Network Bytes Total per second beyond threshold

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at]  

Topic Last Modified: 2006-02-13

The Microsoft® Exchange Server Analyzer Tool includes a performance data collection engine that is used to query performance counter objects on computers that are running Exchange 2000 Server or Exchange Server 2003. The performance data collection engine collects data from the Bytes Total/sec performance counter of the Network Interface performance object to analyze performance data.

The Bytes Total/sec performance counter shows the rate at which the network adapter is processing data bytes. This counter includes all application and file data, in addition to protocol information, such as packet headers. The Bytes Total/sec performance counter is the sum of the Network Interface\Bytes Received/sec and Network Interface/Bytes Sent/sec.

The Exchange Server Analyzer reports the maximum value for the performance counter during the collection interval. For a 100 megabits per second (Mbps) network adapter, the value of the Bytes Total/sec performance counter should be under 7 megabytes/second. For a 1000 Mbps network adapter, the value of the Bytes Total/sec performance counter should be under 70 megabytes/second. If Bytes Total/sec exceeds 7 percent of the bandwidth of the network, the Exchange Server Analyzer displays an error.

This error usually indicates that the server is experiencing periods of unresponsiveness, causing mail flow to slow down or stop. Additionally, Microsoft Outlook® clients who connect to this server may receive the RPC cancel Request dialog box.

The following are some of the possible causes of this error:

  • A network interface card (NIC) on the computer cannot support the maximum bandwidth supported by your network infrastructure.

  • There is too much load on the server.

  • Viruses or SPAM are causing sudden elevated network usage patterns.

To resolve this error,

  • If a NIC is does not support the maximum bandwidth of your network, upgrade the NIC to support a faster bandwidth.

  • Reduce the load on the server. You can do this by moving mailboxes to a server that has fewer mailboxes. If it is required, add an additional Exchange server to your environment.

  • If you suspect that the unusually high load is not caused by too many mailboxes on a server, try to identify the source of the unusually high load and stop it.

  • Consider the best practices in the following articles:

    • For information about network bandwidth considerations, see Network Performance in "Understanding Exchange Performance" in the Performance and Scalability Guide for Exchange Server 2003 (

    • For information about troubleshooting network problems, see "Ruling Out Network-Bound Problems" in Troubleshooting Microsoft Exchange Server 2003 Performance (