Solved

Network Slow Down

Posted on 2012-03-28
17
684 Views
Last Modified: 2012-05-02
I have a windows 2003 domain. Recently my users have been reporting decreased performance inside of Windows on their desktops.

Especially when using word and excel to navigate through shares on our file server. Even changing the drive the applications look in from C to P (P being a mapped share) or vice versa can take up anywhere from 5-10 seconds. It randomly hangs when when trying to open folders within those drives, it eventually opens but there is a major delay. It is something I have seen replicated on several workstations now and am not sure what to attribute it to. The file server is not under any kind of load. I've used perfmon to monitor the performance of it and it seems fine. Any suggestions would be much appreciated.

All workstations are configured to automatically search for network devices and shares and office apps have been optimized for accessing files from the network. Could this be active directory related?
0
Comment
Question by:J C
17 Comments
 
LVL 63

Expert Comment

by:SysExpert
ID: 37779620
1) Check for a bad switch
2) check event logs on the servers and 1 workstation that has issues
3) Use wireshark to do a packet trace to see if there are any retries or delays
4) Check that the server hardware is ok, maybe a drive is dying or other issues on the server

I hope this helps !
0
 
LVL 22

Expert Comment

by:mutahir
ID: 37779682
What AV do you have on your file server ?
I have seen this behaviour with a ESET AV installed on a Fileserver ; eset installed a tdi driver which basically does inspection on your LAN NIC too.

Let us know which AV and you can also try uninstalling AV (for a few hours) to test .
0
 

Author Comment

by:J C
ID: 37779769
No antivirus software is running on the file server currently. I don't see any issues being reported on any of my switches such as duplex mismatches, nothing is running in half duplex on the network. I did think it could be a switch when this started occurring and was obviously affecting multiple users but the network connections seem solid otherwise. Checked the user's logs and am not seeing anything there. I will use wireshark to take a closer look at what's happening behind the scenes and post back. Thanks for the responses.
0
 

Author Comment

by:J C
ID: 37779798
What kind of filter can I place so that when I am capturing traffic via wireshark I see what is relevant for this particular issue?
0
 

Author Comment

by:J C
ID: 37779823
This is what I am seeing with wireshark. I am filtering by protocol SMB and believe I am seeing a few errors.

Here it is:

10      0.642348      192.168.1.13      192.168.1.19      SMB      134      Trans2 Request, QUERY_PATH_INFO, Query File Basic Info, Path:

Header checksum: 0x0000 [incorrect, should be 0x4c95 (maybe caused by "IP checksum offload"?)]

Expert Info (Error/Checksum): Bad checksum

I see several of these.
0
 

Author Comment

by:J C
ID: 37779824
192.168.1.13 is the machine I am accessing the file server from. 192.168.1.19 is the destination
0
 

Author Comment

by:J C
ID: 37779825
Could the above error be causing my problems?
0
 
LVL 5

Expert Comment

by:Yohei0815
ID: 37782219
Hi when looking at the protocol:
make an actual request for a word and excel sheet and watch the time it takes before the answer comes.
Is it really a server problem or is the answer coming fast and the client waiting for something.
On the server look for the logfiles to see unusual messages.
0
 

Author Comment

by:J C
ID: 37808887
Could this be a master browser issue? I forcefully removed a windows 2000 DC from the domain after it crashed.  It could not be dcpromo'd down. It will only boot into directory services restore mode/safe mode. The interesting thing is, with the server powered on (which it has not been while this issue crept up) we don't experience the slowness. Before forcefully removing the server from the domain, I made sure the FSMO roles were transferred to a functional DC. Part of why I had to forcefully remove the DC and more quickly then I would prefer is because I was rolling out Exchange 2010 which requires a Domain Functional Level of 2003. Any feedback is appreciated.
0
 
LVL 23

Expert Comment

by:ComputerTechie
ID: 37843711
Have you checked the dns setting for the workstation and serve to make sure they are not searching outside the network then coming back in?

CT
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 37843765
#1 Cause of poor network performance is poorly installed network cabling. Poor terminations or improperly run cabling results in cross talk and lost packets. Constant retransmissions result in a significant performnace loss.  Assuming that is not the case, since this seems to be something that changed:

Slow browsing for files is often related to Windows searching for old links that no longer exist. This happens on a LAN as well, but it becomes much more obvious over a VPN. Finding these can sometimes be a bit time consuming. A few places to look:
-My computer. Look for mapped drives that are disconnected (no longer present)  
    You may want to run
   net use /persistent:no
   net use * /delete
   on a problematic machine to clear all drives, and then re-map
-Network places. Look for links/connections that no longer exist.
  (I prefer to also turn off "automatically search for network folders and printers". Locate by going to the menu bar of my computer | tools | folder options | View | fist item)
-Start menu "recent Documents". To clear; right click on task bar and choose properties | start menu tab | customize | advanced | clear list
-If the Word or Excel applications are slow opening the files from the menu, clear the recent document list within the application. To do so in Word; open the application | on the menu bar choose  tools | options | general | un-check "recently used file list | choose OK to apply | then you can go back in and re-enable. Excel is similar.
-make sure any NIC’s (PC & Server) are configured the same as the switch.  For example if the switch is set to 100 full duplex the NIC should be as well, but if auto-negotiate (as with most switches) the NIC’s must be auto-negotiate.  Mis-matches are a huge problem with performance
-On the explorer menu bar choose tools | folder options | view | un-check "show pop-up description for folder and desktop items"

I would also update NIC drivers, especially on the server.  Having said that there are some new features with NIC’s that are known to cause propmelms……

There are some known issues with newer advanced NIC properties such as "Task Offloading", and “Receive-Side Scaling” which drastically affect performance and stability of file share access if enabled and especially if you are running older drivers. The following outline  changing for the command line but I have found in some cases you have to do so within the advanced NIC properties for them to take effect. Any of these changes require a reboot to take effect.

To disable Receive-Side Scaling, at a command prompt, with elevated privileges, run the following command:
netsh int tcp set global rss=disabled

To disable Task Offload, at a command prompt, with elevated privileges, run the following command:
netsh int ip set global taskoffload=disabled

To disable Add-On Congestion Control Provider, at a command prompt, with elevated privileges, run the the following command:
netsh int tcp set global congestion=none

For more information Information about the TCP Chimney Offload, Receive Side Scaling, and Network Direct Memory Access features in Windows Server 2008
http://go.microsoft.com/fwlink/?LinkId=189029

Related blog articles:
http://blogs.technet.com/b/networking/archive/2008/11/14/the-effect-of-tcp-chimney-offload-on-viewing-network-traffic.aspx
http://blogs.dirteam.com/blogs/sanderberkouwer/archive/2008/05/15/backward-compatible-networking-with-server-core.aspx
http://support.microsoft.com/kb/951037
http://msmvps.com/blogs/thenakedmvp/archive/2010/02/23/rss-tcp-offloading-strikes-again-microsoft-should-kill-this-feature-for-the-masses.aspx
http://www.petestilgoe.com/2008/01/sbs-2003-sp2-broadcom-nics-slow-network/
0
 

Author Comment

by:J C
ID: 37844076
Would you be willing to read my last post. When the forcefully removed dc comes online performance immediately improves. I'm just not sure how to become un-reliant on it at this poiint.

Thanks!
0
 
LVL 77

Accepted Solution

by:
Rob Williams earned 500 total points
ID: 37844121
Sorry I missed that.
I don't belive it would be a master browser issue, but could the PC's still be pointing, even as an alternate, to a decommisioned DNS server?  That would certainly cause slow logons and delays in accesing resources.

How is performance if you acces using the IP such as  \\192.168.123.123\ShareName ?
If that is OK it at least rules out physical network issues.
0
 
LVL 5

Expert Comment

by:OOsorio
ID: 37851414
There is a windows update that causes this slowdown on mapped office documents. There's a lot of references to this on the internet.
0
 

Author Comment

by:J C
ID: 37911782
RobWill, I will test your theory and rule out DNS. That would make sense. Once I have tested I will update you. Thanks a lot for your input.
0

Join & Write a Comment

Trying to figure out group policy inheritance and which settings apply where can be a chore.  Here's a very simple summary I've written which might help.  Keep in mind, this is just a high-level conceptual overview where I try to avoid getting bogge…
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now