HERE is why!
Today from cluster2 windows1 we had was looked to be a DOS attack, but more normal traffic flows. After searching all the usual suspects we found that it was someone connecting to an external MSSQL server.
We also have this issue from the MSSQL servers to external web servers, so it works in both ways.
They were using a CONTINUAL 160mb of traffic, just for their MSSQL connection.
This is why we block such when required, if someone wants totally open connections to external MSSQL, it has to be paid, this is unaccounted traffic we have to pay for, because we know who did it, but cannot bill them for the excess bandwidth.
Attached graphs:
