mbhf01
asked on
Experiencing slowliness in surfing the Web and in printing
Recently we started experiencing slowliness in surfing the web.
The only changes we have had is we used to have two DC's (2000 and 2003) something went wrong with the 2000 server (used to be DNS and DHCP server), so we have retired it and we now using only the 2003 server after seizing the roles and moving the services to the 2003 server.
On an other note, I have been asked to install Network Monitor on a client machine and take a network trace when the problem occurs. And I need help on that.
P;lease advise.
Thank u
The only changes we have had is we used to have two DC's (2000 and 2003) something went wrong with the 2000 server (used to be DNS and DHCP server), so we have retired it and we now using only the 2003 server after seizing the roles and moving the services to the 2003 server.
On an other note, I have been asked to install Network Monitor on a client machine and take a network trace when the problem occurs. And I need help on that.
P;lease advise.
Thank u
At first you need to find the cause. Sounds like it could be a DNS problem, like the client tries to reach the old retired DNS and after a few seconds it tries the next one? But really just guessing. An easy network monitoring could be done if you just download wireshark (open source sniffer) install it on an affected workstation and sniff the packets. See what packet was sent last before the "delay" occurs, i would bet on DNS, but maybe its also something completely different like proxy authentification (Guessing here, i dont know what your real network looks like).
ASKER
Thank you for your input,
No slowness noted on the LAN it is just when surfing the web.
The DNS server was setup correctly
No slowness noted on the LAN it is just when surfing the web.
The DNS server was setup correctly
just as a test...set the DNS server as a static ip on the network connection tcp/ip settings of one of the computers. It's a no brainer that slow web sites relates to dns. It's worth a try...
ASKER
I did try that. Now it is even slower
ASKER
Hi Kyodai,
I did install Wireshark, could you please guide me on how to use it?
Thank you
I did install Wireshark, could you please guide me on how to use it?
Thank you
Hi, just open up Wireshark, then click capture -- Interfaces and click the start button on the interface you want to sniff on. You will see every single package that leaves or arrives at the network card. with setting the filters (these are very mighty, the online Help with F1 gives much info here) you can blind out unwanted traffic or look at scefic traffic, like http or DNS. You can click a single package and look at details in the lower window, after some minutes practice you get a feeling to read the packages if you know a little bit about TCP/IP. ALso helpfull stuuf appears when you right click a package. A quite cool tool is "Follow conversation" or the various quick filters you can apply. The column "Time" is in your case very interesting, here you can identify delays! You will need to analyze the conversation a bit. Normally in a local network server responses should be arond several miliseconds, for example in our network a usual response from the DNS server takes around 10 miliseconds and these could be faster! If the proxy servers answer just takes too long the problem would very likely be on the proxy, but in that case ALL clients in the network segment should experience the same problems. Maybe the Proxys primary DNS times out or its some firewall rule or stuff. You need to analyse a bit more here. Usually delays can happen on the proxy when there is a problem with authentication and it uses a fallback, or similar stuff. I hope sniffing the traffic and seeing what really happens when client and proxy talks will give you the solution.
ASKER
I have installed NS Network Monitor 3.2. I was not able to attach the caption file as it says that it is not supported. I did include a part of the caption and it is referring to the 2 old servers that I have retired and seized the roles and the services from.
8832 549.683376 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8833 549.730526 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8834 549.730526 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663: C520 FF02:0:0:0:0:0:0:C SSDP SSDP:Request, NOTIFY *
8835 550.207046 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for SUN <0x00> Workstation Service
8836 550.277270 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8837 550.278273 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8838 550.382606 {DNS:1580, UDP:1579, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0x5840, QUERY (Standard query), Query for homestore.122.2o7.net of type Host Addr on class Internet
8839 550.580237 ALEP 192.168.200.9 ARP ARP:Request, 192.168.200.102 asks for 192.168.200.9
8840 550.684569 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8841 550.957440 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for SUN <0x00> Workstation Service
8842 551.040705 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8843 551.042712 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8844 551.085849 HEIDICOMP 192.168.200.9 ARP ARP:Request, 192.168.200.61 asks for 192.168.200.9
8845 551.090865 {UDP:1516, IPv4:1515} HEIDICOMP 192.168.200.255 NbtNs NbtNs:Query Request for SHOP <0x00> Workstation Service
8846 551.382797 {DNS:1580, UDP:1579, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0x5840, QUERY (Standard query), Query for homestore.122.2o7.net of type Host Addr on class Internet
8847 551.684760 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8848 551.687769 {HTTP:22, UDP:21, IPv6:20} FE80:0:0:0:B510:3C6F:C337: E39 FF02:0:0:0:0:0:0:C SSDP SSDP:Request, M-SEARCH *
8849 551.688773 {HTTP:24, UDP:23, IPv4:6} GREG-T60 239.255.255.250 SSDP SSDP:Request, M-SEARCH *
8850 551.688773 MOSCOW 192.168.200.9 ARP ARP:Request, 192.168.200.55 asks for 192.168.200.9
8851 551.690779 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for MOON <0x20> File Server Service
8852 551.690779 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for SYDNEY <0x20> File Server Service
8853 551.713853 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for MASTER <0x00> Workstation Service
