Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Internet connection slow - not ISP

Posted on 2003-02-21
Medium Priority
Last Modified: 2011-09-20

We're on a small business DSL line. Our connection is quite fast, and we can easily get about 200-300 KB/s throughput, depending on the site.

We've noticed, however, that our connection has slowed down all of the sudden, and we sometimes now get time-outs to one of our off-site FTP sites.

We've called our ISP, and they don't see any problems on their side.

We have about 15 people in our office. We've noticed that when the office is fully staffed, we get ping times of 400ms to sites like yahoo.com. When the office only has a few people in it, we get ping times of 75ms or less. There is no major traffic that we can identify (e.g. mass downloads).

Obviously volume of users has something to do with it, but I doubt it would be that severe. Is NIC chatter a possibility? If so, how can we check (I don't have the budget for a permiscuous card).

We almost always have DHCP issues too. That is, in the morning, I have to release and renew in order to get an IP address. This happened with two separate DHCP servers.

Here is our set up:

Cisco 800 router (from ISP) into a Sonicwall SOHO/3 firewall (70Mb firewall throughput). SOHO/3 firewall into a d-link switch. One additional switch in the main d-link switch (5 PCs), and about 10 PCs into the switch directly. We have 3 fixed network devices: 2 x servers, and 1 printer. We are running DHCP, from the firewall.

We have reset the firewall already, but that didn't solve it.
Question by:e-man

Assisted Solution

pedrow earned 150 total points
ID: 7994989
you might have a bad cable. i'd start at the top near your switching core, since this problem seems widespread...check that they're plugged in and not damaged. No harm in replacing if in doubt.

Other possibilities are speed/duplex mismatches on your ethernet cards and switches.

I suppose these are dumb switches? If so, make sure the nics are set to autonegotiate. dumb switches don't like hard-set speed/duplex parameters.

Assisted Solution

rrhunt28 earned 150 total points
ID: 7995173
One way to narrow down a few of your questions would be to get a sniffer and run it from differnt locations at differnt times of the day.  You can find free stuff online, I use ethereal.  That will show you if you have excessive traffic problems.  And like pedrow said, most networking problems start at layer 1, so check your cables out.  Good luck.

Accepted Solution

matt_t1 earned 300 total points
ID: 8001851
I am a great believer in what one of my colleagues terms the "flashing light theory of networking".  It can be a good quick-and-dirty indicator of where you need to start looking for problems.

I assume your switches all have activity and link lights on the ports.  Take a few minutes to watch the behaviour at various times during both normal and slow access:

Is there a major difference in the amount of traffic (flashing)?
   Is it spread over all ports?  This points to overall ethernet congestion, but is very unlikely on your small network.

   Just one port?  Might be a badly configured device doing lots of broadcasting and tying up other client's resources, or hogging the Internet bandwidth for itself.

Are there any times when some pretty intensive flashing completely stops for a few seconds then starts up again?  This can indicate a link problem somewhere that is causing the switches to stop and reset the affected port/ports.

Any differently coloured lights?  This normally means you have to read the manual to work out what the colours mean, but they normally do point to a problem.

The thing that seems strange in your case is the response time of up to 400ms.  That is seriously out of order!  Instead of just doing a "ping" at various times, try a traceroute (in Windows, "tracert").  That will give you the round trip time to each gateway in the link between you and Yahoo.com.  It is a useful way of identifying the segment where the delay is being introduced.  Your firewall will be the first link in the chain - if that one isn't the slow point and the second gateway (800 router) is, that means it could be your firewall itself, anything between there and the 800 router, or the 800 router itself.

I you do want to do some packet sniffing, I would also recommend ethereal - www.ethereal.com - as a good free sniffer.  You don't normally need to specifically buy a promiscuous mode card - most cards will operate in promiscuous mode if they are told to.  Just make sure your switch is configured to mirror all traffic to the port you are in otherwise you won't see anything apart from your own traffic anyway.

Author Comment

ID: 8558959
sorry for the delay in assigning points. no hard feelings? Thanks for all of your help

Expert Comment

ID: 8559177

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We've been using the Cisco/Linksys RV042 for years as: - an internet Gateway - a site-to-site VPN device - a leased line site-to-site subnet-to-subnet interface (And, here I'm assuming that any RV0xx behaves the same way as an RV042.  So that's …
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question