Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 960
  • Last Modified:

T1 Bandwidth Congestion (Cisco 2811)

We have a new Cisco 2811 router with a T1 WIC. The new router includes the SDM (web) interface. Even before we purchased the router, we knew we were experiencing a bandwidth problem (slow response times on internet, slow downloads, etc.) Now, with the SDM interface, we can view the available bandwidth on the T1. But it seems that 100% of our T1 bandwidth is being used alot of the time -- and the traffic is mostly incoming. If not at %100, then it is usually above 65-70.The internet is very slow for our users and we cannot find the source. This is small-to-medium sized school district with a schedule that would make it difficult for many users to be on the internet at one time downloading files, etc.

We even temporarily setup an Ipcop linux router and, with DHCP, caused IP traffic to go through the Ipcop router. Ipcop has nice network graphs that show the incoming/outgoing load. I also used the "iptraf" utility on the Ipcop box to monitor workstation IP traffic. Even using both, we cannot find a workstation or group of workstations that are causing the problem. In fact, the traffic going through the Ipcop was under 100kb/sec total.

A few months ago we borrowed a very nice Fluke appliance to test our network for problems. Nothing major was found and response times across the LAN (through the core switch connected to the router) are great.

Any suggestions on what might be causing the bandwidth congestion?

2 Solutions
How many total users do you have?
Another suggestion is to enable netflow on that router and export to a NTOP box..

Do you have a NAT firewall between the users and this router?

I have seen a few times where a poorly configured ISP was dumping trash down their customer’s links which caused similar mysterious congestion problems like you are seeing. One time I disconnected all the hosts from the router and I still had over 80% link utilization, so you might want to try that and see if that is the problem, note make sure the Ethernet interface is connected to a hub or switch when you do this, or it will go down and make the test invalid. If that isn’t the problem I’d set up a port sniffer and look at the address the traffic is coming from, and going to. From my experience if the traffic is coming from your network and web usage really is light, you will probably find a few, or more computers have some kind of peer to peer network software on them sucking up all the bandwidth, about 9 out of 10 times that is what I find.        
inraindreamsAuthor Commented:
I am very impressed with ntop. It worked wonderfully... allowing me to see all sorts of data about IP traffic. Also, I do believe there might be a problem with the ISP... (actually, connect to a larger WAN through an ISP). Anyway, I'm going to split the points because both answers were helpful.

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now