July 20, 2008 02:04am pdt

1. BillBach 16,390
2. RobWill 15,300
3. omarfarid 8,122
4. litmuslogic 6,650
5. keith_al... 6,450
6. from_exp 5,300
7. AdriendeC 5,000
8. Johnjces 4,764
9. oBdA 4,750
10. donjohnston 4,500
11. Melaleuca 4,400
12. lnkevin 4,000
13. Chris-Dent 3,750
14. grahamno... 3,500
14. sentner 3,500
14. brent_ca... 3,500

1. BillBach 36,475
2. RobWill 33,000
3. lrmoore 20,357
4. stevenlewis 17,126
5. giltjr 16,650
6. Chris-Dent 13,650
7. omarfarid 12,822
8. donjohnston 11,500
9. keith_al... 10,354
10. pseudocyber 10,259
11. AdriendeC 9,400
12. Johnjces 9,264
13. harbor235 8,700
14. toniur 8,450
15. ShineOn 7,869

06.20.2007 at 07:53AM PDT, ID: 22645958

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

4.4

Network Slow

Zones: Networking Protocols, Network Analysis Software, Network Management

Tags: slow, network

Hello,

I have a bit of a network issue. I have 6 users. All running winXP. 1 SBS2003 premium edition. 4 of the 6 users use a laptop. When all the users are in the office the network is extreamly slow. Sometimes takes almost 20 min to log in. I have done some research and found that slow network could mean many things. So I have done my research and found that DNS might be the culprit. All the computers point to our SBS server, and our network tcp/ip settings point to itself on the server. under DNS there are ISP forwarders setup.

I have also done some network traffic monitoring. During 10am i get around 900-1300 packets sent a second. At night, around 1am average around 40-50packets per second. I have a great feeling that this might be the issue.
I was wondering if there is anyway to see run a traffic monitor on the server to see which computer or IP would be cause this network clogg.

If anyone has any ideas please help me out. I am putting a max of 500 points plus and extra 500 points for the correct answer. I will explain how to get the free 500 points after we find a solution.

Thanks.
Mike

Start your free trial to view this solution

Question Stats

Zone: Networking

Question Asked By: nexxsupport

Solution Provided By: giltjr

Participating Experts: 3

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
Automotive
New Net Users
New Users

Software
Digital Music
Gaming World
Home Security

Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Displays / Monitors
Handhelds / PDAs
Components
Peripherals
Laptops/Notebooks

Servers
Misc
Apple
Embedded Hardware
Networking Hardware

Storage
Desktops
New Users

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMware
Misc
Web Development

OS
CYGWIN
Voice Recognition
Virtualization
Message Queue
Quality Assurance
Security
Firewalls

MultiMedia Applications
Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals
Devices

Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
Web Computing
WebApplications
IDS
Vulnerabilities
Email Clients
File Sharing

Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Consulting
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMware

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel
Automation

Algorithms
Game
Signal Processing
Project Management
Open Source
Database

Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Web Services

Images
Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration

WebApplications
Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Web Computing

Broadband
Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Lounge
Business Travel
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles
Automotive

Community Support

Suggestions
New to EE
New Topics
CleanUp

Announcements
General
Feedback

Input
EE Bugs

06.20.2007 at 06:57PM PDT, ID: 19329976

Rank: Master

giltjr:

What are you using to connect the users to the network? A hub or a switch? What is the network speed?

Do you use roaming profiles? If so how big are the profiles?

Without knowing the size of the packets I would only be guessing, but is sounds like you have a either a 10 Mbps Hub or 10 Mbps switch.

06.20.2007 at 09:23PM PDT, ID: 19330614

nexxsupport:

Hi, we have a d-link switch. we are not using roaming profiles.

not sure the size of the packets.

06.21.2007 at 06:28AM PDT, ID: 19332818

Rank: Master

giltjr:

It is 10 or 100 Mbps? If 100Mbps, are you actually connecting at 100 Mbps?

You may want to install something like Wireshark on one of the dekstops/laptops and capture some packets to see what is going on.

SBS2003 comes with MS Netmon (It is not installed by default, so you may have to install it) which is a packet capture utility. You should also do a capture on the server to see what it sees.

With only a few users if you are running at 100 Mbps full duplex you should not be seeing any real issues. However if for some reason you were getting 10 Mbps, you could see some issues.

06.21.2007 at 08:37PM PDT, ID: 19338893

nexxsupport:

its running at 100Mbps. i installed wireshark, but god i wish i could understand that info.

06.22.2007 at 07:51AM PDT, ID: 19341875

Rank: Master

giltjr:

You really don't need to understand it, yet. What you need to look at is how much traffic is flowing and where do you see delays.

Click on view --> time format --> seconds since previous packet.

This will show you the delay in between packets. You need to look for packets that have long delays between them. In most cases on a network where all traffic is local anything longer than about 1/2 a second (0.5) between packets is "LONG."

Generally you will also see all broadcast traffic in your network. Are you seeing a lot of broadcast traffic?

