Identifying RPC requests

[Charles Carmichael]

I’m looking for a way to identify the source of a user/device that may be hammering an Exchange 2007 server with RPC requests. We have a small SBS 2008 SP2 server with about 20 mailboxes. Lately RPC requests in Exchange have gone through the roof (scale is 100.0) and spikes between 50-100 for 15 users. Seems ridiculously high to me. Is there an easy way to identify the source that is creating so many requests?

[Timothy Warner]

Hey Maphias. Have you considered installing Microsoft Network Monitor on your Exchange Server and running a trace for RPC packets? The trace will tell you exactly which computers the requests are coming from.

Let me know,
Tim

[Michael Pietroforte]

Network Monitor is certainly a great choice. This tool helped me many times to troubleshoot odd network issues. WireShark is another great network monitoring tool although it is more difficult to use than NetMon. It is helpful if you need statistics over longer periods of time.
In your case you might want to use a specialized tool. There is a free monitoring tool for troubleshooting Exchange: Microsoft Exchange Server User Monitor, better known as ExMon.

[Sitaram Pamarthi]

Like Michael said, Exmon is the right choice. It gives you the source(computer) of high RPC traffic.

[Author]

Posts