We recently made a significant upgrade in bandwidth on the WAN to our other sites (from 1.5 meg to 10 meg)
Here in the last week or so the Lync server seems to be pushing out 20 - 30 megs pretty consistently. I have done some packet captures and find that it looks like Lync traffic as best I can tell, but I check with the users who are on the other end and they are not doing any video, audio and usually not much if any chat. I had thought maybe Lync shapes traffic based on bandwidth and now with bigger pipes it is using more, but it does not seem to be consistent rather usually pushing mostly to a few users much higher than others.
Can anyone tell what this might be? Is Lync pushing updates? Might this be something nefarious? What are some things I can look for since much of the Lync traffic is encrypted?