WAN Link Saturation

[davis226]

We have been having an issue recently where some of our WAN links appear to be getting satuarted with Lansweeper traffic. I dropped the number of simultaneous threads from 40 to 15, but that didn't help the situation. Upon further investigation using NetFlow Analyzer it appears Lansweeper sent 45Mb of data to one single machine it was scanning. In addition, it was odd that the data was going from the server to the pc and not the other way around. Per the analyzer it appears to be sending data from port 80 on the server to port 1211 on the pc.

Any ideas about what may be causing this?

[Hemoco · Accepted solution]

Lansweeper (WMI) is not using port 80, I suggest inspecting the server and the traffic, we have seen something similar before with another customer when the lansweeper server was infected by the Conficker worm.