Temporary slow network. What to look for in a capture?

A customer beleives that they are having network problems. I want to make a capture from a mirrored port on a switch.

How can I see the following in a capture:

- if a switch port is bad?
- if a host have a bad network interface? Bad driver? Wrong speed settings 10/100 half/full Auto and so on?
- if a host are broadcasting (why would it do that?)

Im a beginner on this so please help me on what to look for.
LVL 1
TANGLADAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

from_expCommented:
hi!
I would look for
1. broadcasts,
2. network scans (it is virus)
3. broken packets and therefore a lot of retransmits

I would also look at logs on switches and firewall
0
TANGLADAuthor Commented:
I now how to look for broadcasts in a capture. But how do I see network scans and retransmits in a capture?
0
from_expCommented:
network scans - just look for patterns, for example it is strange when a single pc is sending out a lot of arp who has requests for the ips not in your subnet
retransmits and broken packets are marked with red in wireshark
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Analysis

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.