[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

10 feet of molasses

Posted on 2005-04-15
27
Medium Priority
?
370 Views
Last Modified: 2010-08-05
I have a server about 10ft away from the computer I use.  If I ping the server I usually get response times <1ms.  The problem is, when I attempt to transfer a file from the server to computer or vice versa it is very slow (ie.. 180mb file = 2 hours)  I have a feeling the problem is very basic, setting or something, I just don't have a clue...   the server is running NT Server 4.0 and I'm on an XP machine connecting through a BayStack 450-24T Switch.  There you go.
0
Comment
Question by:txpaulrs
  • 7
  • 6
  • 4
  • +5
27 Comments
 
LVL 88

Expert Comment

by:rindi
ID: 13793187
Are you using a 10MB NIC? Is there antivirus running on the server slowing down things (also on your PC)?
0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13793548
innoculate is running on server and office trend micro running on computer... the nic 10/100 set on auto
0
 
LVL 6

Expert Comment

by:magicomminc
ID: 13793658
Can you login to Baystack and check the ports see if they are also set to 10/100 auto?
0
Granular recovery for Microsoft Exchange

With Veeam Explorer for Microsoft Exchange you can choose the Exchange Servers and restore points you’re interested in, and Veeam Explorer will present the contents of those mailbox stores for browsing, searching and exporting.

 
LVL 10

Expert Comment

by:ngravatt
ID: 13793727
go into the network card settings and make sure they are both set to speed 100 duplex full.
0
 
LVL 88

Expert Comment

by:rindi
ID: 13793755
Also turn off the AV online scan (test turning off innoculate first. If that doesn't help, turn it back on and instead turn trendmicro off). Then turn off both. Compare the throughput among the different settings.
0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13793824
both network cards now set 100 full duplex; no change   still attempting to access switch to check settings and will now work the antivirus angle.
0
 
LVL 6

Expert Comment

by:magicomminc
ID: 13794158
make sure NIC settings matches with Bystack switch, also does this problem happen on other machines?
0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13794509
the problem does happen with all machines connected on this network
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13794692
Check the inoculate-it rts config to see if it's scanning both reads and writes.  Do the same for the trend client on the XP box.  They should both only scan writes real-time, since reads should be of already-scanned files.  Before doing that, make sure there is a full scan done on all files on both server and PC.

What protocol(s) are you using - IP only?  WINS or NetBT?

How is the NT server "tuned?" - maybe it's not comm at all, but just poor file server performance.


0
 
LVL 15

Expert Comment

by:ZabagaR
ID: 13794840
How many client PCs are on this network?  At the end of the day, can you turn off all (or close to all) the office PCs - - then test the speed.

My thought was maybe you have 1 or more machines that won't shut up, network speaking......either caused by virus/malware or a bad NIC.  (although I think you'd notice slow network performance in general, not just file copying)

You have to narrow down the possibilities to find the culprit.  If the problem is not elsewhere on the network, it could be the server's drive controller or harddrive itself or some other hardware piece.

Why don't you turn on the NT PERFORMANCE MONITOR and then do some file copying.  You may be able to see what's dragging your performance down.  Here's a good article on what to monitor:

http://support.microsoft.com/default.aspx?scid=146005

-z-
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13794947
You could also monitor the network traffic for a while with a sniffer like Ethereal.  Just make sure the switch port the PC you're running Ethereal on is set to Promiscuous Mode or whatever your switch mfr. calls it, so it can see the whole network and not just its switched segment.
0
 
LVL 11

Expert Comment

by:PennGwyn
ID: 13795562
I've seen a couple of cases where small packets got through with no problem, but larger packets had difficulty.  These have included, in no particular order:

1.  Abused/damaged Cat5 cable.  It's not as tough as many people seem to assume.

2.  Duplex mismatch between NIC and switch.  In GENERAL, auto-sense of duplex is highly unreliable and to be avoided.  But in a few cases, it provides much better results that hard settings....

