After many long philosophical discussions, we bounced the server. The traffic stopped, and I've decided to become a bus driver. I've got a screen print of the sniffer, doesn't help a bit.
-----Original Message----- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 2:02 PM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 When did you first notice this? when you do a netstat -n , what port is the traffic using? ( I apologize if you have already stated this) -----Original Message----- From: McMahon, Terry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 2:47 PM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 Network guys just showed traffic from the Exchange server headed to 10.10.10.10. Nothing else. Like pulling teeth. -----Original Message----- From: Thomas Di Nardo [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 11:40 AM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 Did your network guys stick a sniffer out there? What did the sniff show? Tom. -----Original Message----- From: McMahon, Terry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 10:50 AM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 Right, sorry. When stopping the MTA, I stopped it for about 10 minutes, I got about 30 messages in the queue to the hub server about 2/3 public folder replication and 1/3 mail. Inbound was a lot bigger, some 200 Public folder rep and 100 or so mail. That's what made me think it was public folder replication. . . but, this is where I get lost, while the MTA is down, there's still this traffic to 10.10.10.10. Windows Directory replication? There is no 10.10.10.10 that I can find and the network guys say the traffic isn't going anywhere. By a lot of traffic I mean, if left "un-shaped" it would fill a 3meg pipe. Normal traffic from this server averages 200k. I've decided computers are too complicated and I'm going to work at Dairy Queen. -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 9:12 AM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 Also, can you define "loads of traffic"? Serdar Soysal -----Original Message----- From: McMahon, Terry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 10:00 AM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 I thought it might be public folder replication, goes off every four hours. But this is constant. All I get from the transport guys is the source name and the destination, is there any way to check which process is sending the traffic? I've got NAV running and updated on the server so I'm pretty sure (not completely sure, getting less sure every couple of minutes) that it's not a virus. -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 8:51 AM To: Exchange Discussions Subject: RE: Exchange traffic to 10.10.10.10 Directory replication? Virus? Serdar Soysal -----Original Message----- From: McMahon, Terry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 23, 2002 9:48 AM To: Exchange Discussions Subject: Exchange traffic to 10.10.10.10 Hello, One of our Exchange servers (5.5 Sp4) is sending loads of traffic to 10.10.10.10. It's an internal mailbox server, not a relay, has an IMC and a site connector. NAV for exchange and Pagemaster. I can't find anything wrong with it, but there has to be some kind of configuration error. Anyone else have this problem? Terry McMahon Enterprise e-mail team AEGON _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ---------------------------------------------------------------------------- -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. ============================================================================ == _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
