DCKeta, I'm not a network guy by profession but here's what i have to say: Your netstat dump may not be reflective of the MGRT graph you posted... The dump doesn't really show much bandwidth intensive connections established...(unless you're uploading or downloading a large file, in which case even port 80 could take up lotsa bandwidth)... This sounds kinda fishy but it shouldn't even use your network card since it should really use the loopback channel: TCP 127.0.0.1:3983 127.0.0.1:3984 ESTABLISHED TCP 127.0.0.1:3984 127.0.0.1:3983 ESTABLISHED does your MGRT graph also include the local loopback? I'd also examine the CRT sessions since they appear to have been tunneled over port 22?...there's certainly some overhead... like i said, i don't practice networking... speaking pretty much based on the theoretical training and some personal experience... so i could be wrong. why don't you start a new thread with an appropriate topic so that it may draw an expert's attention?