Solved

Network traffice.

Posted on 2008-06-11
7
370 Views
Last Modified: 2011-10-19
Ok here is my problem or at least I think so.  I think my network seams to be slow and I cant even seem to hand multicast our school district went to Altiris  to deploy images to computer other schools are able to image a whole lab of computers with out any problems. I end up getting mixed results some work fine while others seam to time out and hang.  So I downloaded Wireshark and did a quick capture there seam to be a lot of ARP requests going on is this normal.  I dont know much about monitor network traffic but there sure seems like a lot of them.  I would say they make up for almost 90% of what I captured. I have a feeling the equipment can handle multicast but have a sneaking feeling something is miss configured that would speed things up.  All the major switches in my school are 3com 3250s all tied in by fiber in the 3com core builder 9400. Most of my labs have Netgear 16 port switches or 24 in them.  
0
Comment
Question by:dsexton18
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 3

Author Comment

by:dsexton18
ID: 21759890
ARP made up for 83% of what I Captured.  Is that normal
0
 
LVL 28

Expert Comment

by:Bill Bach
ID: 21762906
Post the capture file, and we'll have more information.

Also, please note that a network analyzer can ONLY see traffic bound for that machine.  You would need either a full-duplex tap or a switch configured to route ALL traffic to the monitor port to be able to see ALL traffic.

Since ARP inquiry traffic is broadcast to all nodes, you will always see ARP traffic from EVERY node on the network.  Thus, if you monitor any switched network from an otherwise-idle machine, you will naturally see a bunch of ARP traffic.  If the computer is doing nothing else, and other broadcast traffic is limited, then you'll see a high percentage of ARP packets.

To really get a good picture, replace your core switch with a hub (just temporarily), and monitor everything that comes through for a little while.  You'll see a much better picture of the real traffic.
0
 
LVL 3

Author Comment

by:dsexton18
ID: 21763518
I would love to plug in a hub but since I am not the one in charge of the network I probably better not.  I did how ever contact him about my problems.   Attachedk is the text of a 60second captuere I did today.  
network.txt
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 28

Expert Comment

by:Bill Bach
ID: 21763640
A quick GREP-based analysios showed that there were about 4900 ARP packets in a 60-second interval, or 81 ARP/Second.  This is probably acceptable for a large network.  If you find the greatest offenders and increase their ARP timeout values, you might be able to reduce this a bit...
0
 
LVL 3

Author Comment

by:dsexton18
ID: 21855129
How do I increase the arp time out?
0
 
LVL 28

Accepted Solution

by:
Bill Bach earned 50 total points
ID: 21855368
This would be a configuration item on each device.  A quick scan through the 3com manuals should provide this information.  Again, though, this may be quite normal, and changing it may prevent networking changes from resolving as quickly as you might like.

Are you sure that this is a problem?  The level of network traffic (under 100/second) doesn't indicate any real performance issues.  I think you need to look for a different culprit.  I'd start by spanning a trunk port onto the analyzer & see if you see anything there first...
0
 
LVL 3

Author Comment

by:dsexton18
ID: 21913387
cool thaks .....i think i finnaly got the network guy convinced there are problems with our network. ....so hopefully he will come out soon.....
0

Featured Post

Enroll in June's Course of the Month

June’s Course of the Month is now available! Experts Exchange’s Premium Members, Team Accounts, and Qualified Experts have access to a complimentary course each month as part of their membership—an extra way to sharpen your skills and increase training.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question