8854 551.805144 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8855 551.807150 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8856 551.835240 {UDP:1516, IPv4:1515} HEIDICOMP 192.168.200.255 NbtNs NbtNs:Query Request for SHOP <0x00> Workstation Service
8857 552.180341 {SMB:1584, UDP:1583, IPv4:29} BOGOTA 192.168.200.255 BROWSER BROWSER:Host Announcement, ServerName = BOGOTA
8858 552.182347 {SMB:1586, UDP:1585, IPv4:31} BOGOTA 192.168.200.255 BROWSER BROWSER:Host Announcement, ServerName = BOGOTA
8859 552.263606 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8860 552.263606 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663: C520 FF02:0:0:0:0:0:0:C SSDP SSDP:Request, NOTIFY *
8861 552.309753 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8862 552.309753 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663: C520 FF02:0:0:0:0:0:0:C SSDP SSDP:Request, NOTIFY *
8863 552.418099 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for MOON <0x20> File Server Service
8864 552.418099 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for SYDNEY <0x20> File Server Service
8865 552.446189 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for MASTER <0x00> Workstation Service
8832 549.683376 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8833 549.730526 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8834 549.730526 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663:
8835 550.207046 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for SUN <0x00> Workstation Service
8836 550.277270 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8837 550.278273 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8838 550.382606 {DNS:1580, UDP:1579, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0x5840, QUERY (Standard query), Query for homestore.122.2o7.net of type Host Addr on class Internet
8839 550.580237 ALEP 192.168.200.9 ARP ARP:Request, 192.168.200.102 asks for 192.168.200.9
8840 550.684569 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8841 550.957440 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for SUN <0x00> Workstation Service
8842 551.040705 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8843 551.042712 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8844 551.085849 HEIDICOMP 192.168.200.9 ARP ARP:Request, 192.168.200.61 asks for 192.168.200.9
8845 551.090865 {UDP:1516, IPv4:1515} HEIDICOMP 192.168.200.255 NbtNs NbtNs:Query Request for SHOP <0x00> Workstation Service
8846 551.382797 {DNS:1580, UDP:1579, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0x5840, QUERY (Standard query), Query for homestore.122.2o7.net of type Host Addr on class Internet
8847 551.684760 {DNS:1582, UDP:1581, IPv4:48} TAHITI P2SERVER DNS DNS:QueryId = 0xC726, QUERY (Standard query), Query for tracking.realtor.com of type Host Addr on class Internet
8848 551.687769 {HTTP:22, UDP:21, IPv6:20} FE80:0:0:0:B510:3C6F:C337:
8849 551.688773 {HTTP:24, UDP:23, IPv4:6} GREG-T60 239.255.255.250 SSDP SSDP:Request, M-SEARCH *
8850 551.688773 MOSCOW 192.168.200.9 ARP ARP:Request, 192.168.200.55 asks for 192.168.200.9
8851 551.690779 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for MOON <0x20> File Server Service
8852 551.690779 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for SYDNEY <0x20> File Server Service
8853 551.713853 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for MASTER <0x00> Workstation Service
8854 551.805144 {UDP:30, IPv4:29} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8855 551.807150 {UDP:32, IPv4:31} BOGOTA 192.168.200.255 NbtNs NbtNs:Query Request for QUEBEC <0x00> Workstation Service
8856 551.835240 {UDP:1516, IPv4:1515} HEIDICOMP 192.168.200.255 NbtNs NbtNs:Query Request for SHOP <0x00> Workstation Service
8857 552.180341 {SMB:1584, UDP:1583, IPv4:29} BOGOTA 192.168.200.255 BROWSER BROWSER:Host Announcement, ServerName = BOGOTA
8858 552.182347 {SMB:1586, UDP:1585, IPv4:31} BOGOTA 192.168.200.255 BROWSER BROWSER:Host Announcement, ServerName = BOGOTA
8859 552.263606 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8860 552.263606 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663:
8861 552.309753 {HTTP:1509, UDP:1508, IPv4:1507} DALLAS 239.255.255.250 SSDP SSDP:Request, NOTIFY *
8862 552.309753 {HTTP:1512, UDP:1511, IPv6:1510} FE80:0:0:0:5952:58A5:2663:
8863 552.418099 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for MOON <0x20> File Server Service
8864 552.418099 {UDP:77, IPv4:76} MOSCOW 192.168.200.255 NbtNs NbtNs:Query Request for SYDNEY <0x20> File Server Service
8865 552.446189 {UDP:2, IPv4:1} PARIS 192.168.200.255 NbtNs NbtNs:Query Request for MASTER <0x00> Workstation Service
Well then it is very likely that these 2 old servers are still in some local settings. The Client still has these somewhere in the settings. Unfortunately you did not note which of the servers are the retired ones, but i would look up the retired server names in the client settings and remove them. In large companies you probably distribute settings centralized, so you would need to remove them from your windows policies or DHCP or similar setting distributing services.
ASKER
The servers names are Moon and Sun and we have a small network wit 1 DC and a Citrix server
WE have a T1 connection with a Cisco Router managed by AT&T is there any seeing on the router where to enter the DC's names and IP addresses?
WE have a T1 connection with a Cisco Router managed by AT&T is there any seeing on the router where to enter the DC's names and IP addresses?
ASKER
I need help on DNS forwarders.
Can someone help me on setting my ISPs DNS servers as forwarders
Can someone help me on setting my ISPs DNS servers as forwarders
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
"It's a no brainer that slow web sites relates to dns."
C'mon...who was right? :)
Glad you fixed it
C'mon...who was right? :)
Glad you fixed it
Also...verify that the DHCP server is only giving out the ip address of the DNS server for DNS, and not the old one. You will also want to verify in the command prompt the DNS server...by using
ipconfig /all
If you see the old ip address of the DNS server you took offline anywhere you found your problem. Also flushdns may help otherwise.
Good luck