Office LAN Bandwidth Problems

[Darthshearer]

Morning Guys

Just a quick one. Our Office LAN is dying its death. We currently have 2 servers to my knowledge.

The one that is running our outlook & internet is virtually dead. Our "IT Dept" (A guy who aint brilliant) has said he knows its coming from internal. I.e its a PC internally bringing down the net.

Now, I dont know how he has come to this conclusion, but is there a way we can find out what IP is taking up all the bandwidth?

Cheers

Darth

 

[Insane]

Wireshark it?
Install it onto a laptop, as you will need to be pretty mobile to do this.

Plug it in and run wireshark, let it pick up the traffic and see what the major network traffic is, most probably broadcasts to 255.255.255.255 (or 192.168.1.255 if your network is 192.168.1.0/24) and you can trace back what's doing it all, possible causes can be some network teaming software on certain servers (*cough* dell 2950's with intel dual NICS *cough*) sending out what I call "detection" packets to decide if the link is up, or down

Next option is if you have a decent managed switch (like a layer 2/3 Cisco) you could sit beside the switch and clone each port individually and sniff the traffic to see what each individual machine is doing, if you dont have a fancy switch you will need to find yourself a really old network hub and put it in-line, i.e.

[switch]-----[hub]-----[server]

and attach the laptop to the hub, cloning the port on the switch is just doing the hub trick virtually (and a lot less hassle!)

Might be worthwhile checking the network drivers for the outlook/internet server, in case your "it dept" guy decided in a sudden flush of inspiration to update them because "windows update said so"

Your best bet is to try and find out whats changed or happened recently, i'm guessing since its revolving around one server being slow (which affects outlook and internet) it might be network card, patch cabling or drivers.

If all else fails, check the server isnt processor-intensive or got rogue processes hogging the memory, if its an exchange server it does like to eat RAM up and anything else on the box will just slow it down.

 

[Dark Orb Choir]

the easiest way (depending on how many users there is) would be to turn them al loff and turn them on one by one until the network starts falling over..


capturing packets of data is too complicated and time consuming and it gets complicated, you mentioned your IT guy isnt a very lbright star in the sky.

so its easy to do what i suggested yourself.

 

[TdC]

tbh what Insane said imo. If your IT person can't work out where the noise is coming from with no more than a laptop and some free software then it's time to get a new person to do it. imo ofc.

if the traffic is "magically" appearing it could even be a bad nic spouting rubbish into the wire. that may make it slightly harder but still quite doable as the person plugs into each segment to see what's going on.

 

[Insane]

If your IT person can't work out where the noise is coming from with no more than a laptop and some free software then it's time to get a new person to do it. imo ofc.

ideally you should go out and get a network specialist in to have a gander at the network anyhow, its why theres such things as "network healthchecks" bounded about in higher-level companies, you just need one old Jetdirect board spamming out IPX and thats your network raped because your switches are having to fire this out to everyone.

What you will find is that too many broadcasts from a NIC will murder your network, especially if you bought a couple of cheapo £20 switches.. those do not have the memory available to even handle 4 machines sending out network broadcasts.

Actually, what is the physical make of the servers and the network switches? it might help troubleshoot it farther if we can understand part of the physical make-up.

 

[inactionman]

If you've got a managed switch all you need to do is logon and see the port usage and errors, the port that has the highest usage/errors will be the one with the problem. If that port leads to another switch, you start again.