When in I was investigating a network problem with a netflow solution, I discovered that a user with Outlook was causing a lot of Exchange data traffic. I didn't see any large attachments being sent/received by this user. When looking at the ports used between the Exchange server and the Outlook user, I saw tcp port 1119 creating 97% of the traffic. What is this port? When looking it up, it's a game port, battlenet. Also, tcp port 1210 (eoss) had a lot of retransmits between Exchange and the Outlook user. None of these ports are required for Exchange. Do you know what these are? Are they 3rd party add-ins? Virus/trojan? Thanks Ron

Those are just random low port range and not tied to any standard well known ports so those port numbers do not say anything. Fire up exmon to confirm and see if these offending users are showing high activity. I would also start off by taking them out of cached mode, defunct osts have also known to cause high traffic, but so have a number of other issues, outlook third party indexing, bugs with items being constantly stuck in outbox etc.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

James, This specific user is not in cache mode. At the moment, this user is not high in the Exmon activity list. is there a monitoring tool like Exmon but keeps historical data? Thanks Ron

Hi Ron, You may run in Outlook safe/mode to isolate the fault from addins. Also, please try in Windows safe mode with network connection to isolate the third party applications. Hope it is helpful. Fiona Liao TechNet Community Support

hi have you ever used network monitoring software (like sniffer) to monitor networking flow ? "it's a game port, battlenet" I think he was play Wow or diablo 3. It's an interesting game. Stay Hungry, Stay Foolish

Thanks Fiona and SoulForJ. At the moment, I'm going to apply the Outlook 2007 July 2012 stability and improvement update and see if this prevents any un-needed hung connections between Outlook 2007 and Exchange 2007. Ron

Thanks Fiona and SoulForJ. At the moment, I'm going to apply the Outlook 2007 July 2012 stability and improvement update and see if this prevents any un-needed hung connections between Outlook 2007 and Exchange 2007. Ron