Skip to main content
micahawitt
micahawitt
New Member
November 24, 2015
Question

High NIC usage

  • November 24, 2015
  • 2 replies
  • 16143 views

Ive noticed over the past few installs, 5.4 and 5.2.5, that after installing, and even after a reboot, my NIC shows it is getting data at 8MB/sec.  I have to shutdown forticlient and sometimes reboot, then will go to normal.

 

I first noticed this in my lab environment after installing EMS and pushing out to 3 servers, it eventually brought down my entire network and killed CPU and NIC traffic, i had to power off two esx hosts and my SAN, switch and start fresh.

 

Since then, i have noticed this on clients, mostly they are Windows 10 installs, yet there are a few Windows 7 pc's i notice this on.

 

Anyone else having related issues or possibly know?

 

Thank you

    2 replies

    Chris_Lin_FTNT
    Staff
    Chris_Lin_FTNT
    Staff
    November 24, 2015

    Do you know what IP address it's sending traffic? I want to know if it is downloading AV signatures.

    micahawitt
    micahawittAuthor
    New Member
    November 25, 2015

    It appears to be the local IPv4 address, and I will have to see if I can do some more digging when it does occur, sometimes it happens a day or two later after a I boot up a pc, it will then just hang and CPU and NIC go berserk, there is a Host Service system proc that is going, I will have to get a screen shot for you so you can see exactly, but either a reboot, or killing that service seems to help.

     

    I will work on getting pics and more details, it appears however that its not trying to grab AV signatures, yet just causes a broadcast storm that brings things down.

     

    Stay tuned...

    Chris_Lin_FTNT
    Staff
    Chris_Lin_FTNT
    Staff
    November 25, 2015

    It will be helpful to identify the type of traffic.

     

    You case reminds me a traffic storm in my network, which turned out to be some IGMP broadcast.

    Chris_Lin_FTNT
    Staff
    Chris_Lin_FTNT
    Staff
    January 5, 2016

    Could you try Windows build 788?

     

    https://www.dropbox.com/sh/cb0j4pxw1f8nq84/AABHzZW1bpx1VjzYAmiK00S9a?dl=0

     

    It has some fix for Application FireWall.

     

    Thanks.

    micahawitt
    micahawittAuthor
    New Member
    January 5, 2016

    I will test this build tonight and let you know.

     

    Thank you

    alantz
    alantz
    New Member
    January 7, 2016

    I just had the same sort of issue on our network with FortiClient 5.4. Whenever firewall is enabled through custom FortiClient XML, cisco router starts heavy IGMPv2 traffic. Ticket number is 1606251. Never noticed this with 5.2.3.

     

    Alan

     

     

    Terms & ConditionsAccessibility statement