ping packet loss

I am running windows server 2008 R2.  I have 2 servers, one is an IIS web server and the other is a SQL server.  The SQL Server is fine, but my IIS server every 5 to 12 pings, it looses at least 1 or more packets.The ms is very large, but the ms on the other server is fine, so I know it's not my internet connection.

Dont know exactly when it started doing this, but most of my websites are down because of this.  I restarted the server numerous times and it does the same thing, packet loss continues..

Any direction or help would be much appreciated.
packetloss.PNG
DanNetwork EngineerAsked:
Who is Participating?
 
JelcinConnect With a Mentor Commented:
Hello,

could you describe the network structure more detailed please? Are those servers hosted at some hosting provider or in your Company network? From where do you ping the servers?
For how long do you see this happening?


This kind of behavior is typical for DDOS attacks where the internet connection of a server is beeing overutilized thus the response time of the server gets very high or the server cannot respond at all. In your atached file you have response time of several hundred ms which is very very high. Normal would be response time of max 100ms.
0
 
DanNetwork EngineerAuthor Commented:
I will reply with more details tomorrow might.
0
 
rumytauluConnect With a Mentor Commented:
Could you run a :

netstat -a

on a command prompt and post the result here too? might be a trojan/malware hijacking your connection, netstat will help us find it.

--
rumy
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
DanNetwork EngineerAuthor Commented:
I've just attached a copy of the output of netstat -a after I restarted the server, as it was running so slow I had to do something about it.  Since I restarted the server, the ms times is better, still a bit slow, but ok.  I still have dropped packets, "request timed out", i just can't figure out why that is happened, as on my other server,  I don't have any dropped packets, well maybe one every few minutes, but on this server, it's like one every 10 seconds.


A little about my servers, the servers are hosted, and are NOT on our network.  They are on a seperate network than my internal network. I have 2 servers and one is fine, but the other is not, that's where I get all these packet loss.  I have about 15 static IP's on the server.  Running windows server 2008 R2 on both servers.  I tried pinging the servers from both, my work and my house, and I get the same results, dropped packets.  My work and home networks are again totally different networks.  

I actually had a DOS attack 2 years ago, and it was totally different, it was so bad that the data center called me and asked me what am I doing, as his entire bandwidth was being saturated by my server.  So I'm fairly confident that it's not a DOS attack.

The IPs with xxx.xxx are my local server IPs.

Any more direction would be appreciated.
ping.PNG
netstat.txt
0
 
DanNetwork EngineerAuthor Commented:
Can anyone provide any tips of what I should be looking at that could cause this issue?

I have attached 2 more screenshots with pings from the servers as of 5 minutes ago.
goodserver.JPG
problemserver.JPG
0
 
rumytauluConnect With a Mentor Commented:
1. On your ping result (problemserver.JPG) it seems that your have a good ping time (around 11 ms) yet you still experience RTO.

2. According to your "netstat -a" result you have tons establish (ongoing) outbound web connection which is strange

So I suspect a malware/trojan hijacking your connection, here's what you can do :

a. Install anti trojan/malware (trojanremover or malwarebytes) and scan your system in Normal Mode.
b. After that, boot into Safe Mode (F8 while booting into your Windows machine) and then scan your system again.
c. Reboot into Normal Mode, and see what "netstat -a" gives you this time.

Good luck.

--
rumy
0
 
DanNetwork EngineerAuthor Commented:
The server is my web server. Is that not normal activity for a Web server?  We have about 30 websites on that server, so is that not normal?
0
 
ChiefITConnect With a Mentor Commented:
Is the troubled server over a satellite connection. If so, this is what you would see via the first pic you posted in the original question. If I saw this, and new it was satellite, I would make sure the antenna is balanced and the ACU (antenna control Unit) is not causing errors. Satellite looks a lot like the first pick.

The second pick with lower ms return times, looks again like a wifi connection. The ms return time is not consistent, like the wired connection of 14 ms almost every time. The missing packet could in this case could be clocking and synchronization with the wifi connection or RF interference.
0
 
DanNetwork EngineerAuthor Commented:
No, they both have the exact same internet connection, they are in a data center.  It's probably fiber.  I have up to 20Mbps connectionf or both servers.  The internet connection is NOT wifi or satelite, it's a fiber connection into a data center.
0
 
ChiefITCommented:
then this problem may be a ISP/Cloud based problem. It appears that you  have RF (Radio Frequency) somewhere within your connection. It appears that RF is interferred with. So, this is what you can do...

Snatch up one laptop from the problem child data center and hook it up outside the firewall/gateway. Set the network config settings to auto and let the populate from your ISP. Now see if the times still look fowl.
0
 
DanNetwork EngineerAuthor Commented:
Thanks guys for your help, the problem was with a security software that one of my co-workers installed on the server, that causing the droped packets.  As soon as the service was stopped, everything is good now,
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.