan 2 '13 at 22:11
The point of that portion of the web interface, and the "Usage" panel is to allow you to figure out how your bandwidth is being used. – David Schwartz Jan 2 '13 at 22:18
@TomTom nice. THat is larger than my 4 workstations in my company at the moment. Well, plus our HPC cluster, but that is isolated. So, do not tell me what is small ;) I beat most of you in this regard. I dnont believe in hiring people - i rather have computers work. – TomTom Jan 2 '13 at 22:22
up vote 0 down vote accepted

How would you approach identifying the workstation responsible?

After firing the administrator who has not put in policies in place to distribute bandwidth equal (a switch on the router / firewall)...

...I just log onto the firewall, look at the current traffic by source IP address (i.e. the internal one) and then make a ping -a to find the corresponding machine name.

Not that this is ever possible, because your backbone has 7 traffic priorities and does - within one priority - distribute bandwidth equal if needed (I.e. one can not block all bandwidth). You can do that transfer of your colleage all day and noone would notice. Not even ping, voip or our financial data streams would realize that.

share|improve this answer
I suppose you'd have to fire me. :-( I hear you and think your point is valid. I will open up a support ticket with Fortinet to figure out how to do what you suggest. At the very least it would stanch the flow. – tcv Jan 2 '13 at 21:55
No traffic shaping available on this firewall. Wanna come take the job? I'm kidding. There's a lot of history regarding this site that I can't share here. Some of this is my fault. Some of this is not. Of course, everyone says that. ;-) – tcv Jan 2 '13 at 22:18

Best way to find the device causing the problem would be to use package inspection (-> sources!) at your router.

Also have in mind that there are many other technical reasons which can cause a enormous slowdown of your network performance e.g. electrical issues!

And after that: Get somebody who setups traffic shapping at your location!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.