0

I manage a windows server (2012 R2) that has an SMB share used by people across my company. Recently, people have been complaining that the share is slow, and I'm seeing that the network bandwidth is completely saturating the NICs. I can see the number of files opened per user/session connected to the share, but I can't see bandwidth used by users or files. I suspect there are some automated scripts pulling files off the share and are misbehaving, but I don't know how to show this.

Are there any tools for dealing with this sort of problem?

Improve this question
1
  • 1
    Sounds like a job for a protocol analyzer.
    – Davidw
    Feb 5, 2016 at 4:58

1 Answer 1

Reset to default
4

Finding the remote machine is easy:

Just use Resource Monitor. Go to the 'Network' tab, expand "Network Activity", sort by Send(B/s). Your culprits will have the highest current Network traffic.

Alternatively, you could use TCPView.

https://technet.microsoft.com/en-us/sysinternals/tcpview

Order by "Sent Bytes". Look for entries where the Local Port is "Microsoft-DS". The "Remote Address" will be your culprit.

From there you should just be able to use net file to see which files are open by that user.

Improve this answer
1
  • Thanks, that's basically what I've tried already. I should've put that in the question description. Resource Monitor and TCPView mostly just tell me bandwidth by IP address at a given instant in time. net file only tells me what files are "open" for each user and not necessarily using bandwidth. None of these let me pin bandwidth to a user or a file.
    – Tron
    Feb 5, 2016 at 17:08

Not the answer you're looking for? Browse other questions tagged .