3.  I've occasionally seen switch component failure produce this sort of problem.

0
 
LVL 6

Expert Comment

by:magicomminc
ID: 13799959
if you have both PCs hardcoded 100full, your should set both your co-respond switch ports to 100full.
I suggest you get a console access to your baystack switch and make sure those ports are matching with your PC settings, clear the statics and wait for a while, look if there is any Alignment Errors and any Collisions. if you can't get console access to your switch, try to change both your PCs to auto-auto since that's most common default settings on switch.
0
 
LVL 1

Expert Comment

by:BLackCrypToN
ID: 13800310
(make sure to grab the latest drivers for the nic cards)

uninstall the cards drivers, remove the network cards (power off first of course)

boot the machines, then shutdown, reinstall the cards, power up, install drivers again

Set both cards to half duplex (or half mode)

test

if fails set to 100 full duplex (or full mode)

test

if this does not help

try this

copy and paste this into a text file, save it as tweak.reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"SizReqBuf"=dword:0000ffff

then save the file, double click it to merge with the registry on the machines.

this sets the DIR commad's buffer from 14000 to 65000, might help with browsing as well as transfers

You can also change and remove the bandwidth cap of QOS

on the XP machine, goto run and type gpedit.msc
goto admin templates > network > QoS Packet Scheduler

over to the right, double click "limit reservable bandwidth, changed to enabled

Then for bandwidth % set to 0, then press ok and reboot.

By default (not on) XP is set to reserve 20%, so there is a default speed cap at which transfers take place.

If this still does not work, I know this sounds strange, but swap the NIC cards from each computer, take the one in the XP machine, put in your other machine and vise versa...

I encountered a similar strange behavior when using 2 identical linksys cards as well as a linksys and plain realtek.

Might be worth trying...
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13800915
If you have exclusive access to the server, like on a weekend or after hours, try using a crossover cable directly between your PC and the server.  If it still happens using a crossover cable, that eliminates all guesswork as far as the switch is concerned.

If that makes it fast all of a sudden, then look at the switch.

As far as QoS, it's actually best to just turn that off on XP.  It doesn't help unless you are doing QoS priority scheduling on the rest of your network, which most people don't unless they're doing VoIP.
0
 
LVL 1

Expert Comment

by:BLackCrypToN
ID: 13803333
by enabling it and setting it to 0% you are "disabling" it, when set to off windows uses the default setting of 20%

The only way to truly disable it from being used at all is to uninstall it from network configuration by unchecking it then making sure it is highlighted, click uninstall, otherwise regardless of whether or not any programs use it, it will set default 20%
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13803444
Sorry I wasn't clear on that.  That's what I meant.  I remove it as a matter of course, because it's highly unlikely we will ever use QoS where I work, and should we have a need we can always put it back.  Doing it that way you don't have to rely on group policy.

There's another cap on XP IP, too, a limit on the number of concurrent half-open connections (XP SP2 has it capped at 10, IIRC) and it involves a hack patch to TCPIP.SYS.  I didn't mention it before, because I didn't think that cap would likely affect a simple file copy anyway, and it's not usually recommended to apply unapproved patches.  If that new arbitrarily-set cap somehow does affect the file copy, then there's way too much connection traffic through your NIC, and I would suspect spyware or a Trojan like ZabagaR suggested earlier.
0
 
LVL 1

Expert Comment

by:BLackCrypToN
ID: 13803738
possible that perhaps 1 of the NIC cards is bad? Or maybe needs to reseated in a seperate slot than the one it is in currently? Worth a try, NIC cards can be purchased very cheap and is always a good idea to have an extra handy anyhow. You could always purchase a cheap $10-$15 Realtek 10/100 NIC to test in both machines to see if it is one of your current NIC cards.
0
 
LVL 1

Expert Comment

by:BLackCrypToN
ID: 13803773
Another theory came to mind, while it maybe not likely, it is possible some settings need to be adjusted. As to "tweaking" the MTU ect..

I would goto www.dslreports.com and in their Test+Tools section run a tweak test, see what it says based on your settings, it may tell you something like MTU should be xxxx or other various settings such as RWIN.

You can easily edit these settings using Dr.TCP which can be found at http://www.dslreports.com/drtcp

You may get something like this if everything is ok, otherwise it will put notes in telling you where you could improve some settings and what settings would be good to try for your setup. I know this is mainly for net performance, but from LAN you will still be using these settings so it will partially reflect your internal network as well.

