SBS2011 Server losing packets

Hello, so this customer of mine has a Windows network with SBS2011 Essentials on the server and W7 64bit on 3 clients.

There was a lag problem for all software on the clients connected with the server, so we tested it all by pinging and there's a heavy loss of packets when you ping the server from any client.

This doesn't happen when clients ping each other: no loss whatsoever.

Also, it doesn't happen if you ping a client from the server, so it's one-way only.

The packet loss seems to be totally random, it won't happen for an hour then start to happen every few minutes.

On average, I'd say about 5% of the packets is lost, but the loss happens in waves, so it's heavily felt on the client machines.

We tried changing switches and cables, disabling all non-essential services on the server but still we couldn't find the cause of this. We used Process Hacker and other tools, but to no avail.

The network is behind a Zyxel firewall, but it shouldn't interfere at all with the LAN.

So can anybody help me diagnose this? Thanks.
Daniele BrunengoIT Consultant, Web DesignerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David AtkinTechnical DirectorCommented:
Hello,

I'd start by checking that your NIC drivers are up-to-date.  I'd think about swapping out the NIC as well to rule it out.

What switches do you have on site and how many?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
Thanks.

About the switches, they have all been bypassed in one of our tests, we tried connecting all to the same switch, also changing the switch, and it still happens. Drivers are up to date. Trying another NIC is one thing we didn't try.

Right now I'm off-site though, so I can only work remotely. Is there anything software-wise you think I could try out?
0
Chris HInfrastructure ManagerCommented:
Packet loss even after all that troubleshooting is almost guaranteed hardware.   You could check in device manager and see what you have your flow control, frame size, etc set to.  Although, I'm confident David's suggestion above about replacing your interface card is the best bet.  

In the worse case scenario, you could even have a bad onboard NIC or PCI bus.
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
I can try that on saturday. What seems strange to me though is the fact that the loss is only with client pinging server and not with server pinging client. I am just now pinging two clients from the server and I have 100% passed: at the same time I am pinging server from each client and I have 95% on one and 94% on the other.
0
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
Sorry, my colleague just told me he already tried with two different NICs, same problem.
0
Chris HInfrastructure ManagerCommented:
Interesting... Try disabling windows firewall temporarily?  Test and see.  Do both server and client have IPv6 enabled?  Are you ping via Hostname or IP?

Make sure to clean up superfluous pointer records in your dns.

EDIT:

http://www.networksteve.com/forum/topic.php/Packet_Loss_-_Server_2012_&_HyperV/?TopicId=39878&Posts=9

Take a look at that also.  This seems to be a common issue but I've never heard of it.  The two culprits in most cases are ipv6 and dns, either misconfigured or duplicate pointer/host records
0
David AtkinTechnical DirectorCommented:
IPv6 would have been my next suggestion as well.

If you have any Anti-Virus installed on the server then temporarily disable this as well just to rule it out.

If you go on task manager and look at the network performance, is it doing anything unusual? Or is it relatively low activity?

Is the network gigabit?
0
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
The ping has been done via ip usually. Windows Firewall has been disabled on domain level.

I have been testing with IPv6 but disabling it doesn't seem to do the trick as it did for a guy in the page you found.

I still have to check dns.
0
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
Antivirus has been disabled together with most Services.Network's gigabit.

One importante thing I forgot to mention: safe mode with networking makes the problem go away.
0
David AtkinTechnical DirectorCommented:
I'd refer back to the drivers again then.  When you replaced the network card was it the same model of card using the same driver?
0
Chris HInfrastructure ManagerCommented:
I would go with an entirely different brand and chipset of network card (preferably intel if you're not already) and install the latest drivers from the website.

Also, not sure about windows 2012, but you used to have to do cleanup after p2v for windows.  I'm wondering, since microsoft's OS has strayed the user so far from the kernel, if going from 08 to 12 has installed some form of virtual or TAP devices for any of your legacy hardware.  Try taking a look at everything network related, delete and re-install in device manager.

How to show orphaned and hidden devices in device manager:
http://support.microsoft.com/kb/315539

set devmgr_show_nonpresent_devices=1
start devmgmt.msc
Click Show hidden devices on the View menu in Device Manager
0
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
We tried with 2 Intel cards and a Realtek chipset card. No change.

We're going to format everything tomorrow, it's taking too much time to diagnose this.
0
Daniele BrunengoIT Consultant, Web DesignerAuthor Commented:
So after formatting everything's perfect. Still would have loved to know what the hell was wrong in the previous setup, but we inherited it and were on a schedule. I'll distribute points since you were all quite helpful and it was a learning experience.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Management

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.