Hi all
I've recently migrated a client over from SBS2003 to SBS2011. Server was installed into Production early Jan 2014.
Then approx 20-1-2014 their internet usage spiked 5 times their usual level.
So far I have checked and performed the following...
1. Checked WSUS is fully sync'd. (approx 100gb of data) and this was completed prior tot he spike occurring.
2. Trend Micro Worry Free Console - configured with defaults - there were suspicious trojans found, quarantined and now deleted.
3. MalwareBytes scanned and cleaned infected on the server.
4. Exchange email queues - No SPAM appears to be queued or excess email being sent out according to the exchange logs.
5. Scanned all pc on the LAN and WAN with Trend Micro and MalWareBytes and nothing suspicious appears to be generating the excess traffic.
6. They have SMTP hosted Exchange and DNS hosted inhouse. Their appears to be excessive DNS traffic on Network Performance Monitor on the standard SBS2011 Task Manager console.
7. Once the SBS2011 box is restarted - traffic appears to resume to normal for a day or two, then spikes again. Normal traffic usage was approx 250 - 500Mb / day.
Excess is approx 4-5Gb uploads per day and about the same downloads.
They are a small company - 2 sites (hardware VPN to a remote site using Cisco 527W).ADSL2+ Business plan with Telstra (Australia) on a 25Gb/Month plan. Excess use last month spike close to 50Gb.
They have 8 pc's on LAN and another 6 pc's across their WAN VPN connection which have Outlook connect to the Exchange Server.
Failing installing some network monitoring software on their LAN, can anybody suggest what else I could be looking at?
Is there some quick and EASY, FREE Software that can be used to install on a pc on their LAN to analyse the internet traffic by protocol, source and total size generated.
I am pulling my hair out trying to work out what is causing it???
Any assistance, pointers or guidance appreciated.