Massive network traffic puzzle

[nikaso]

Is there a kind person with wireshark knowledge that can help me work out why our print server is seeing such a massive amount of network traffic? (constant 1Gbps)

 

I've got a 60 second wireshark capture that is over 2 gig in size and my wireshark skills are sadly lacking. If someone could take a look and tell me what is causing the traffic or give me some pointers I would be very grateful!

[synaesthesia]

Printers are noisy, some more than others. Xerox printers for example are particularly chatty for no apparent reason. One thing you can do quickly & easily is disable Bonjour on the printers unless you need it (unlikely) so they go back to the standard "hi, hello, are you looking for me? No, you need address xx.yy.zz.aa."

[Edgehill]

If you open the conversations and/or endpoint windows in Wireshark you can sort by Bytes, which should point to which IP addresses are using the most bandwidth.

[AlanD]

Is this printer server a physical box..rather than a virtual one? I’d want to find out if it was actually printer traffic..by disconnecting them...

[MatthewL]

What printer/MFD's do you have?

[nikaso]

Thanks for these tips, I've found that there is a lot of traffic between the print server (which is virtual) to lots of desktops. I picked the top talker from the conversations and ran a seperate capture on that machine and it showed 44 meg total traffic between it and the print server in about a 10 second capture, it was roughly equal send and receive. The desktop wasn't doing anything at the time and certainly not printing. Looking further into it now.

[Edgehill]

If you log on to the desktop in question and open resource monitor then look at Network activity it might show which program is the culprit.

[nikaso]

If you log on to the desktop in question and open resource monitor then look at Network activity it might show which program is the culprit.

 

I went on to a desktop and on hunch stopped the print spooler service, network use dropped from circa 5% of a 1Gbps connection to 0.01% instantly and went straight back up when I restarted the spooler.

[nikaso]

Update, it looks like a corrupt follow me virtual queue was responsible for most of the traffic, once recreated this drops to normal levels. Next week should see this tested as everyone has gone home now so it isn't a normal usage level.