We have a network that consists of 300+ workstations, mostly win xp, 10
servers (file, email, antivirus, and sus) and about 20 network
printers. Linking these w/s are a combination of switches and hubs (90%
10/100 switches although there are still a few 10/100 hubs present).
All of these workstations, switches, and servers are interspersed
throughout two 7 story buildings. We are connected to the internet by a
full T1 line. Lately, at certain times of the day (never at a fixed
time and never on a predetermined day), our internet access slows to a
point where everyone on the network is crawling. Our internet access
has never behaved like this. The number of machines has not increased
significantly on our network in one year. I was advised to use a
protocol sniffer which I did and found nothing out of the ordinary
other than high ARPage from our servers. I've checked for machines with
viruses and found none. Does someone know of something else to look for
on the protocol sniffer or for that matter anything else that might
help me out?
DComTalk.com
Discussion of VoIP, VPN, Video Conferencen, DSL and other data commucations.
Slow down of internet service
6 posts
• Page 1 of 1
Re: Slow down of internet service
by Hansang Bae » Mon Nov 28, 2005 4:20 am
lelo wrote:
What was the utilization on the router interface facing your Internet
connection? Not sure what protocol analyzer you used, but I'm not sure
what you mean by "nothing out of the ordinary" The way you phrased
this post (no offense meant) tells me you may not know - fully - what
to look for in the traces. But if you use Ethereal (for example) and
watch the router interface with the T1 connection, you will see traffic
patterns. Perhaps there is someone is clogging it up with P2P
programs, for example.
--
hsb
"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************
We have a network that consists of 300+ workstations, mostly win xp,
10 servers (file, email, antivirus, and sus) and about 20 network
printers. Linking these w/s are a combination of switches and hubs
(90% 10/100 switches although there are still a few 10/100 hubs
present). All of these workstations, switches, and servers are
interspersed throughout two 7 story buildings. We are connected to
the internet by a full T1 line. Lately, at certain times of the day
(never at a fixed time and never on a predetermined day), our
internet access slows to a point where everyone on the network is
crawling. Our internet access has never behaved like this. The number
of machines has not increased significantly on our network in one
year. I was advised to use a protocol sniffer which I did and found
nothing out of the ordinary other than high ARPage from our servers.
I've checked for machines with viruses and found none. Does someone
know of something else to look for on the protocol sniffer or for
that matter anything else that might help me out?
What was the utilization on the router interface facing your Internet
connection? Not sure what protocol analyzer you used, but I'm not sure
what you mean by "nothing out of the ordinary" The way you phrased
this post (no offense meant) tells me you may not know - fully - what
to look for in the traces. But if you use Ethereal (for example) and
watch the router interface with the T1 connection, you will see traffic
patterns. Perhaps there is someone is clogging it up with P2P
programs, for example.
--
hsb
"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************
- Hansang Bae
Re: Slow down of internet service
by Patrick Schaaf » Mon Nov 28, 2005 4:20 am
"lelo" <leroyd@optonline.net> writes:
Look at the T1. A T1 is only 1.5% the bandwith of each of your 300 hosts.
So it is absolutely trivial for any single host to clog the available
outside bandwidth. So this is what you'll need to look for.
If this is the first time you notice such problems, this is the ideal
time to create some semblance of a network management. Apart from
sniffing-when-things-are-gone-bad, this involves round-the-clock
measurement of at least the bandwidth usage on the T1, and packet
drops on the T1's router interface. The most common open source
software used for such basic monitoring, can be found at
http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/
BTW, if you have further questions, this newsgroup is probably not
the best one to ask. comp.dcom.net-management may be more appropriate.
Or, depending on the importance of the internet connection for your
operation, and a possible total lack of inhouse competence in these
matters, maybe a good network consultant would be even more appropriate.
best regards
Patrick
Does someone know of something else to look for on the protocol sniffer
Look at the T1. A T1 is only 1.5% the bandwith of each of your 300 hosts.
So it is absolutely trivial for any single host to clog the available
outside bandwidth. So this is what you'll need to look for.