What you may want to do to start with is coordinate with one user. Start a trace from the file server and have them boot their PC and logon. You can setup NETMON (or if you installed wireshark on the server) to filter traffic so that it will only capture traffic from the one PC you really want to monitor. I would suggest setting up a filter on the PC's MAC address. That way you can see any non-IP based traffic also.

Once you have that trace then look for long delays and try to see if it is from the server side or the client side.

When a user logs on within the domain, are there any automated scripts that download a lot of files or automatically updates something?

06.22.2007 at 10:44AM PDT, ID: 19343332

nexxsupport:

Thanks. I will give this a try today.

As for scripts, the only one they have is for 2 mapped drives. just a logon script.

06.22.2007 at 11:22AM PDT, ID: 19343606

nexxsupport:

Ok i have installed enthereal and wireshark. where i am lost is where i am able to choose with pc i want to monitor. Right now i have installed them on the server. But there is 1 computer in specific i would like to trace. Any idea how to do that?

06.22.2007 at 11:34AM PDT, ID: 19343698

nexxsupport:

ok i figured out how to trace a specific IP. but there doesn't seem to be to many at long wait period. average is 0.001245 some were 1.03535 and 2.03534 but only a few.

06.22.2007 at 11:37AM PDT, ID: 19343726

Rank: Master

giltjr:

Start up wireshark and click on "Capture" then "Interfaces". Click on "Options" on the Interface you wish to collect network data on.

In the box "Catpture Filter:" enter:

src ether xx:xx:xx:xx:xx:xx

Where xx:xx:xx:xx:xx:xx is the mac address of the PC's that you wish to monitor traffic from. Then click on start and have that person logoff, reboot and then logon their PC.

06.22.2007 at 01:32PM PDT, ID: 19344630

Rank: Master

giltjr:

Was this while it was taking them 20 minutes to logon?

07.06.2007 at 07:37AM PDT, ID: 19432078

rio688:

If your machines are taking along time to login it might be worth checking the windows eventlogs in administrative tools, on one of your client machines, this will often show login errors particularly as it sounds like a DNS issue.

Is this a new server that replaced an old server on the same domain

07.06.2007 at 07:39AM PDT, ID: 19432099

nexxsupport:

No, this is a brand new server someone else installed 2 years ago. Anything i should double check on the DNS settings?

07.06.2007 at 10:07AM PDT, ID: 19433251

Rank: Master

giltjr:

DNS issue should not really cause a 20 minute logon. Were you tracing from the server, the client, or both?

If there is no obvious network issues, could the server have non-network related problems? Disk I/O problems, not enough RAM so it is paging/swapping too much, high CPU utilization?

If there where DNS issues you could enter "dns" in the filter box of the wireshark while looking at the packet captures you have and see the DNS requests. If it were a DNS issue you would see a request go out and no response come back.

07.06.2007 at 11:11AM PDT, ID: 19433769

nexxsupport:

I do see know there is 2GB of RAM and a steady 1.5GB for Paging File. Could this impact the speed?

07.06.2007 at 11:12AM PDT, ID: 19433780

nexxsupport:

Sorry not 1.5GB 1.90GB.....almost at 2GB

07.06.2007 at 01:40PM PDT, ID: 19434876

Rank: Master

giltjr:

I am assuming that the sizes you are quoting is really the commit size?

If so, then RAM should not be a problem, as your commit size is equal to or less than your physical amount of RAM. Now, that is cutting it a bit close. This means that all of the programs you have running combined beleive they need about 2GB of virtual storage.

In task manager on the performance tab you also need to look at available RAM and system cache.

Available RAM is how much RAM is available for the OS (for non-caching purposes) and programs to use. System cache is how much physical RAM the OS is using for caching of various things, files that application are reading for example.

If the amount of physical RAM available is low and the amount of system cache is low, this means that most likely you are doing paging/swapping, which will slow the system down. How much will it slow it down? Well that depends on how much paging/swapping you are doing, what the performance is of the disk(s) that your page files reside on and how much non-paging I/O you are doing to that disk/disk sub-system.

07.06.2007 at 02:16PM PDT, ID: 19435114

nexxsupport:

The amount above is for physical memory.

Here are the exact amounts under performance in task manager (for physical memory)
Total: 2096392
Avaliable: 368712 (this changes, was as low as 145829 at one point)
System Cache: 522650

07.06.2007 at 03:33PM PDT, ID: 19435472

Rank: Master

giltjr:

Umm, looks like you are a bit short on RAM. Basically what this is saying is that out of 2GB you have 150-360K available and that you are using about 500K for system caching.

Typically Windows will not perform well. Unless this is a database server or a Web server (only) this means that you are doing a real I/O quite a bit. Real I/O is typically a performance killer in Windows. The exception would be if you have SAN and you have multiple physical connections from the server to the SAN through multiple controllers.

Are the disks internal or external?

Are they IDE/ATA, SATA, or SCSI?

You may want to run pefmon. The default settings looks at CPU utilization, paging rates, and avg disk queue time for physical disk.

Now, this still should not cause 20 minute logon times. May be 2-3 minutes, but not 20 minutes. Unless your definition of logon is different from mine.

When you say it takes 20 minutes to logon, please tell me when you start the clock and when you stop the clock.

To me it is the time from when I enter my userid and password, until the logon box goes away.

07.10.2007 at 07:14PM PDT, ID: 19459396

nexxsupport:

They are internal. RAID 1 mirror. They use 2 SATA drives.

Im counting from when they enter their username and password.

07.10.2007 at 07:40PM PDT, ID: 19459469

nexxsupport:

this is the ipconfig from the server, if this helps at all.

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig/all

Windows IP Configuration

Host Name . . . . . . . . . . . . : abcpdc
Primary Dns Suffix . . . . . . . : abc.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : 10.0.0.2

Ethernet adapter Server Local Area Connection:

Connection-specific DNS Suffix . : abcpdc
Description . . . . . . . . . . . : NVIDIA nForce Networking Controller
Physical Address. . . . . . . . . : 00-11-2F-A7-EE-EE
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 10.0.0.2
10.0.0.1
Primary WINS Server . . . . . . . : 10.0.0.2

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet
NIC #2
Physical Address. . . . . . . . . : 00-40-05-36-10-99
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Autoconfiguration IP Address. . . : 169.254.55.60
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :

C:\Documents and Settings\Administrator>

07.11.2007 at 04:41AM PDT, ID: 19461519

Rank: Master

giltjr:

--> Im counting from when they enter their username and password.

Until when?

Just to make sure, if you do not connect the computer to the LAN, it takes a "normal" amount of time to logon? Also please define "normal", 1 minute or 10 minutes?

I would double check the network trace. If not connected to the network it take only 1 or 2 minutes, then in the network trace you should see something. Either large volumes of traffic, a request go out from the PC and then a long delay for either the response, or another duplicate request, or a combination of large amounts of data and requests with either a long response or duplicate requests.

By duplicate requests I mean something like you see a DNS request to reslove a name, then a 30 second wait before the next network request and there was NO response.

07.11.2007 at 06:44AM PDT, ID: 19462522

nexxsupport:

Do i do the network trace on the server or ona client PC?

07.11.2007 at 09:21AM PDT, ID: 19464153

Rank: Master

giltjr:

Well, this is the tough part. You need to trace what the client PC is doing. Which means:

In order to trace from the client you need to be logged on, which makes it impossible to trace from the client.

You need to have a managed switch that allows you to do port mirroring, which with only a few users my guess is you do not have a managed switch.

You need a hub, connect the client computer and one other computer to the hub and the hub to the switch. Then use the 2nd computer to capture all of the traffic.

The problem with tracing from just the server, is that you will only see broadcast traffic and traffic specifically to that server. If there is something "in correct" on the desktop and it is attempting to contact another computer that does not exist, you will never see this in a trace done on the server.

Do you happen to have a hub laying around? :)

07.11.2007 at 09:30AM PDT, ID: 19464252

nexxsupport:

Wow sorry. i don't have a HUB.

Someone mentioned this could be a DNS issue. Does anything look odd on the network config up above?

Where should the client DNS be pointing to? Right now some are pointing to automatically set.

07.11.2007 at 06:22PM PDT, ID: 19468062

Rank: Master

giltjr:

O.K. A few issues. You have a second NIC that seems to be configured for DHCP, but there is no DHCP server on the network that NIC is connected to, if it is in fact connected to anything. If you are not using this NIC, then disable it.

You also have IP routing enabled. Unless I am missing something, you are not (and you should not be) using this server as a router. Disable this.

Another issue is that you have:

--> DNS Suffix Search List. . . . . . : 10.0.0.2

This should NOT be an IP address. What this should be a a list of alternet IP domain names that the computer should append to host names when doing name look ups. This can be causing extra host name lookups. If you do not have other IP domain names in your enviroment, then leave this blank. It should also be blank on all other computer in your enviroment.

What is 10.0.0.1? If I assume this is your Internet gateway that also does DNS lookups. If this is true, then I would suggest that you remove this from your DNS settings. You should only be using your internal DNS server to reslove names. Your internal DNS server should be configured to use 10.0.0.1 as a forwarder.

Why? Say your internal domain name is abc.local. When a client PC goes to reslove the name abcpdc.abc.local, it will send the request to both 10.0.0.2 and 10.0.0.1. The client PC will accecpt the 1st response back. The DNS server 10.0.0.1 will not be able to find abcpdc.abc.local and will say "no such host", if it responds faster than 10.0.0.2 (which I assums knows abcpdc.abc.com) then the client must then do a WINS lookup. Although this should not add a lot of time to startup it will add sometime. I am talking about a few seconds here and there, not mintues though.

I do not see anything that pops out at me that would cause a 20 minute logon.

The only way that I can think of it being a DNS issue is if the clients are getting the wrong IP address as the DNS and the IP address they are getting is for either a non-existant server or for a host that is not running DNS.

Accepted Solution

02.17.2008 at 04:58PM PST, ID: 20916782

Jay_Jay70:

No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I will leave the following recommendation for this question in the Cleanup topic area:
Accept: giltjr {http:#19468062}

Any objections should be posted here in the next 4 days. After that time, the question will be closed. <