Start Free Trial

asked on

Network almost at a standstill

Hi,

I rebooted our SBS 2003 server yesterday and since the reboot everything has been crawling. The network speed is so slow and it is taking ages for users to save documents and print to network printers.

All PC's also have mcafee total protection on them which would also have updated around the same time as the server was restarted.

I feel this problem is going to be like looking for a needle in a haystack and wondered whether there were any very common causes to investigate first. It is not helped by the fact that I am not on site until Monday but am able to work remotely.

Couple of things I am thinking:
1. Try an alternative router (could a dodgy router cause this problem? I did reboot the router yesterday and think the issue was less severe immediately afterwards)
2. Turn all workstations off bar the server and one workstation to see if the problem still exists. If not then introduce one workstation at a time to try and narrow down any potential faulty hardware that could be causing the problem.

Any other suggestions? My users are very unhappy and it is impacting their ability to work...

Many thanks in advance for any suggestions :-)

Well, Strangely enough- a second reboot may be in order, you may be suffering from any number of issues, but if a reboot caused it, maybe another reboot will fix it. I would try doing a diagnostic startup, using MSCONFIG ,and see if the problem occurs if you have the minimum services and applications running. Look for any recent updates. That may be a cause. also make sure your hardware updates are up to speed. THe network adapter is a common cause. IF you have broadcom, you always need the latest driver and firmware. Check you resource utilization. Is your RAM or CPU pegged?

L

This could be your router that is going bad. Do you have a spare your could test to see if that is the issue?

ASKER

Thanks for your quick response.

I have tried another reboot which did not resolve. As far as I am aware my hardware drivers are up to date.

What do you mean by RAM or CPU being pegged?

Just see if your server is using all of its system resources, you can view this in task manager under performance tab. This will tell you what your CPU and RAM usage are at. Also, do you have sufficient space on the Server C:\ drive? if that fills up things will definately slow down. If all of those things check out you could run a test on the NIC card or test the router.

ASKER

I definitely have more than enough space on C

I have a spare, new, router which I will swap out first thing monday to see if that helps....

CPU and RAM usage seem fine....

Yeah it sounds like either the NIC card on the server or a bad router. how are the Internet speeds?

ASKER

Internet speeds seem ok although download speeds to server are awful - but to workstations seem ok (don't know what that means? NIC card or Router? or neither?!! LOL)

Think swapping router out is first option followed by perhaps starting with only server and introducing one workstation at a time?

Usually that means the router is okay, I would do the check anyway to be sure, but I am starting to lean toward the NIC card on the server being the problem.

How many stations are accessing the server? how many switches do you have for these users?

ASKER

There are approximately 20 workstations accessing the server and there are about 4 switches (off top of my head). All was working without issue until yesterday

ASKER

I have spare NIC's in server which are currently disabled - any reason not enable one of these and disable the current one (ie swap them over). Will this test the server NIC adequately?

That will work another thing you could do is bridge several NICs together on the same IP address this will increase the network speed from the server to the users. just right click on the network connections and choose bridge network connections. Then connect all of the NIC connections.

Just make sure you set the correct IP address to the NIC or NIC's if you decide to bridge them.

ASKER

Great; thank you! I shall be trying that first thing Monday, along with swapping out the router.... and will report back! Thanks again for your help so far.....

ASKER

Something else (which may be nothing) but seems slightly strange.... i have logged onto a couple of workstations this afternoon and a message has flashed up briefly (too briefly to be able to read properly) but references a printer? This is despite me not needing or asking for anything printer related at the time. Could one of the printers having a dodgy NIC be at the source of all this? And if so, is turning all printers off the way to start investigating this?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

All printers are hosted on the server... I will go forward with the server NIC and router first and see how I get on. Thanks - have a good weekend :)

Your welcome good luck!

2 things to try

get a usb nic and use it when ever you have this type of issue. Always a quick test
check make sure someone isnt sending docs to printers with bad/wrong drivers. If you ever seen what a bad driver can print out you can imaging what it can do on your system if its choking on it.

ASKER

Hi,

Despite the fact that I can't physically get to the server until tomorrow to try the NIC/router swap out I am still scratching my head and trying to figure out a resolution to the problem. One thing I was hoping I could run by you...

I am getting IPSEC errors in the event log: The IPSec driver has entered Block mode. IPSec will discard all inbound and outbound TCP/IP network traffic that is not permitted by boot-time IPSec Policy exemptions. User Action: To restore full unsecured TCP/IP connectivity, disable the IPSec services, and then restart the computer. For detailed troubleshooting information, review the events in the Security event log.

Could this be anything to do with my current network issues? Should I disable the IPSec services (what are they for?) and restart?

Thoughts most welcome :)

ASKER

To update: I have just opened my archived logs and the Ipsec errors have only been appearing since the problem started.... I would like to assume that this must be relevant?

ASKER

Ok, latest update...

I disabled IPSec - no change to LAN speed
I swapped the router - no apparent difference

With regard to the NIC card the server has a HP NC375i integrated quad port multifunction gigabit server adapter of which we are currently only using one connection which is labelled Server Local Area Connection and the other ports are named "network connection", "Network Connection 2" etc.

Currently if I try and download a file from the internet I am getting a download speed of approx 5kps per second. I had hoped to switch the cable to a different port on the network adapter and use that to see of the current port is playing up. I did this and was then getting a download speed of almost 200kps per second. However when I was using a different port on the adapter no users were able to log on to the server. Is what I am doing not possible/relevant?

Where do I go from here? Should I purchase a replacement NIC?

I'm not sure where to go from here? Meanwhile I have everyone back on the domain but it is still crawling and causing huge user problems...

Help greatly appreciated as always!

...It sure sounds like the NIC has gone bad, What I would do is change the IP address of the current NIC, then disable it. Then program the same static IP that the users currently resolve on one of the other NICs, then the users should be able to connect. This should resolve the problem. However I would look into using all of the NICs to increase speed even more. Here is small guide to bridging NIC cards together. Don't include the bad NIC in the bridge.

http://www.ehow.com/how_5553055_use-nic-cards-one-computer.html

ASKER

Thanks for that and I shall certainly look at the link for using all the NIC's

I "think" however that I may have just solved the problem..... I had disabled the mcafee firewall on the server (before the problem started). I decided, as the software firewall had been a relatively recent addition, to uninstall it totally rather than just leave it disabled. As soon as I rebooted following the uninstall the network speed is back to normal. Odd....

LOL... Isn't that how it goes? What I would probably do, is re-install just the Anti-Virus and not the firewall. Then just use the windows firewall. This way you are still protected yet can control a little better what traffic is allowed on the server. Still look into bridging the NICs it makes a big difference when you have several users all accessing the same server.

ASKER

The antivirus is still installed, just not the firewall currently. I will definitely look at bridging the NIC's (probably not today though! LOL)...
Thanks for your time on this; it's been appreciated :-)

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Sure, its all up to you on how you want to award points.

You're welcome and good luck.

ASKER

Sorry, hard to grade question and award points - am awarding on helpfulness and willingness to help rather than actual resolution of the issue (as I found this myself by trial and error).