If this is the first time you notice such problems, this is the ideal
time to create some semblance of a network management. Apart from
sniffing-when-things-are-gone-bad, this involves round-the-clock
measurement of at least the bandwidth usage on the T1, and packet
drops on the T1's router interface. The most common open source
software used for such basic monitoring, can be found at
http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/
BTW, if you have further questions, this newsgroup is probably not
the best one to ask. comp.dcom.net-management may be more appropriate.
Or, depending on the importance of the internet connection for your
operation, and a possible total lack of inhouse competence in these
matters, maybe a good network consultant would be even more appropriate.
best regards
Patrick
- Patrick Schaaf
Re: Slow down of internet service
by lelo » Mon Nov 28, 2005 11:55 pm
You are correct in the assumption that I'm not experienced in using a
protocol analyzer and I take no offense to the statement. It was the
free ethereal protocol analyzer that I used but other than hints from
other inexperienced people I know very little of it's correct usage.
Any ideas will be greatly appreciated.
Hansang Bae wrote:
protocol analyzer and I take no offense to the statement. It was the
free ethereal protocol analyzer that I used but other than hints from
other inexperienced people I know very little of it's correct usage.
Any ideas will be greatly appreciated.
Hansang Bae wrote:
lelo wrote:
We have a network that consists of 300+ workstations, mostly win xp,
10 servers (file, email, antivirus, and sus) and about 20 network
printers. Linking these w/s are a combination of switches and hubs
(90% 10/100 switches although there are still a few 10/100 hubs
present). All of these workstations, switches, and servers are
interspersed throughout two 7 story buildings. We are connected to
the internet by a full T1 line. Lately, at certain times of the day
(never at a fixed time and never on a predetermined day), our
internet access slows to a point where everyone on the network is
crawling. Our internet access has never behaved like this. The number
of machines has not increased significantly on our network in one
year. I was advised to use a protocol sniffer which I did and found
nothing out of the ordinary other than high ARPage from our servers.
I've checked for machines with viruses and found none. Does someone
know of something else to look for on the protocol sniffer or for
that matter anything else that might help me out?
What was the utilization on the router interface facing your Internet
connection? Not sure what protocol analyzer you used, but I'm not sure
what you mean by "nothing out of the ordinary" The way you phrased
this post (no offense meant) tells me you may not know - fully - what
to look for in the traces. But if you use Ethereal (for example) and
watch the router interface with the T1 connection, you will see traffic
patterns. Perhaps there is someone is clogging it up with P2P
programs, for example.
--
hsb
"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************
- lelo
Re: Slow down of internet service
by Hansang Bae » Tue Nov 29, 2005 2:46 am
lelo wrote:
If in fact, you're T1's are being swamped, you need to find out if it's
legitimate traffic or some bogus traffic. So here's what I would do.
1) Track the T1 interface's utilization using MRTG. *VERY* easy to
setup as there are step by step instructions on setting it up.
2) span the router's Ethernet port to a PC running Ethereal. Capture
using bytes size of 128 bytes. You don't need the full packet for
stuff like this.
Capture for a bit (say 15 minutes) and use the following filters in
Ethereal:
tcp.analysis.retransmissions
You can also use Statistics, Endpoints, and look at the TCP stats. Are
they legitimate?
You can also enable netflow (or cflow if it's not a Cisco router) and
export it to many free netflow collectors. This will give you a
running total of IP/pairs/port numbers/packet sizes. Basically, a
who's who listing of your network.
--
hsb
"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************
You are correct in the assumption that I'm not experienced in using a
protocol analyzer and I take no offense to the statement. It was the
free ethereal protocol analyzer that I used but other than hints from
other inexperienced people I know very little of it's correct usage.
Any ideas will be greatly appreciated.
If in fact, you're T1's are being swamped, you need to find out if it's
legitimate traffic or some bogus traffic. So here's what I would do.
1) Track the T1 interface's utilization using MRTG. *VERY* easy to
setup as there are step by step instructions on setting it up.
