network slows down

[yatot]

my network does slow down after every 5 minutes (more or less) of net activity. after several minutes, it goes back normally. the OS before was windows 2000 advanced server and i've tried installing the windows XP as a server in another computer (server capable). for about 5 (i think) hours after i've installed the XP. the network was working pretty good including the net activity of workstations. there is no problem in LAN actually. it seems like just our internet connection goes slow. so i've uninstalled the XP (formatted, unpartitioned) and installed linux (gutsy gibbon). now, my server is fine and working good for several days. just before the year ends. the problem occured once again.

does anyone had the same problem with their network or maybe i was infiltrated with virus or spam or whatever?

i badly need some help. thank you.

[SirDice]

Run a sniffer and have a look...

[AngelicKnight]

How well versed are you in network troubleshooting? I'd start by waiting until it slows down again. When it does, simply run a tracert to google.com or something, and see if you can spot where packets are dropping or slowing down. That will help you first determine if the problem is internal or with your ISP. This could be anything from a bad router to an infected computer on the network hogging bandwidth to who knows what. We need more info.

[nihil]

Is this problem still happening? I could understand poor performance around Christmas and the New Year because traffic is much heavier.

[yatot]

just got to the office. sorry for the late reply.

SirDice: what's the use of sniffer? am currently running windows 2k adv. server (the old server).

AngelicKnight: i just did a tracert to google ad here's the result:

Tracing route to google.com [64.233.187.99]
over a maximum of 30 hops:


1 2 ms 1 ms 1 ms 192.168.1.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 312 ms 311 ms 311 ms jc-in-f99.google.com [64.233.187.99]

Trace complete.

that 192.168.1.1 is the ip address of my server's modem which connect to the internet.

[yatot]

Is this problem still happening? I could understand poor performance around Christmas and the New Year because traffic is much heavier.

even before christmas and after new year the problem occurs. we already changed ISP bcoz we thought that the problem was with the ISP.

[nihil]

OK, it was just a thought. I would still be inclined to have your connection checked.

I assume that although you changed your ISP, your connection remains the same? OK I don't know your architecture so I am guessing it is something like I see around here. You connect to your telco along their copper wire, and then to your ISP.

[yatot]

yes, same architecture on LAN. my server does have two NIC, one for the LAN and the other to modem/router which the latter NIC is shared for LAN.

[nihil]

Hi,

What is your connectivity: wired, wireless or a mixture?

I would suggest the following:

1. Get your telephone company to check the line.
2. Try different cables to connect to the router/modem.
3. Try swapping the two NICs over.
4. Can you try a different modem/router?

At the moment I am not suspecting malware, given the different operating systems that you have tried. If it is malware then it is something pretty exotic to survive those changes.

At this point i would also start checking my logs and management software and see exactly what my users are getting up to. It only takes one idiot hogging the bandwidth? Obviously, if you have a rogue user, it doesn't matter what operating system you are using, as it is their activities that are causing the problem.

[SirDice]

jSirDice: what's the use of sniffer?

A sniffer is a simpler word for Network Protocol Analyzer. It shows you the IP packets that are on the "line". You would need to have some TCP/IP knowledge.

http://www.wireshark.org