Hi all,

Ok, i give up - i've spent the best part of the last couple of weeks trying to get to the bottom of this problem at work - can someone help me?? Plleeease!

We have a small network of less than 20 machines. Mostly XP clients (a couple of Win7'ers), with Server 2008 as DHCP, DNS & Domain Controller, another 2008 box as a VM for VPN, and another couple of server 2003 boxes for file storage & sharepoint duties.

Firewall responsibilities are left to Fsecure on the clients and the main router.

Now, the problem is, as the first person arrives in the morning, they will find the connection perfectly fine with speedtest.net giving a nice & healthy 4MBs download speed. Gradually as people switch on and log in that 4Mb is munched away at until it's below 0.5Mb! It stays like that for the rest of the day.

It's almost like each machine 'takes' some bandwidth on switch on, and doesn't give it back - leaving an almost unusable connection for all people.

Does anyone have any ideas of what i can try/look for?

We do have 2 managed switches (Linksys SRW2024) but i haven't a clue how to use the management console to diagnose a problem. (i'm learning on the job )

I'm hoping there's some diagnostics i can do without having to sit on every machine...

Thanks in advance - i hope that's enough info - if not, i can supply more!

MPM

it sounds like you have some software installed thats polling the web all the time. 4mb should be more than enough for that number of users.

To start with I would put a packet sniffer on the lan and see what the traffic looks like. Switch off all the PC's, then go round them turning them on, and checking the sniffer to see what its trying to talk to. You can get basic packet sniffers for free, just google for one. We use a comercial one, but a basic one should do for you.

You can check which servers and so on a desktop is connected to, by dropping to a cmd prompt and entering: netstat -a this shows the active ports on the desktop, and the destination of those, so it should be easy to spot something outside your network.

Some questions that may help:

Do you have any PC's where users have installed something they shouldnt (eg. bittorrent client)

Are the users using streaming services (youtube, iplayer, bbc news ticker) etc.

Do your users VPN, or access other systems offisite (Citrix, Netilla etc.)

Whatever is munching the bandwidth is doing it quietly, i'm 99% sure it's not someone streaming/bittorrent etc. as the internet is unusable due to its slowness.

I also confirmed noone is running BTorrent yesterday - i got a resounding "Nope, connection is to slow to bother" :P

Do you have any hot tips on the use of packet sniffers? I've been down that route and i'm unsure where to install them, and how to interpret the results. Sorry if that's a stupid question - i'm learning as i go on this one...

Ta,

MPM

When we had this issue at my last place, we found that one member of staff was using a nntp client to download oodles of p0rn to his desktop from Usenet. The particular client was pulling about 8 download streams at once. We only worked it out when he went on holiday and everything started working normally.

Phil

Do you have any hot tips on the use of packet sniffers? I've been down that route and i'm unsure where to install them, and how to interpret the results.

You can just run it on the PC, as long as its connected to the lan it should see all the traffic as it switches the NIC to a mode where it can see everything. What you will see is all the network traffic from all the PCs, to whatever they are talking to. The trick is to look for destination or source IP addresses which are not on your network, you can then do a reverse DNS lookup on the IP address to get an idea of whats being communicated with.

If you are having trouble, try the switch everything off route, then turn each pc on one by one and see if its all machines or just one that causing the true slowdown.

We had an issue with adobe and its update service, when adobe released an update. We had 300+ machines trying to download a 30MB update across a 2mb internet connection, and everything just stopped.

We had an issue with adobe and its update service, when adobe released an update. We had 300+ machines trying to download a 30MB update across a 2mb internet connection, and everything just stopped.

Good old Adobe. Gotta love 'em.

Phil

You can just run it on the PC, as long as its connected to the lan it should see all the traffic as it switches the NIC to a mode where it can see everything. What you will see is all the network traffic from all the PCs, to whatever they are talking to. The trick is to look for destination or source IP addresses which are not on your network, you can then do a reverse DNS lookup on the IP address to get an idea of whats being communicated with.

That won't necessarily see all the traffic on the network though - the switch will only forward broadcast traffic , and packets destined to your PC or an unknown machine out of the port you are connected to.

If there is someone running bittorrent or spyware then that data will be switched directly to the router.

To get round that you can either set up the switch to mirror traffic onto your port , or put a hub between the switch and router and connect your PC there.

Wireshark is a handy free sniffer.

Oh , and double check that nobody has anything daft like extra mini switches or multi-homed PCs that could be putting a loop on the network.