 Your Tweakable Settings:
Receive Window (RWIN):  65535
Window Scaling:  off
Path MTU Discovery:  ON
RFC1323 Window Scaling:  OFF
RFC1323 Time Stamping:  OFF
Selective Acks:  ON
MSS requested:  1460
TTL:
(less any hops behind firewall)
 128
TTL remaining:  113
 
 2. Test 146000 byte download
 Actual data bytes sent: 146000
Actual data packets: 100
Max packet sent (MTU): 1500
Max packet recd (MTU): 1500
Retransmitted data packets: 0
sacks you sent: 0
pushed data pkts: 5
data transmit time: 0.388 secs
our max idletime: 63.8 ms
transfer rate: 163879 bytes/sec
transfer rate: 1311 kbits/sec
This is not a speed test!
transfer efficiency: 100%

 3. ICMP (ping) check
 Minimum ping: 38 ms
Maximum ping: 60 ms
Ping stability:
40 40 45 38 60 40 39 38 40 39

Notes and recommendations:
 RWIN is in range
 Looking good
 
Notes and recommendations:
 Good data stream (no/few rexmits)
 
Notes and recommendations:
 Looking good
0
 
LVL 15

Expert Comment

by:ZabagaR
ID: 13803804
If you want to see 11 feet of molasses, just print out all these solutions.

txpaulrs, let us know how it's going - - otherwise the stabbing in the dark will continue.




0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13825052
the switch is set to auto and the network isolated from the outside world so I've removed all virus protection innoculate and trend.  the problem does exist on transfers between all machines on the network any machine to any machine, so not just a single point to point.  I'm just back in the office today, so I have a lot of idea presented here to try, I will have more info on how the process went in the a.m.  
0
 
LVL 35

Accepted Solution

by:
ShineOn earned 2000 total points
ID: 13825421
Slow all the way around for file copies...  Do you have a lot of (or all) WinXP pc's?  Are they WinNT4 domain members?  Do you also do a lot of PC-to-PC file sharing and printer sharing for some reason?  If so, did you set up "traditional" peer-to-peer sharing or are you allowing "simple file sharing(recommended)" - which should be NOT recommended in a business network, by the way - do the p2p sharing?

If you don't as a matter of course do P2P sharing, you should turn off "simple file sharing" (and "automatically search for network folders and printers" for that matter) when you are doing a "real" business-type client/server type network.  Those "features" are really made for the home user or SOHO user, not a "real" network, and can interfere with normal network functions.
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13825459
Even if you DO as a matter of course do P2P sharing, you should set it up in the traditional fashion (it's more secure and efficient) and still turn off "simple file sharing(recommended)"
0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13830420
as a matter of fact there are quite a few file shares as well as printer shares.  this entire network was setup and tweaked by a few different people before I got here.  I guess it wouldn't be a job unless there was a lot to sniff out.  Yet more to investigate when I get to work in the a.m.   All this info from the forum is quite a bit more than I thought I would get.  But that's a very good thing.  
0
 
LVL 15

Expert Comment

by:ZabagaR
ID: 13832954
You could use Microsoft's Network Monitor (netmon) to capture traffic and see what workstation or workstations are generating the most traffic.  Download from microsoft's download site.

Netmon will display the MAC addresses of the machines and the amount of traffic they're passing.  You can sort from highest to lowest.  You can use dhcp to find the IP of the machine, given any mac address - so you know which pc in your office you're looking at.





0
 
LVL 1

Author Comment

by:txpaulrs
ID: 13845662
shutdown all instances of local machine shared folders and shared access to printers attached to local machines and BAM!!!  A much higher more acceptable transfer rate achieved.. night and day.  Thanks ShineOn.  
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 13845768
You're welcome.  Glad to help.

If you need to do local sharing, set it up using the traditional method of creating shares and granting access rights to them. Not only is it more secure than "simple file sharing" it should also have much less impact on the rest of the network operations.
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Make the most of your online learning experience.
LinkedIn blogging is great for networking, building up an audience, and expanding your influence as well. However, if you want to achieve these results, you need to work really hard to make your post worth liking and sharing. Here are 4 tips that ca…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question