We have 2 sites with DFS-R between them. All files are edited on Server1 at our HQ, and synced down to Server2 at our DR site. In late December, Server1 hung up and required a hard shutdown. It came up fine, and after several hours it logged that the DFS database had recovered successfully.
Ever since then, we've had very consistent DFS traffic (about 1.1Mbps) from the DC to HQ. When I run a dfsrdiag replication state or dfsrdiag backlog, there are no files actively replicating in that direction, and no backlog. Files still replicate fine among all members, but this steady traffic is hurting our bandwidth, and I'm curious what it is.
Before the restart, traffic was very consistent - no traffic overnight, with peaks during the day as changes replicated from HQ to DR (I can't post images, but Cacti graph is at http://s22.postimg.org/itsz8qz8x/traffic_normal.png)
After, there's heavy traffic from DC to HQ, with the only drops when there is traffic in the other direction for syncs (cacti graph at http://s28.postimg.org/m79h8qgnh/traffic_heavy.png)
I've looked at the log files but can't see what's happening. How can I find out what this traffic is, and stop it?