Endpoint Protection

We've been running SEP since MR2 on Windows SBS 2003 Premium, and have consistently upgraded with each MR/MP. We are now running MR4 MP2.

Have spent several weeks trying to figure out why our Internet bandwidth (which should be 6MB down/6MB up) is consistently running between 2MB and 4MB in each direction. We tested by plugging the incoming CAT5 jack directly into a notebook and running several online speed tests (primarily at speedtest.net). Only AFTER we completely uninstalled the SEP client from the notebook did the speed tests start returning measurements in the expected 6MB range, and those results were extremely consistent. Reinstalling the SEP client (or using another machine with an SEP client) consistenly reduces the available Internet bandwidth by approximately half.

Since we're running ISA server on the server (w/2 NICs) in conjunction with the SEP Management program and the SEP client, we're experiencing the same results when the Internet connection is routed through our SBS 2003 server. We are using Intel Gigabit NICs on the server and have updated the drivers to no avail.

Has anyone else had this experience? If so, are there any possible workarounds? Management is pushing to dump SEP so we can get the Internet bandwidth we're paying for, but I'd prefer to FIX the problem rather than switch to another product and inherit new issues.

What is the current settings for the network protection? Try using a packet sniffer or MS-DOS netstat to check what connections are being made.

We have tried various settings, but currently network protection is turned off (unchecked) at the profile level in the SEPM. To the best of my knowledge, we're not scanning network drives from either the server or the clients.

If SEP is the one taking up the bandwidth, then by disabling Network Threat Protection (NTP), you should notice a drop in bandwidth usage. The other component only uses up the disk, cpu and memory. Remote scanning of drives isn't enabled by default. You have to map a network drive to trick the application that it is scanning a local drive for this to work. And it doesn't take that much bandwidth.

If NTP is enabled on the Pc in question, you can view the information in NTP.
Just click on the Options... found at the right. Then select "View Network Activity".

This is like Netmon of SysInternals.

Using ISA 2006 and MR4 MP2 as well, but not SBS. How does it look on this site: http://www.speakeasy.net/speedtest/ ?

Ray

The site you cited is one of a handful of "free bandwidth speed test" sites we've been testing with. All give results in the same neighborhood, which is roughly 33-50% slower than what we get by testing on machines without SEP installed.

We've uninstalled the SEP client from the server (SEPM is still installed) and the problem remains. So now I have these results:

SEP Client on testing PC - bandwidth cut by 33-50%
SEPM on testing PC - bandwidth cut by 33-50%
No SEP components on testing PC - bandwidth speed as expected

I don't see Teefer2 listed in the network components anymore - could it still be there and causing problems?