network slows down

my network does slow down after every 5 minutes (more or less) of net activity. after several minutes, it goes back normally. the OS before was windows 2000 advanced server and i've tried installing the windows XP as a server in another computer (server capable). for about 5 (i think) hours after i've installed the XP. the network was working pretty good including the net activity of workstations. there is no problem in LAN actually. it seems like just our internet connection goes slow. so i've uninstalled the XP (formatted, unpartitioned) and installed linux (gutsy gibbon). now, my server is fine and working good for several days. just before the year ends. the problem occured once again.

does anyone had the same problem with their network or maybe i was infiltrated with virus or spam or whatever?

i badly need some help. thank you.

Run a sniffer and have a look...

How well versed are you in network troubleshooting? I'd start by waiting until it slows down again. When it does, simply run a tracert to google.com or something, and see if you can spot where packets are dropping or slowing down. That will help you first determine if the problem is internal or with your ISP. This could be anything from a bad router to an infected computer on the network hogging bandwidth to who knows what. We need more info.

Is this problem still happening? I could understand poor performance around Christmas and the New Year because traffic is much heavier.

just got to the office. sorry for the late reply.

SirDice: what's the use of sniffer? am currently running windows 2k adv. server (the old server).

AngelicKnight: i just did a tracert to google ad here's the result:

Tracing route to google.com [64.233.187.99]
over a maximum of 30 hops:


1 2 ms 1 ms 1 ms 192.168.1.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 312 ms 311 ms 311 ms jc-in-f99.google.com [64.233.187.99]

Trace complete.

that 192.168.1.1 is the ip address of my server's modem which connect to the internet.

Quote:

---

Originally Posted by nihil

Is this problem still happening? I could understand poor performance around Christmas and the New Year because traffic is much heavier.

---

even before christmas and after new year the problem occurs. we already changed ISP bcoz we thought that the problem was with the ISP.

OK, it was just a thought. I would still be inclined to have your connection checked.

I assume that although you changed your ISP, your connection remains the same? OK I don't know your architecture so I am guessing it is something like I see around here. You connect to your telco along their copper wire, and then to your ISP.

yes, same architecture on LAN. my server does have two NIC, one for the LAN and the other to modem/router which the latter NIC is shared for LAN.

Hi,

What is your connectivity: wired, wireless or a mixture?

I would suggest the following:

1. Get your telephone company to check the line.
2. Try different cables to connect to the router/modem.
3. Try swapping the two NICs over.
4. Can you try a different modem/router?

At the moment I am not suspecting malware, given the different operating systems that you have tried. If it is malware then it is something pretty exotic to survive those changes.

At this point i would also start checking my logs and management software and see exactly what my users are getting up to. It only takes one idiot hogging the bandwidth?;) Obviously, if you have a rogue user, it doesn't matter what operating system you are using, as it is their activities that are causing the problem.

Quote:

---

Originally Posted by yatot

jSirDice: what's the use of sniffer?

---

A sniffer is a simpler word for Network Protocol Analyzer. It shows you the IP packets that are on the "line". You would need to have some TCP/IP knowledge.

http://www.wireshark.org

Quote:

---

1 2 ms 1 ms 1 ms 192.168.1.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 312 ms 311 ms 311 ms jc-in-f99.google.com [64.233.187.99]

---

Now that's interesting...Looks like it doesn't get out the front door, then suddenly picks something up way down the line...

Nihil, do you think this looks like the problem is at/near the gateway? I'm thinking it's got to be some piece of equipment there in his building. Definitely test the line.

AK, If I were going to hold a drumhead court martial, with immediate executions, I guess I would shoot the modem/router.:D

I believe in Service provider line tests because we don't have to do them.......?


After that I would look at internal cabling or WiFi first, I would think?............ cheapest and easiest solution......... hell, you should have a few spares anyways?

My money is on the modem/router though.

Hey, if you set them up wrong, then performance is usually consistently substandard? This is varying? Aaaahh! :wow:

NO! NO! NO! .............. my favourite suspect is NOW some scumbag little employee doing P2P, KAZAA, and all that crap. I guess I just flog them to death........... given the recent price increases in 9mm Parabellum :lildevil:

I guess I just changed my mind?

I'd definitely agree. I'd say we're down to three possibilities:

1) Bad modem/router.
2) Bad ISP circuit.
3) Bad user.

Lets not forget #4-

Misconfiguration

MLF

nihil, my LAN is pure wired...yeah am trying to figure out that p2p thing bcoz one of the computers here does have some limewire/azureus thingy.

my modem/router here was configured by a tech from the ISP we applied for. yes, the modem/router do all the tricks here. even my web server wont go online bcoz it is being intercept by this modem/router.

i did not install this modem/router myself bcoz i dont know their configuration in the first place and i dont have access to it. as to what i've seen during the installation of that tech form the ISP, he logged in 192.168.1.1 through web and i think its the configuration of the modem/router.

it would be easier if they gave me the actual IP address, Gateways, and DNS so that i can configure it on my linux server but they insist that that's the only configuration they have and they dont do it on OS's like linux.

they we're not trained to configure them on Linux.

Ok...Is the router plugged into a switch\hub...or does linux box have 2 nics and all traffic is routed through the linux server...then out to the router?

Maybe a DNS issue..


MLF

Quote:

---

it would be easier if they gave me the actual IP address, Gateways, and DNS so that i can configure it on my linux server but they insist that that's the only configuration they have and they dont do it on OS's like linux.

---

Gaaaah that's evil! If this is a small business network, IMHO you need your OWN router...the only ISP-owned equipment you should have is the modem. That way you can do most everything yourself and not have to rely on the ISP's tech. I'd be going nutty in your shoes.

I totally agree with AK...

I have always liked having a router that I can configure...that way I can open and close ports as needed.

Plus the ISPs here know less about the configuration than I do...I just have them supply thier modem\router in bridge mode...

One site owns the modem...already in bridge mode...we just change the router configuration when changing services\ISPs.

MLF

morganlefay: am using windows 2k adv. server for the meantime.
the actual architechture is this: my server (both linux and windows) does have two NICs, one for the LAN and one for the modem/router. the first NIC which is for LAN is connected to a switch/hub and the other one is for modem/router (solely).

the modem/router is not plugged into a switch or a hub.

using this two NICs, the modem/router is configured to share its internet access using the other NIC which is the LAN.