# SBS 2008 server stealing bandwidth



## jmchart (Jul 13, 2001)

I have just installed a SBS2008 Server and it seems to be chewing up all of out internet bandwidth. It seems to happen in the mornings from about 10-2est I have looked in the event logs and in the task manager to see what the issue is. I am at the end of my rope.

I ran wire shark on the server to try and diagnose the problem and found that the server was corresponding with two specific IP adresses.

192.221.98.123 our internal ip scheme is 192.168.0.000
and 65.54.95.162 which resolves 

Any suggestions would be appreciated.


----------



## StumpedTechy (Jul 7, 2004)

Well 192.221.98.123 is dlservice.microsoft.com.c.footprint.net which resolves to MS download center.

Also 65.54.95.162 says its from MS as well. Have you looked at some potential issues with Automatic updates or something going on during that time? Usually a good thing to do is stup a WSUS server have it download the updates at the time you want it to and then have the WSUS provide the updates via BITS.

The only thing that has me perplexed is why it would chew it up for 4 hours each night.


----------



## jmchart (Jul 13, 2001)

I looked at the roles that my server is performing and WSUS was definitely not one of them. In the SBS consloe though it does have the computers set up update daily at 3 am. 

SBS2008 does not allow WSUS as a role.

In the scheduled tasks fro yesterday right around the time of the bandwidth was taken two tasks ran. I have been trying to find out what they are.

026405fa-21a8-b588-ef844f36b40a this task ran for about 1.5 minutes
and the second task was
8174a92e-ed9c-4480bfdb-54810711db2 this task ran fro less than a minute.


----------



## StumpedTechy (Jul 7, 2004)

Well those numbers don't mean anything to me.... and really they could be anything. WSUS is something you add on to a server its not a built in role. It basically distributes the updates from your server instead of all servers and clients downloading content at the same time over the WAN connection. Usually nothing is set at 10am for updates as far as I know.

Have you checked all your automatic update settings to make sure its set for at night/early morning when your not in?

Also if you can identify these tasks and what they are running. While the task may be short lived they could kick off a process that runs for the 4 hour timeframe you mention.


----------



## jmchart (Jul 13, 2001)

All of our computer updates are set for 3 am. If WSUS is an add on I assume I can download it from Microsoft.


----------



## StumpedTechy (Jul 7, 2004)

If updates are set for 3am then I have no clue why your server is trying to access MS at 10 what all is installed that is MS related?


----------



## jmchart (Jul 13, 2001)

Update on my situation. I have installed WSUS 3.0 sp1 on my w2k8 sbs. It is configured to pull updates at 11 pm, I have updated the Update policy to have all computers poll the server for their updates. 

The server is still communicating with three update servers. I have tired stopping the windows update service. I have also stopped all share point services. 

This server is running as an exchange, server, DNS Server, DHCP server, and now an update server.

No other applications are running on it with the exception of back up software which is not configured yet,


----------



## jmchart (Jul 13, 2001)

Update on my situation. I have installed WSUS 3.0 sp1 on my w2k8 sbs. It is configured to pull updates at 11 pm, I have updated the Update policy to have all computers poll the server for their updates. 

The server is still communicating with three update servers. I have tired stopping the windows update service. I have also stopped all share point services. 

This server is running as an exchange, server, DNS Server, DHCP server, and now an update server.

No other applications are running on it with the exception of back up software which is not configured yet,


----------



## StumpedTechy (Jul 7, 2004)

You haver checked the logs of all the different services for this 10-2 timeframe? In exchange, in dns, in dhcp as well as the system event logs you said you checked? When you say mornings I never quite got that is that morning 10pm to 2 am or morning 10am to 2pm (I am thinking the latter but wanted to verify)?


----------

