Solved

SLOW DNS RESOLUTIONS

Posted on 2003-11-10
18
906 Views
Last Modified: 2013-11-09
I have a client with a small (5 old Win98 workstations) network.  They have no server and had an old ISDN connection that seemed to work periodically but have long timeouts.  They upgraded their link to a Birch T1, but are having the same issues, Internet connectivity up and down.  

They recently added antivirus software to their PCs but they seem to scan clean.  I plugged a laptop directly into their gateway and it performs fine.  If I run it through their cabling, it seems slower.  If I plug other network devices back in, it is even slower.  Tracerts show increasingly slower responses and it seems like DNS is timing out.  

We had their cabling vendor come in and test cabling, but they say it is all OK.  I plan to swap their switch, but am looking for other ideas and tests.  Any suggestions?

Thanks,

Steve
0
Comment
Question by:smeek
  • 5
  • 5
  • 4
  • +2
18 Comments
 
LVL 31

Expert Comment

by:qwaletee
ID: 9719341
try monitoring traffix.  Perhaps a device is sending out a packet flood (either due to misconfiguration, or from a worm.)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 9719524
Definately could be a switch problem.
Who's DNS are they using? Suggest setting up an internal DNS server that simply forwards all requests to the root servers. This way, all internal clients use the local DNS server and everyone does not have to go out to the internet for every single dns request. The local server will cache a lot of it. This will improve their response times tremendously.
You say that they don't have a server, but you can get a Win98 add-on, most likely freeware...
http://www.totalshareware.com/asp/list_view.asp?catid=374
0
 
LVL 18

Accepted Solution

by:
chicagoan earned 50 total points
ID: 9720136
Cabling's ok... is it cat5 or cat3?
put a HUB between the gateway and the switch
get wincap and ethereal on you laptop and see what's going on
what's the switch make / model?

0
 
LVL 8

Author Comment

by:smeek
ID: 9722178
Cat 5e, just put in by cabling firm with a 24p unmanaged switch.

I did try Ethereal and WinCap, but my first time with a sniffer and not sure what to look for.  I did catch some obvious stuff (saw some IPX and NetBIOS traffic, so I tracked down clients that had it configured and removed).  Any special sniffing reports or items to look for...
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 50 total points
ID: 9722268
duplex mismatches are #1 headache in switched networks.
If it is unmanged switch, it most likely does not keep interface error counts.
If it is unmanaged switch, your sniffer is going to be less than effective unless you can turn one port into a "mirror" port - not likely on an unmanaged switch.
Look for collisions. Collisions are not acceptible on switched networks, but will show up with a duplex mismatch.
Make sure all PC's are set to autodetect speed/duplex, not hard-set to 100/full or anything else
Power-cycle the switch.

If you want to make a dramatic difference, you need a local DNS server. Period.

0
 
LVL 18

Assisted Solution

by:chicagoan
chicagoan earned 50 total points
ID: 9722437
>Make sure all PC's are set to autodetect speed/duplex
IMHO - make sure they're properly detecting speed/duplex - else set them explicitly
0
 
LVL 9

Expert Comment

by:cooledit
ID: 9722501
try to look if you have the following systoms in your network many broadcast (could make minor broadcast storms)
how many PC in each broadcast domains.

Could you provide a little more info on your network as how big is your IP-Range pool how much extra subnetting do u have, you must help to see if you can figure out (draw the plan route of the packets how does it traverse through your network)

remeber one of the very good rules in the network topology, switch many route once
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 9722612
chicagoan, Not meaning to argue, but perhaps an honest exchange of professional opinions..
>else set them explicitly
Note that this is an unmanged switch. If one end is auto (switch end, not changable), and one end is explicitly set, then you run a very high risk of a duplex mismatch. If you hard-code a NIC to 100/full, and the switch is set to auto, the switch does not see the autonegotiation packet, it could default to half-duplex. This is the default behavior of many switch brands. Especially on the lower end un-managed switches. It is by design so that you can plug a hub into it. Plug and play by the novice. Because a hub was never designed to negotiate, it does not try. If the switch senses that there is no negotiation attempt, it thinks it must be a hub and hubs can only work at half-duplex, therefore I'm going to set that port to half-duplex. That is why either both ends are hard-set, or both ends are auto.
0
 
LVL 18

Expert Comment

by:chicagoan
ID: 9722848
Thanks - "Set them" should have been qualified!

we agree that you want the most reliable way of matching speed and duplex

My remark "make sure they're properly detecting speed/duplex" was meant for smeek to examine that issue.
You're right, in the absence of auto-negotiation of whatever is attched to the switch will default to 1/2 duplex, but I have seen many installations that don't auto-detect properly and I think you're better off with 100half on both ends than with a mismatch.
As far as "thinking it's hub", I don't like to anthropomorphize network hardware, it makes it too easy to hold a grudge.
I 'think' the hub issue is more about auto MDI/MDIX detection... but that's another debate - though I will say I don't like hanging hubs off cheap switches not knowing how they'll handle the spanning tree.

0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 79

Expert Comment

by:lrmoore
ID: 9722912
Touche'
Glad we're on the same team!

At least we are all in agreement that there could be a duplex mismatch that does cause all manner of network performance issues...Replacing the switch would be a wise move at least for testing purposes and an easy way to eliminate one possibility. Get a cheap one, plug it in and if the performance is not improved, put it back in the box and take it back to the store. No cost to test it, and you have just ruled that out as a problem.


0
 
LVL 9

Expert Comment

by:cooledit
ID: 9722919
what I tried to see if it was possible to figure out which switch has the root port ?

One switch must be the one with the root port if they can not determine who is the root switch it will start over a new negotiation "period" assuming there are more than one switch of course and that will lame your network. Maybe stupid answers in the fact since you got unmanaged switch but would like to know more of your network setup to give better answers.

Subnet (Supernetting)
How many nodes on each subnet (possible broadcasts) to avoid collisions (maybe consider as stated from Lmoore if you are running a 10MB affected network the possibilities for collisions are 100 % bigger (100MB Network = 0 collisions)
manageable switches are farely cheap today.

0
 
LVL 9

Expert Comment

by:cooledit
ID: 9722922
sorry for mistiping lrmoore
0
 
LVL 8

Author Comment

by:smeek
ID: 9723023
cooledit

Not sure what other data you are looking for...

My first statement was that it was a five PC network.  They have a private IP range (Class C).  They have a single Lexmark network printer.  

Did I miss any info you were looking for?

S
0
 
LVL 9

Expert Comment

by:cooledit
ID: 9723179
that Lexmark is that running 10MB NIC
0
 
LVL 18

Expert Comment

by:chicagoan
ID: 9726046
sorry to repeat myself... the cabling is it CAT3... CAT5... doorbell wire??
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 9726092
chicagoan:
>Cat 5e, just put in by cabling firm

One of those days, huh?
0
 
LVL 18

Expert Comment

by:chicagoan
ID: 9726190
sorry - jeez - i had just read the whole post again too... better have another gertiol
0
 
LVL 8

Author Comment

by:smeek
ID: 9727421
Actually, the business is in Fort Worth, so it is using the 802.8 standard, Ethernet over barbwire...

Thanks for the help, I was able to sniff enough details to track down 2 errant NICs (what luck).  One, I was able to update the driver and get it working properly, it would autonegoiate properly.  The other one is still an issue, so I plan to replace the NIC.  One was saturating other w/s, the other was saturating the router causing it to drop and DHCP to stop working.

Thanks again.

Steve
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
new to networking configuration 6 34
SSH logs Cisco switch 4 33
FTP output from Wireshak 6 50
RDP Sonicwall 8 32
Hello All, I have been training on Multicast for a while now and whenever I start the topic , I find out that my friends /  Colleagues mention that they do not know how to test Multicast Joins. As most of the multicast would be video traffic and …
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now