We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between capture point with a tracing package we noticed that the traffic was coming from one of our non production virtual machines. Actually it was a SBS 2008 test environment. The issue would go away once we disconnected the one office that housed this virtual machine.
Once the virtual machine was stopped or disconnected the traffic trickle would go away. The bandwidth was approximately 900Kbps steady when it would start running. We looked around for any such large downloaded data and noticed that there is no large data footprint on the virtual machine or any other network shares/servers.
We don't have any ftp or other WAN side services open except an SSH tunnel on a non standard port that is pretty locked down.
My question is what could of caused such a high amount of download on our end. To give an example there was 162GB download with only 6GB uploaded from our WAN ip.
To clarify it appeared that we had downloaded 162GB of data and uploaded 6GB of data from our end.
I can give more information if needed.