Link to home
Start Free TrialLog in
Avatar of mbhf01
mbhf01

asked on

Experiencing slowliness in surfing the Web and in printing

Recently we started experiencing slowliness in surfing the web.
The only changes we have had is we used to have two DC's (2000 and 2003) something went wrong with the 2000 server (used to be DNS and DHCP server), so we have retired it and we now using only the 2003 server after seizing the roles and moving the services to the 2003 server.

On an other note, I have been asked to install Network Monitor on a client machine and take a network trace when the problem occurs. And I need help on that.

P;lease advise.

Thank u
Avatar of authen-tech
authen-tech
Flag of United States of America image

Try opening a command prompt on a computer experiencing slowness and type ipconfig /flushdns

Also...verify that the DHCP server is only giving out the ip address of the DNS server for DNS, and not the old one.  You will also want to verify in the command prompt the DNS server...by using
ipconfig /all

If you see the old ip address of the DNS server you took offline anywhere you found your problem.  Also flushdns may help otherwise.  

Good luck
Avatar of kyodai
kyodai

At first you need to find the cause. Sounds like it could be a DNS problem, like the client tries to reach the old retired DNS and after a few seconds it tries the next one? But really just guessing. An easy network monitoring could be done if you just download wireshark (open source sniffer) install it on an affected workstation and sniff the packets. See what packet was sent last before the "delay" occurs, i would bet on DNS, but maybe its also something completely different like proxy authentification (Guessing here, i dont know what your real network looks like).
Avatar of mbhf01

ASKER

Thank you for your input,

No slowness noted on the LAN it is just when surfing the web.
The DNS server was setup correctly
just as a test...set the DNS server as a static ip on the network connection tcp/ip settings of one of the computers.  It's a no brainer that slow web sites relates to dns.  It's worth a try...
Avatar of mbhf01

ASKER

I did try that. Now it is even slower
Avatar of mbhf01

ASKER

Hi Kyodai,

I did install Wireshark, could you please guide me on how to use it?

Thank you
Hi, just open up Wireshark, then click capture -- Interfaces and click the start button on the interface you want to sniff on. You will see every single package that leaves or arrives at the network card. with setting the filters (these are very mighty, the online Help with F1 gives much info here) you can blind out unwanted traffic or look at scefic traffic, like http or DNS. You can click a single package and look at details in the lower window, after some minutes practice you get a feeling to read the packages if you know a little bit about TCP/IP. ALso helpfull stuuf appears when you right click a package. A quite cool tool is "Follow conversation" or the various quick filters you can apply. The column "Time" is in your case very interesting, here you can identify delays! You will need to analyze the conversation a bit. Normally in a local network server responses should be arond several miliseconds, for example in our network a usual response from the DNS server takes around 10 miliseconds and these could be faster! If the proxy servers answer just takes too long the problem would very likely be on the proxy, but in that case ALL clients in the network segment should experience the same problems. Maybe the Proxys primary DNS times out or its some firewall rule or stuff. You need to analyse a bit more here. Usually delays can happen on the proxy when there is a problem with authentication and it uses a fallback, or similar stuff. I hope sniffing the traffic and seeing what really happens when client and proxy talks will give you the solution.
Avatar of mbhf01

ASKER

I have installed NS Network Monitor 3.2. I was not able to attach the caption file as it says that it is not supported. I did include a part of the caption and it is referring to the 2 old servers that I have retired and seized the roles and the services from.

8832      549.683376            {DNS:1582, UDP:1581, IPv4:48}      TAHITI        P2SERVER        DNS      DNS:QueryId = 0xC726, QUERY (Standard query), Query  for tracking.realtor.com of type Host Addr on class Internet
8833      549.730526            {HTTP:1509, UDP:1508, IPv4:1507}      DALLAS        239.255.255.250      SSDP      SSDP:Request, NOTIFY *
8834      549.730526            {HTTP:1512, UDP:1511, IPv6:1510}      FE80:0:0:0:5952:58A5:2663:C520      FF02:0:0:0:0:0:0:C      SSDP      SSDP:Request, NOTIFY *
8835      550.207046            {UDP:2, IPv4:1}      PARIS       192.168.200.255      NbtNs      NbtNs:Query Request for SUN  <0x00> Workstation Service
8836      550.277270            {UDP:30, IPv4:29}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8837      550.278273            {UDP:32, IPv4:31}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8838      550.382606            {DNS:1580, UDP:1579, IPv4:48}      TAHITI        P2SERVER        DNS      DNS:QueryId = 0x5840, QUERY (Standard query), Query  for homestore.122.2o7.net of type Host Addr on class Internet
8839      550.580237                  ALEP        192.168.200.9      ARP      ARP:Request, 192.168.200.102 asks for 192.168.200.9
8840      550.684569            {DNS:1582, UDP:1581, IPv4:48}      TAHITI        P2SERVER        DNS      DNS:QueryId = 0xC726, QUERY (Standard query), Query  for tracking.realtor.com of type Host Addr on class Internet
8841      550.957440            {UDP:2, IPv4:1}      PARIS       192.168.200.255      NbtNs      NbtNs:Query Request for SUN  <0x00> Workstation Service
8842      551.040705            {UDP:30, IPv4:29}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8843      551.042712            {UDP:32, IPv4:31}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8844      551.085849                  HEIDICOMP       192.168.200.9      ARP      ARP:Request, 192.168.200.61 asks for 192.168.200.9
8845      551.090865            {UDP:1516, IPv4:1515}      HEIDICOMP       192.168.200.255      NbtNs      NbtNs:Query Request for SHOP   <0x00> Workstation Service
8846      551.382797            {DNS:1580, UDP:1579, IPv4:48}      TAHITI        P2SERVER        DNS      DNS:QueryId = 0x5840, QUERY (Standard query), Query  for homestore.122.2o7.net of type Host Addr on class Internet
8847      551.684760            {DNS:1582, UDP:1581, IPv4:48}      TAHITI        P2SERVER        DNS      DNS:QueryId = 0xC726, QUERY (Standard query), Query  for tracking.realtor.com of type Host Addr on class Internet
8848      551.687769            {HTTP:22, UDP:21, IPv6:20}      FE80:0:0:0:B510:3C6F:C337:E39      FF02:0:0:0:0:0:0:C      SSDP      SSDP:Request, M-SEARCH *
8849      551.688773            {HTTP:24, UDP:23, IPv4:6}      GREG-T60        239.255.255.250      SSDP      SSDP:Request, M-SEARCH *
8850      551.688773                  MOSCOW        192.168.200.9      ARP      ARP:Request, 192.168.200.55 asks for 192.168.200.9
8851      551.690779            {UDP:77, IPv4:76}      MOSCOW        192.168.200.255      NbtNs      NbtNs:Query Request for MOON   <0x20> File Server Service
8852      551.690779            {UDP:77, IPv4:76}      MOSCOW        192.168.200.255      NbtNs      NbtNs:Query Request for SYDNEY   <0x20> File Server Service
8853      551.713853            {UDP:2, IPv4:1}      PARIS       192.168.200.255      NbtNs      NbtNs:Query Request for MASTER   <0x00> Workstation Service
8854      551.805144            {UDP:30, IPv4:29}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8855      551.807150            {UDP:32, IPv4:31}      BOGOTA        192.168.200.255      NbtNs      NbtNs:Query Request for QUEBEC   <0x00> Workstation Service
8856      551.835240            {UDP:1516, IPv4:1515}      HEIDICOMP       192.168.200.255      NbtNs      NbtNs:Query Request for SHOP   <0x00> Workstation Service
8857      552.180341            {SMB:1584, UDP:1583, IPv4:29}      BOGOTA        192.168.200.255      BROWSER      BROWSER:Host Announcement, ServerName = BOGOTA
8858      552.182347            {SMB:1586, UDP:1585, IPv4:31}      BOGOTA        192.168.200.255      BROWSER      BROWSER:Host Announcement, ServerName = BOGOTA
8859      552.263606            {HTTP:1509, UDP:1508, IPv4:1507}      DALLAS        239.255.255.250      SSDP      SSDP:Request, NOTIFY *
8860      552.263606            {HTTP:1512, UDP:1511, IPv6:1510}      FE80:0:0:0:5952:58A5:2663:C520      FF02:0:0:0:0:0:0:C      SSDP      SSDP:Request, NOTIFY *
8861      552.309753            {HTTP:1509, UDP:1508, IPv4:1507}      DALLAS        239.255.255.250      SSDP      SSDP:Request, NOTIFY *
8862      552.309753            {HTTP:1512, UDP:1511, IPv6:1510}      FE80:0:0:0:5952:58A5:2663:C520      FF02:0:0:0:0:0:0:C      SSDP      SSDP:Request, NOTIFY *
8863      552.418099            {UDP:77, IPv4:76}      MOSCOW        192.168.200.255      NbtNs      NbtNs:Query Request for MOON   <0x20> File Server Service
8864      552.418099            {UDP:77, IPv4:76}      MOSCOW        192.168.200.255      NbtNs      NbtNs:Query Request for SYDNEY   <0x20> File Server Service
8865      552.446189            {UDP:2, IPv4:1}      PARIS       192.168.200.255      NbtNs      NbtNs:Query Request for MASTER   <0x00> Workstation Service
Well then it is very likely that these 2 old servers are still in some local settings. The Client still has these somewhere in the settings. Unfortunately you did not note which of the servers are the retired ones, but i would look up the retired server names in the client settings and remove them. In large companies you probably distribute settings centralized, so you would need to remove them from your windows policies or DHCP or similar setting distributing services.
Avatar of mbhf01

ASKER

The servers names are Moon and Sun and we have a small network wit 1 DC and a Citrix server
WE have a T1 connection with a Cisco Router managed by AT&T is there any seeing on the router where to enter the DC's names and IP addresses?
Avatar of mbhf01

ASKER

I need help on DNS forwarders.
Can someone help me on setting my   ISPs DNS servers as forwarders
ASKER CERTIFIED SOLUTION
Avatar of mbhf01
mbhf01

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
"It's a no brainer that slow web sites relates to dns."

C'mon...who was right?  :)

Glad you fixed it