Mweb traffic

[BouncyNinja]

Hi Guys,

i need some assistance pleeease

our mweb is horribly slow today, i phoned mweb business, and got told its because of and i quote " someone on our network is downloading and uploading large amounts of data"

now i have been to everyones pc, and there is nothing out of the ordinary happening

does anyone know of any application i can run on our isa firewall to monitor what outbound connections are happening and where the originating from?

 

[eddief1]

How many computers do you have? have you gone to each machine and run netstat -b from the command prompt. This will show you all the connections initiated by that machine.

 

[Pada]

Why don't you just install Windows Network Monitor, which should be available as a standard Windows component on Windows Server.

Just take note that it MIGHT restart the server's network connection. I'm just taking a guess that it would, because most of the intrusive network applications do restart the Windows network when installing.

Here are a few Tips & Tricks for ISA firewall (written in 2004): http://www.isaserver.org/tutorials/2004bestpractices-p1.html

 

[Pada]

How many computers do you have? have you gone to each machine and run netstat -b from the command prompt. This will show you all the connections initiated by that machine.

Or you can download TcpView from SysInternals, which is free. TcpView can also give you the bytes sent/received too.

 

[Mk1gti]

Both my mweb business 4mb lines are crawling today. Logged a call, they then told me they will let Telkom reset my ports, which they did, pohone me back to test, doing the same thing. The one is not even testing at 0.43Mbps other one is touching 1Mbps.
Hopefully it gets sorted quick.

 

[Cryax]

Same hear my home adsl has been horrible. I have only had useable adsl for like 3 days I dont want to keep bothering mweb guy though.

 

[gregmcc]

How many machines do you have? Don't you have a proxy server? How do you monitor the traffic/abusers/block sites?

 

[BouncyNinja]

Hi all, apologies for the delay, we use isa as a firewall / proxy (not my first choice, but yeah)

I eventually found it was someone upload huge amounts of data to our exchange server ( from an mweb ip) just blocked the ip in windows firewall, and the problem was sorted

Thanks for the feedback