Network Usage Question.

[pravius]

Hello,

I am a network engineer trying to figure out some odd Lan sweeper behavior. I do not administer the application at our organization personally but have some questions and our Lan Sweeper admins are not 100% sure why this behavior is occurring, so I figured it would not hurt to ask here.

We use Solarwinds network monitoring and have been closely watching the traffic at all of our remote sites. As soon as a lan sweeper scan is initiated at the remote site I will see the traffic for the remote site shoot up to 100% utilized for about 5-8 minutes at a time. We have DS1's to all of our remote sites so it does not take much to saturate them. The really interesting thing about this is it's the receive traffic that is pegging and not the transmit. As far as I know lan sweeper is just scanning the remote site and sending the data back to the server, that should be transmit traffic.

So my question is, what is the server pushing out to the remote sites, or what exactly is happening where the receive is pegged and the transmit is not?

Thanks in advance for any insight into this.

[pravius]

Thanks Susan. That is exactly what I was asking. It was curious to me why information was being sent from the server as opposed to being received by the server. Our Lan Sweeper admins were not 100% sure what was going on and why this behavior was occurring.

Appreciate the response.

[Susan_A · Accepted solution]

It's normal for there to be more traffic from the server to the client as opposed to from the client to the server, if this is what you're asking.

Lansweeper scans most Windows computer data from WMI, Windows Management Instrumentation. It takes a lot more traffic to set up the various WMI connections to the client machine than it does to send the scanned data back. This is why our LsPush scanning agent generates so little traffic compared to the agentless scanning methods, because it scans locally and doesn't need to set up client connections.