Network Traffic Problem
Discussion
Have a problem here that ive run out of ideas on how to fix.
Since changing ISP we have had all sorts of connectivity problems, had the isp on the phone pinging our router and they also noticed the problems i had noticed, the very high fluctuating response times (sometimes as high as 3000ms!). We did some tests pulling the connection from the router to the LAN then everything was perfect again, plug it back in give it a few seconds and the problems returned.
So must be a problem internally something generating a lot of traffic spent that night switching on 1 machine at a time and checking the response rates ended up with every machine on the network on and response times perfect.
So guessed it must be something people are doing on their machines tried a similar process logging on only a few people at a time, this time I got some problems but cannot pinpoint it. (eg getting really high response times unplug the one router times immediately drop – plug it back in and the times are still low and stay low, seems I can pull the plug on anything and it will fix it momentarily!)
Have tried isolating the 3 switches to try and find a problem had similar results high responses disconnect a switch and they’ll go back to normal but eventually go back up again same results using all 3 switches.
Have also noticed strange response times from the switches themselves that can be as high as 300ms for a switch my laptop is plugged directly into thes time will go on for about 5 – 10 secs then drop back to <1ms.
Any ideas or help greatly appreciated.
Since changing ISP we have had all sorts of connectivity problems, had the isp on the phone pinging our router and they also noticed the problems i had noticed, the very high fluctuating response times (sometimes as high as 3000ms!). We did some tests pulling the connection from the router to the LAN then everything was perfect again, plug it back in give it a few seconds and the problems returned.
So must be a problem internally something generating a lot of traffic spent that night switching on 1 machine at a time and checking the response rates ended up with every machine on the network on and response times perfect.
So guessed it must be something people are doing on their machines tried a similar process logging on only a few people at a time, this time I got some problems but cannot pinpoint it. (eg getting really high response times unplug the one router times immediately drop – plug it back in and the times are still low and stay low, seems I can pull the plug on anything and it will fix it momentarily!)
Have tried isolating the 3 switches to try and find a problem had similar results high responses disconnect a switch and they’ll go back to normal but eventually go back up again same results using all 3 switches.
Have also noticed strange response times from the switches themselves that can be as high as 300ms for a switch my laptop is plugged directly into thes time will go on for about 5 – 10 secs then drop back to <1ms.
Any ideas or help greatly appreciated.
Is it the same router that you used previously?
Is the port on the switch set to autonegotiate or is the speed set to match the routers?
Could be a problem with speed/duplex negotiation.
However if the problem only occured when you switched ISP, it's best to avoid focusing on the LAN as it could mislead your diagnosis.
Is the port on the switch set to autonegotiate or is the speed set to match the routers?
Could be a problem with speed/duplex negotiation.
However if the problem only occured when you switched ISP, it's best to avoid focusing on the LAN as it could mislead your diagnosis.
get a copy of ethereal (free you need winpcap also on windows) and run it on the link to the router if there is that much traffic it should be fairly obvious especially if you know what should be leaving your network.
If your switches aren't managed then you will need to put the router and the ehtereal capture pc on a hub together to make sure you capture all the traffic going through the router.
Do you have AV on the clients and is it up to date?
If your switches aren't managed then you will need to put the router and the ehtereal capture pc on a hub together to make sure you capture all the traffic going through the router.
Do you have AV on the clients and is it up to date?
Thanks for your replies.
i have tried it on 2 routers so far the old one we used to use with the old ISP and on a new temporary one ive been lent, the reason we changed was to set up a bonded ADSL service so have a Cisco router configured for the bonding but when we plug the 2 lines into that the problems get worse so have to resolve the issues before i can switch over to the bonded.
The port on the switch is set to autonegotiate speed and duplex.
To start with i was focused on it being an ISP problem however with the LAN unplugged the response times were perfect if pinged from outside, with the LAN plugged back in the response rates went up again.
I'll have a go at setting up the router/firewall on a hub and examining the traffic coming through.
Thanks for all the replies
i have tried it on 2 routers so far the old one we used to use with the old ISP and on a new temporary one ive been lent, the reason we changed was to set up a bonded ADSL service so have a Cisco router configured for the bonding but when we plug the 2 lines into that the problems get worse so have to resolve the issues before i can switch over to the bonded.
