Bandwidth Saturated - Can't find culprit

Why not create a firewall rule to allow traffic to this specific IP and put logging on?

 

Or create a rule to this specific IP and drop it, just to see what happens or breaks?

Should have though of that myself...

I performed a packet capture and turns out this data is all BITS (Microsoft Update) related. I thought I had a policy in place for this and I do, however it does not seem to be working. 

In the packet capture I am seeing it classified and traffic shaping being correctly applied to it but it's still running at about 22Mbps. Is there something wrong in my policy?

I checked and the work hours are correct and the time is set correctly on the device

Should have though of that myself...

I performed a packet capture and turns out this data is all BITS (Microsoft Update) related. I thought I had a policy in place for this and I do, however it does not seem to be working. 

In the packet capture I am seeing it classified and traffic shaping being correctly applied to it but it's still running at about 22Mbps. Is there something wrong in my policy?

I checked and the work hours are correct and the time is set correctly on the device

You traffic policy is set at 2560000 KBps, Kilo Bytes per second.

So this equals 2.56 MBps, Mega Bytes per second. This looks quite consistant with your graph.

 

2.56 MBps equals a bit less than 21 Mbit/sec, and looking at the fact that you have a 25 Mbit/sec line, you are flirting with the limits of your line.

Have another look, that is the default but I've overridden it with a "work hours" (0500-2200) limit of 125 KBps or 1Mbps. Or maybe I am incorrectly understanding this? Thanks

In order to make sure you did not make a mistake in your work hours limit policy, you might want to try to set lower the normal limit for windows updates.

At least you are able to see if that solves your problem.