2) span the router's Ethernet port to a PC running Ethereal. Capture
using bytes size of 128 bytes. You don't need the full packet for
stuff like this.
Capture for a bit (say 15 minutes) and use the following filters in
Ethereal:
tcp.analysis.retransmissions
You can also use Statistics, Endpoints, and look at the TCP stats. Are
they legitimate?
You can also enable netflow (or cflow if it's not a Cisco router) and
export it to many free netflow collectors. This will give you a
running total of IP/pairs/port numbers/packet sizes. Basically, a
who's who listing of your network.
--
hsb
"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
********************************************************************
- Hansang Bae
Re: Slow down of internet service
by David Tiktin » Tue Nov 29, 2005 8:32 pm
On 27 Nov 2005, "lelo" <leroyd@optonline.net> wrote:
I'm not sure a protocol analyser is the best tool for this problem.
The first thing you need to do is determine if the problem is on your
end or somewhere on the other side of the T1. You don't say what
kind of router is on your end of the T1, but it likely can give you
usage statistics per interface. You might check the free MRTG tool
which would allow you to monitor traffic patterns easily and to see
if there are usage spikes on your end:
http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
If you can't do this yourself, ask your ISP for help. If they know
what they're doing, they should be able to give you data on use of
your T1. They may even use MRTG ro its commercial equivalent. (If
they don't know what they're doing, you might want to switch ISPs!)
I work in a network situation much like you describe, but on a
smaller scale, 20+ machines behind a DSL connection. We also have
periodic internet "brown-outs", but when I take the time to track
down the problem (that is, when it lasts more than a minute or two),
it's almost always at our ISP, often due to configuration changes or
equipment upgrades gone awry. Once in a great while someone here is
downloading a 700 Mb ISO or something, but I can find out just by
asking a half dozen people.
Dave
--
D.a.v.i.d T.i.k.t.i.n
t.i.k.t.i.n [at] a.d.v.a.n.c.e.d.r.e.l.a.y [dot] c.o.m
We have a network that consists of 300+ workstations, mostly win
xp, 10 servers (file, email, antivirus, and sus) and about 20
network printers. Linking these w/s are a combination of switches
and hubs (90% 10/100 switches although there are still a few
10/100 hubs present). All of these workstations, switches, and
servers are interspersed throughout two 7 story buildings. We are
connected to the internet by a full T1 line. Lately, at certain
times of the day (never at a fixed time and never on a
predetermined day), our internet access slows to a point where
everyone on the network is crawling. Our internet access has never
behaved like this. The number of machines has not increased
significantly on our network in one year. I was advised to use a
protocol sniffer which I did and found nothing out of the ordinary
other than high ARPage from our servers. I've checked for machines
with viruses and found none. Does someone know of something else
to look for on the protocol sniffer or for that matter anything
else that might help me out?
I'm not sure a protocol analyser is the best tool for this problem.
The first thing you need to do is determine if the problem is on your
end or somewhere on the other side of the T1. You don't say what
kind of router is on your end of the T1, but it likely can give you
usage statistics per interface. You might check the free MRTG tool
which would allow you to monitor traffic patterns easily and to see
if there are usage spikes on your end:
http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
If you can't do this yourself, ask your ISP for help. If they know
what they're doing, they should be able to give you data on use of
your T1. They may even use MRTG ro its commercial equivalent. (If
they don't know what they're doing, you might want to switch ISPs!)
I work in a network situation much like you describe, but on a
smaller scale, 20+ machines behind a DSL connection. We also have
periodic internet "brown-outs", but when I take the time to track
down the problem (that is, when it lasts more than a minute or two),
it's almost always at our ISP, often due to configuration changes or
equipment upgrades gone awry. Once in a great while someone here is
downloading a 700 Mb ISO or something, but I can find out just by
asking a half dozen people.
Dave
--
D.a.v.i.d T.i.k.t.i.n
t.i.k.t.i.n [at] a.d.v.a.n.c.e.d.r.e.l.a.y [dot] c.o.m
- David Tiktin
6 posts
• Page 1 of 1
Who is online
Users browsing this forum: No registered users and 0 guests