The port on the switch is set to autonegotiate speed and duplex.
To start with i was focused on it being an ISP problem however with the LAN unplugged the response times were perfect if pinged from outside, with the LAN plugged back in the response rates went up again.
I'll have a go at setting up the router/firewall on a hub and examining the traffic coming through.
Thanks for all the replies
If it is worm/mailer activity on a PC, it might not start as soon as you plug the router in but might take a few minutes to kick in.
Another vote for Ethereal here too - its the danglies for this! Might have to chain a dumb hub inbetween the router and the LAN and sniff on that to see anything though, obviousley if you're fully switched then otherwise you'l only see broadcast.
Another vote for Ethereal here too - its the danglies for this! Might have to chain a dumb hub inbetween the router and the LAN and sniff on that to see anything though, obviousley if you're fully switched then otherwise you'l only see broadcast.
borris-bear said:
Have a problem here that ive run out of ideas on how to fix.
Since changing ISP we have had all sorts of connectivity problems, had the isp on the phone pinging our router and they also noticed the problems i had noticed, the very high fluctuating response times (sometimes as high as 3000ms!). We did some tests pulling the connection from the router to the LAN then everything was perfect again, plug it back in give it a few seconds and the problems returned.
So must be a problem internally something generating a lot of traffic spent that night switching on 1 machine at a time and checking the response rates ended up with every machine on the network on and response times perfect.
So guessed it must be something people are doing on their machines tried a similar process logging on only a few people at a time, this time I got some problems but cannot pinpoint it. (eg getting really high response times unplug the one router times immediately drop – plug it back in and the times are still low and stay low, seems I can pull the plug on anything and it will fix it momentarily!)
Have tried isolating the 3 switches to try and find a problem had similar results high responses disconnect a switch and they’ll go back to normal but eventually go back up again same results using all 3 switches.
Have also noticed strange response times from the switches themselves that can be as high as 300ms for a switch my laptop is plugged directly into thes time will go on for about 5 – 10 secs then drop back to <1ms.
Any ideas or help greatly appreciated.
I had an IDENTICAL problem just before Christmas.
After weeks of being fobbed off by my ISP, swapping out hardware, scouring firewall logs, packet sniffing with ethereal etc... I went back to them and insisted that they escalate the case as I was 100% certain the problem was not at my end. They called the next day to say they had found a fault at the exchange. They fixed it and the problem went away.
The main symptons I experienced at first were very slow web browsing and e-mails taking ages to go; the IMC outbound queue in Exchange just kept backing up. I tried the ping test and spotted the very high response times. Tried all the things you have tried and all the suggestions posted on this thread to no avail. I could reproduce the problem simply by sending an e-mail with a reasonably large attachment. I set up an account in Outlook Express configured to send directly to our ISPs mail server (to eliminate Exchange from the equation). The instant I clicked Send the ping response times dropped through the floor. It seems that the connection was simply unable to deal with the normal load we placed on it due to the faulty equipment in the exchange.
If I disconnected the router from the LAN the ISP could ping my router and get good response times. They used this to convince me that the problem must be at my end. I swallowed this for over a week before insisting they look more closely at their end. They found the fault within a few hours.
>> Edited by pcwilson on Tuesday 28th February 11:57
These were my thoughts exactly as i was pinging our external address from home and during the times when the responses seemed to be OK i was still getting fluctuations of between 23 and 50ms when at the same time i was pinging google and only getting fluctuations of 12 - 14ms.
The ISP says these times are perfectly acceptable. my argument being that these responses show the problem on a small scale and when you load up the line with traffic the problem is obviously far more drastic. They're absolutely confident thats its our end.
Funny how the problems only started when we had a new line put in (making a total of 2 for the bonded) and switched ISP that the problems started.
The ISP says these times are perfectly acceptable. my argument being that these responses show the problem on a small scale and when you load up the line with traffic the problem is obviously far more drastic. They're absolutely confident thats its our end.
Funny how the problems only started when we had a new line put in (making a total of 2 for the bonded) and switched ISP that the problems started.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff