Solved

Slow internet connection every 10 days

Posted on 2014-01-29
16
453 Views
Last Modified: 2014-02-05
Hello, all. What happens is a bit weird so let me explain.

Every 10 to 12 days, usually after noon, internet speed goes almost to a standstill. When I try to go to, let’s say www.google.com on the bottom left of the browser I get messages “… trying to resolve host” etc.
If i try to ping an outside IP address or domain name most of the time i get time outs or if i dont time out the speed is like 1500ms.
If I connect my laptop directly to my Router/Modem then the speed is normal again.
This happens only to computers connected wired or wirelessly to the domain/network.

The topology of the network is as follows.
One Cisco X3000 Modem/Router Connected to an HP Switch providing internet.
Also X3000 is the DHCP provider to the premises. All other computers, printers have manually entered IPs. Also as Gateway they have router’s IP and as DNS1 the server’s IP
One Windows server as Domain Controller and DNS server. In server’s network card as Default Gateway there is the IP (192.168.0.150) of the router and as a DNS1 its own IP (192.168.0.100).

As for the forwarders I have the IP of the providers DNS and Google’s.
And that’s it. I can’t figure out what is wrong with my network. It’s very weird that this happens only once in a while so it’s hard to pinpoint the problem.
I have checked if someone is downloading something big etc. No luck.
Also I have checked with our provider if our DSL line is ok and every time it checks out.

Thank you for the assistance.
Dionisis.
0
Comment
Question by:DionisisT
  • 8
  • 7
16 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 39818127
Does your ISP provide you with a fixed IP public address or do you get it via DHCP?

How long is the slow down?  A few minutes, a few hours, the whole day?
0
 

Author Comment

by:DionisisT
ID: 39818269
Static IP and the slowdown lasts about 2 maybe 2 and a half hours.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 39818518
Is there a way you can to a packet capture on the HP switch of the port the modem is on?

Sounds almost like somebody is doing a backup every 10 days of of something.
0
 

Author Comment

by:DionisisT
ID: 39818557
How can I do that? I thought that too. The packet capturing. During the slowdown it would be great if I could see the traffic. There is a piece of hardware that every now and then communicates with a remote location but both user and the engineer responsible for it assured me that this was not the case.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 39818578
What model switches do you have?

Are they managed or unmanaged?
0
 

Author Comment

by:DionisisT
ID: 39818599
Sorry but I can't answer that right now. But i'm pretty sure its manageable. I'll return tomorrow morning for the model. If it is manageable I can monitor traffic right?
0
 
LVL 10

Expert Comment

by:tmoore1962
ID: 39818615
If you go into DNS console on server and restart the DNS server service does that remedy the issue or does internet remain slow?  If resolves issue then you may need to schedule DNS cleanup.
0
 

Author Comment

by:DionisisT
ID: 39818627
I've tried that and it will not help. If I powercicle the router for 2-3 minutes internet speed might return to normal and then back to oblivion...
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 57

Expert Comment

by:giltjr
ID: 39818912
If it is manageable you should be able to do.

What you would do is configure the switch to mirror the traffic for the port that the modem is on.

The connect a PC to that port and run Wireshark to capture the packets.
0
 

Author Comment

by:DionisisT
ID: 39824055
@giltjr Ok done that and packets are comming. What am I looking for?

P.S. It's happening right now!
0
 
LVL 57

Expert Comment

by:giltjr
ID: 39824198
You want to look to see if any host is generating a TON of traffic.  That is enough traffic to eat up all of your Internet bandwidth.

Once you find that out, then you need to find what that host is doing.
0
 

Author Comment

by:DionisisT
ID: 39824285
Ok i've captured 1012 packets. Of which 236 are UDP connections to external IP's from the server. 114 are from a user and many more are outgoing connections from the server to external IP's.

Do give you an example the following are incoming connections(many of them):
48      7.817920000      85.72.92.200      192.168.0.100      UDP      112      Source port: 60858  Destination port: odeumservlink
1012      94.929498000      79.129.16.89      192.168.0.100      UDP      176      Source port: 50546  Destination port: odeumservlink

And the following are outgoing connections:
931      88.319408000      192.168.0.100      79.129.16.89      UDP      112      Source port: odeumservlink  Destination port: 57985
943      89.163910000      192.168.0.100      85.72.92.200      UDP      112      Source port: odeumservlink  Destination port: 60858

Also one thing that i forgot to mention is that on the server is running Hamachi. Someting that i have to use...
0
 
LVL 57

Expert Comment

by:giltjr
ID: 39824312
If the UDP traffic "disappears" from the packet capture then that is most likely your problem.

I believe that  Hamachi I believe it uses UDP to setup VPN connections.  So what do you use VPN for?

Could your server be VPN'ing outbound to distribute "information" or to do a backup every 10 days?

If possible I would check to see if that server has a task that is scheduled to run every 10 days.
0
 

Author Comment

by:DionisisT
ID: 39824348
Hamachi is used by our 2 abroad offices. We have a CRM Software and Hamachi emulates local network connection for these two offices. But from time to time i see errors in event viewer about printer drivers i dont have in my network.
I thing i have to blame Hamachi for this...
Right now i have dissabled Hamachi but network speed is still slow...
Any way... i have to go now. Thanks for your help. I'll get back to you on Monday.
Have a great weekend!!
0
 
LVL 57

Accepted Solution

by:
giltjr earned 500 total points
ID: 39824802
I would do more packet captures, 1000 or so packets is not really a lot.

You have a good weekend too.
0
 

Author Comment

by:DionisisT
ID: 39836923
Internet speed is still good. Next time I experience slow internet speed I will do a ten minute packet capture. @giltjr thank you for your help and suggestions.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Some time ago I was asked to set up a web portal PC to put at our entrance. When customers arrive, they could see a webpage 'promoting' our company. So I tried to set up a windows 7 PC as a kiosk PC.......... I will spare you all the annoyances I…
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now