Start Free Trial

asked on

Slow internet access on one SBS2003 client

Hi
I have an SBS2003 network at home with several computers connected. Mostly this setup has worked well for a couple of years
One client PC has started having problems with very slow internet connection - the others do not. Even laptops of friend attached to the wireless side do not have slow connections
The "slowness" (up to 60 secs per page or longer) affects all browsers (IE/Mozilla etc)
I have tried "cleaning" the affected PC and sometimes this speeds up access for a short time (I have used TUT/SpyBot/AWO)
On the advice of a good friend I have just connected this PC direct to the router, given it a fixed IP address and the DNS of the provider of the internet connection and its working fine
The affected PC is running XP Pro
Security on that machine is Eset Smart Security
Security on the Server is AVG
All updates are in place
I am not a computer wizard - although competent to a good level with most things - so please avaid techie shorthand where possible
Many thanks
John

does ur client DHCP configured ?
if yes then................. clear all cookies,,, dns tracks from all browser....
start > run > %windir%\system32\drivers\etc > press ok
look for hosts file ,,,,open with notepad................ write down ur server ip and dns name as follows as example..
restart ur computer....
Click Start>Run>type gpedit.msc > Local Computer Policy>Computer Configuration>Administrative Templates>Network>QOS Packet Scheduler>Limit Reservable Bandwidth.......
open it > select enable > and set limit to 0 %...

ASKER

Hi there Thanks for your response
Okay Cleared all cookies etc from browsers
Hosts file - 127.0.0.1 localhost plus a bunch of stuff from SpyBot
Restarted
Set limit to 0%
Still very slow (took almost 20 mins to get to this page
Kind regards
John

Gonzalo Becerra

Do you check DNS? the DNS of the client need point to DNS Server (SBS2003) and the DNS need forwarders to DNS Providers.

ASKER

Hi there
I'm sorry but I'm not sure how to check that?
Could you help me?
Thanks
John

in host fine
after the following line enter ur dns server name and ip address

127.0.0.1 localhost
ip of ur dns server name of ur dns server

does ur dns server providing internet to all ur client computer ?

ASKER

Hi there
As I mentioned in my previous post, I do not know what this is. How do I check/find this out please?
Thanks
John

how did u provide internet to ur clients ?
through DNS server or directly through router...

in host file u can find 127.0.0.1 localhost after this line enter below information

12.10.0.10 xyz.com (eg 12.10.0.10 is ur dns ip and xyz.com is ur DNS server)....

ASKER

Hi
I'va asked twice now - how do you find this? I don't want to make a mistake. I think I know (look at IPConfig/all on the server) the IP is clear but am not sure of the name - mine is not like your example its eno3.local
The person that set this all up is not available at present, so I need a little help
Thanks
John

Gonzalo Becerra

- Check in your local computer "ipconfig /all" and check DNS

Open Server SBS and check the DNS Machine if the IP of SBS.

To Check Forwarders:
- Open Administrative Tools > DNS > Right Click on SBS Server > Forwarders and check too all domains and bellow specify DNS of your provider.

Hi ignarus,

Sounds virus issue,

Try this:

1 - Update your anti virus, SpyBot, etc.

2 - Download CCLEANER from http://www.ccleaner.com/ (but dont run now)

2 - Disable system restore
Go control panel, system, tab system restore, and check turn off system restore

3 - Restar yout computer and enter in Safe Mode without Networking (press F8 on boot)

4 - Scan your computer with your anti virus, SpyBot, etc

5 - Run CCLEANER

6 - Open your command line a write chkdsk /F

7 - Restar your computer and enter in normal mode

ASKER

Hi qbecerra
Thanks - I got the IP from config /all no problem
On SBS - I'm sorry but I dont understand what you want me to do with the phrase "Open Server SBS and check the DNS Machine if the IP of SBS" what do you mean if the IP of the SBS? If its what?
Also on last point - following that list of commands - under DNS Domain I have "All other DNS Domains" then the IP of the router below
John

ASKER

Hi Abolinas
Okay I carried out everything. Took quite a long while though
No virus etc found but did seem to load XP quicker (maybe that's just me though!)
However Internet still as slow
Thanks you for the alternative thoughts though. Much appreciated
John

ok,

Post here the following informarion:

On pc: open command linde and do ipconfig /all

On SBS: open command linde and do ipconfig /all

ASKER

Hi Abolinas
Here they are
First for the client

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Windows IP Configuration
Host Name . . . . . . . . . . . . : DD5T7X0J
Primary Dns Suffix . . . . . . . : ENO3.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : ENO3.local
ENO3.local
Ethernet adapter Local Area Connection 5:
Connection-specific DNS Suffix . : ENO3.local
Description . . . . . . . . . . . : Belkin Gigabit Desktop Card
Physical Address. . . . . . . . . : 00-30-BD-BA-AC-FF
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.16.15
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.16.2
DHCP Server . . . . . . . . . . . : 192.168.16.2
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
Lease Obtained. . . . . . . . . . : 18 December 2009 12:20:04
Lease Expires . . . . . . . . . . : 26 December 2009 12:20:04
Then for the Server

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

Windows IP Configuration
Host Name . . . . . . . . . . . . : ensvnt04
Primary Dns Suffix . . . . . . . : ENO3.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : ENO3.local
Ethernet adapter Server Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink Server 10/100 PCI (3C980B-
TX)
Physical Address. . . . . . . . . : 00-50-04-17-1F-80
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
NetBIOS over Tcpip. . . . . . . . : Disabled
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Belkin Gigabit Desktop Card #2
Physical Address. . . . . . . . . : 00-30-BD-BA-A1-77
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.16.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2

Hope that helps - thanks for the quick reply
John

for server side...

if 192.168.16.2 is server ip address and only server in ur network.... there should not DNS servers address is self server address (i.e, 192.168.16.2).. change it to self loopback address (i.e, DNS SERVERs:127.0.0.1 instead of 192.168.16.2)

ASKER

Hi xtreminator
Thank you for this
There is only one server, yes, and its IP is 192.168.16.2
I don't have the competence to understand your next comment however, I'm sorry. Could you please explain what that means and how to take the action you mention?
The other clients in the network are working fine on the internet, will this affect them?
Thank you
John

when u configure server DNS it will should automatically set ur server dns ip address as loopback adress as this is only server in network,,, by this server couldnt forward DNS request to another ip address having DNS facility............

since u r going to change server dns address it should not affect client,,,, while client already member of ur current registered server.,,,,

ASKER

Hi xtreminator
I dont really understand what you are saying as I have mentioned before
Do you want me to set the forwarder to 127.0.0.1. I get to this through Administrative Tools > DNS > Right Click on SBS Server > Forwarders
If this is not what you are saying then please provide instructions
Thank you
John

You have more computers in your network ?

If yes

These computers have the same problem?

If no

Post ipconfig /all of one of these computers

ASKER

Hi Abolinas
Thanks for that
Yes 4 clients. None of them have this problem.
Here is the ipconfig of one of them

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Windows IP Configuration
Host Name . . . . . . . . . . . . : laptop02
Primary Dns Suffix . . . . . . . : ENO3.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : ENO3.local
ENO3.local
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : ENO3.local
Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet NIC
Physical Address. . . . . . . . . : 00-10-60-5D-57-67
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.16.23
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.16.2
DHCP Server . . . . . . . . . . . : 192.168.16.2
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
Lease Obtained. . . . . . . . . . : Friday, December 18, 2009 11:50:51 PM
Lease Expires . . . . . . . . . . : Saturday, December 26, 2009 11:50:51PM

Thanks again
John

How have two nic on sbs, one of them is your default gateway, right?

ASKER

Hi Abolinas

Yes there are two nics. I don't know how to tell if one is the default gateway but I think it is

How many entries are there in your hosts files? I had a co-workers PC slow down all of a sudden and when we were looking that their PC there was over 6,000 entries. All put there by a spyware program. After we got rid of all of the entries execpt for localhost PC was running fine again.

ASKER

Hi Giltjr
There is only the one, plus a bunch of stuff from SpyBot - a real lot, maybe thousands all 127.0.0.1 addresses
Should I delete these?
Thanks for the help
John

ASKER

Just in case it helps - here is the beginning of the hosts file
John

Hosts-file-start.png

Copy the curreht hosts file to hosts.orig

Then delete everything after "Start of entries inserted by Spybot - Search & Destry"

See if that changes anything.

Every time that computer does a TCP/IP name lookup it must read through that whole file before it sends a lookup request to your DNS server. The larger the file, the longer it takes.

ASKER

Okay I've done that and restarted
It did not make any difference I'm afraid
John

Can you ping a host by its name like;

ping www.experts-exchange

and see how long it take before it comes back with the:

Pinging experts-exchange.com [64.156.132.140] with 32 bytes of data

message. It does not matter if the pings works or not, just how long it takes to return the above message.

ASKER

okay the ping worked
it took min 164ms - max 184ms
hope that helps

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

Hi
flushed the DNS as above
Pinged https://www.experts-exchange.com. It took 3.8 seconds to complete elapsed time
stats Min 164ms max 165ms
Hope that helps
John

ASKER

Just in case - if you wanted to know how long the first part took to appear (Pinging experts-exchange.com [64.156.132.140] with 32 bytes of data) - that took so little time I didn't get the stopwatch pressed. Instant - and that was after the flushdns
John

Then whatever is going on has nothing to do with name resolution.

Try going to http://www.speedtest.net/ from the PC that is having problems and see what upload/download speed you get.

If it is not close to what your Internet connection is, then try from another PC and see if it does better.

Do you have any proxy servers?

ASKER

okay on with the speedtest now.
what is a proxy server please?

A proxy server is "server" that your browser sends web requests to and the proxy server sends the requests on to the real web server.

They allow you to filter access to web sites based on the URL and to block content returned based on text or files being returned. Some are called Content Filters.

ASKER

Hi
The connection is supposed to be 8Mb down and 512Kb up
The affected machine did 3.88 down and 0.37 up
The non affected machine returned 5.73 down and 0.38 up
The server returned 4.85 down and .36 up
Thank you for the info on a prxy server - how do I tell if I have one please?
Thanks for your help
John

ASKER

just an observation - this machine is now working much faster. Is it possible that the flushdns did the trick?

Well if you normally use IE, you can to go:

Tools --> Internet Options --> Connections --> LAN Options

and see if you have one configured or have any of the options checked for Automatic Configuration. Then go to command prompt and execute the command proxycfg and see what it says.

I doubt very much if the flushdsn helped at all. If it is faster now, my guess its one of the other things you did.

Oh, if you want you can put back the original hosts file, just del hosts and rename hosts.orig to back to hosts or copy hosts.orig to hosts.

ASKER

Hi there giltjr
I checked the proxy as you suggested and none is configured
Also having rebooted the machine it is back to slow again, perhaps it was my wishful thinking that made it seem faster I don't know
So - problem not solved it seems, sorry for the false alarm
Kind regards
John

Hi

Reasons.

Please use new fibe optical cable to connect and check system performance.
Use a different switch to connect to local network.
See all RJ45 connectors are connected properly and see whether any cracks or cuts in cable.

I hope this will help u

ASKER

Hi hind987
Good ideas!
I don't have fibre - sorry - its all Cat 5e
I only have one switch.
I have run a separate (new) cable to a different port - still the same
I swapped Nic's between machines (one that works fine) and its still slow
Thanks for the help
John

Does the PC seem to have normal performance when access resources on your LAN?

ASKER

Just an observation that might mean something
I flushed dns
rebooted, let everything load, let the sync with the server complete - about 3 mins
I loaded IE 8 - took about 1min 40secs to come up with first page (google.co.uk)
opened new tab - loaded speedtest.net - 1min 52 secs
ran sppedtest - gave 5.41Mb/s down and 0.32 Mb/s up - ping time of 41ms
just struck me as odd that loading the page could take so long but the test be so quick
John

-> ... let the sync with the server complete ...

What sync with the server?

Does it take that long to complete the same action on any of the other computers?

ASKER

Hi Giltjr
Does the PC seem to have normal performance when access resources on your LAN? - yes it works fine
About the synch - its the normal synch it does whenit starts and shutsdown
Yes it does seem slower than the other machines but there's a lot more stuff to check/synch
I'm afraid I have to step away from my computer for about 4 hours now.
thanks again for all the help
John

wht is the status of link speed for lan card ?

desktop > right click on my network palces > right click on lan card > properties > look for configure button > click on advanced tab > line speed > probably its auto detect... > change it to 10 half duplex and check for ping status to out side of ur network (eg. ping www.google.com)

--> therre's a lot more stuff to check/synch

What makes you say this? Unless you have roaming profiles or some other special software there should be no syncing/checking going on with the server.

ASKER

Hi xtreminator
Followed your instructions but no "line speed" option - see image below. Did i do something incorrectly?
John

Advanced-tab-NIC.png

ASKER

Hi giltjr
What i mean is that this computer has more stuff to synch - more files etc on this machine. The synch programme came with SBS. All the specified files are backed up on the server
Thanks
John

hi ignarus:

wht u can see in flow control in above screen shot ?

ASKER

Hi xtreminator
It says "On"

http://www.delete-computer-history.com/slow-internet-connection.html

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

On the NIC configuration screen what is under the Jumbo Frames option?

If your switch is a gigabit switch, then the switch must support jumbo frames and every other computer on the network must support jumbo frames.

ASKER

Hi abolinas
Yes I could connect directly to my router if needed
And I've been through that link you gave me and completed those suggestions thanks

Ok, try connect the computer directly to router, and see what happens.

Give me feedback

ASKER

Hi abolinas
well it took me a while to make this work but it does now - however its not faster
about 1min 50secs to load speedtest page and it returned 2.58Mb/s down and 0.32 Mb/s up
John

All other's computers have TUT/SpyBot/AWO ?

http://www.neowin.net/forum/index.php?showtopic=655694
http://forums.spybot.info/showthread.php?t=32868
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/resolved-hjt-threads/53448-slow-internet-speed.html

do u have any spare nic card to cross check to client pc ?

attach PCI / USB NIC to cross check ur system nic...

ASKER

Hi Abolinas
Well - I followed those 3 links - thank you and carried out, checked and/or updated everything suggested, except for the Ad-aware thing which is still running now.
As to the spare nic, this is what I have tried already, swapping nics between a fast machine and the slow machine, swapping connector cables as well, and also running a new cable direct to the switch. Finally - its now running connected direct to the router bypassing the SBS domain altogether
What I haven't tried (cos I dont have a USB wireless aerial) is attaching this to the SBS via wireless. However, a friend of mine is coming over this afternoon and bring one with him, so I'll try that then.
After do all of this what I've noticed is that the computer seems to access the internet faster (not as fast as it used to - but nontheless faster) for a variable period of time after it starts up after a reboot.
Sometimes its the first page loaded is faster - sometimes its several. But it always reverts
Now what I don't know is, have I just noticed that because of using it so much repetitively rebooting over and over?
I will update when ad aware is done
Thanks again
John

ASKER

Hi xtreminator
Yes I have tried swapping these around. Please see post just made to Abolinas.
I am going to try wireless connection this afternoon and will update
Thanks
John

You may want to use something like wireshark (www.wireshark.org) and do a packet capture and see if you can tell what is going on.

ASKER

Hi giltjr
The ad-aware is still scanning (nothing found yet) - I have the wireless adapter to try when the scan is done and will update you here
I downloaded the wireshark package and installed it on a different machine and am going through the tutorials and manual to dee what to do with this
Will update when done
Thanks
John

ASKER

Hi Guys
Well, Ad-Aware finally finished! Found cookies only no threats
I also had a go at connecting by wireless and its still the same
I looked at wireshark, had a read of the manuals but to be honest I'm not sure what to do with it
Thanks for the help
John

Save the trace as K12 text file and post it and we can take a look at it.

ASKER

Hi there
Which (what is) a trace and what is a K12 file
Thanks
John

O.K. I miss-read your last post, I thought you used Wireshark to do a packet capture/trace and did not know what to do with the trace.

Install and start wireshark. On the menu bar select capture --> Interfaces. On the next pop-up window click on start for your NIC.

Now go to a web site that is slow. Once the page is loaded, go back to wireshark, click on Capture --> Stop. Then click on File --> Save As. In the "Save Type As" box, select K12 Text as the file type. The post the file back here.

ASKER

O.K. i'll swap the cable back so it goes through the server instead of straight out through the router
I'll get back to you once back up

Just to make sure we see "everything", you will want to do a ipconfig /flushdns and clear the browser cache before you start the trace and go to a "slow" web site.

ASKER

Hi Guys
Well - here is the file as requested.
Its much quicker now - amazingly after the swap back and fro between being patched through router/wireless/patched through server - or the ad-aware (which didn't find anything) apparently seems to have fixed the problems.
There are quite a lot of black lines in the file so there may be something there
Thanks again
John

WShark-capture-1.txt

ASKER

Hi abolinas,giltjr and xtreminator
As we head into the holidays just wanted to wish all the best and say a big thank you for all the help with this problem
The computer is now faster (although slows sometimes but a reboot brings back the speed - but as is often the case its hard to tell why
Was it the Ad-Aware run that reported no problems but cleared more cookies? Was it the swapping of the connection swapping with wireless and back. - I'm not sure. Perhaps you guys might know if either could be the "fixer"
I'll leave that WShark file - perhaps there is a tell tale in there.
Next time it runs slow - I'll do another file capture and post it
As we come to the end of the year I think we should close this now. I believe the points should be split equally between abolinas and giltjr and they both brought up the "to do's" that lead to the swapping of the connection and the ad-aware run.
I don't actually know how to do that, but will look it up and sort it out
Many, many thanks again
Happy holidays
John

ASKER

The slow client computer is now faster mostly. However as this thred was so long, I thought it best to close it now and will reopen another if the problem comes back etc.

Thanks and have a merry Christmas and a Happy New Year.

One thing that just did hit me that we never asked. What are the specs on this PC? Is is the same as the others? Especially important is the amount of RAM. Not enough RAM would cause a PC to slow down over time and then become faster after a reboot.

Even if it has the same amount of RAM as the others, if you have more programs using RAM it will be slower. So you may want to open up task manager and see how much memory is in use. Just in case, put your mouse on the task bar, right click and select Task Manger. Then select the performance tab. You want to look at the Physical Memory box and look at Total, Available and System Cache.

ignarus,

Thanks and have a merry Christmas and a Happy New Year.

Best regards

In the wireshark trace what URL(s) did you go to that appeared to be slow?

Can you try a different browser? If you are using IE, please try Firefox or Chrome.

I've look at the trace and all of the response seem to be fairly quickly, within a few tenths of a second. So right now it maybe that whatever browser you are using may just be talking a long time to render the page. So another browser may help identity what is going on.