SBS2008 emails extremely slow

Our internet connection in the office is running extremely slow, preventing users from accessing their emails.
Yesterday I contacted our ISP. They restarted the line and said everything fine. The router says the connection is at 6-7Mb which is normal.
But using the internet is unbelievably slow. Click a link and then go and make a cup of tea slow.

The suspicion is that there is some malware in exchange.
I ran a scan on the router using malwarebytes, attempting to apply the correct file exclusions. It didn't find anything.

Looking at the NAT sessions table on the router it shows a large number of active sessions involving ports 25 and 443, but I don't know what is normal.

If I reboot the router, there is flurry of emails arriving from Exchange, then it quickly grinds to a halt.

Any pointers?

I'm a bit desparate. But fortunately I'm not called Dan
clivie1Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

CompProbSolvCommented:
I would start by identifying whether or not Exchange is the issue.

From the server, browse to speedtest.net and do an internet speed test (or use whatever site you prefer), several times to have a good baseline.
Stop Exchange
Run the speed test several times again

If the speed is slow before stopping Exchange and fast afterward, then Exchange is the issue and we can look into that.  If it is slow in both cases then there is some other sort of issue to troubleshoot and we can look into that.  If it is fast in both cases, then we need to look at how you determined "internet connection is slow".
Dennis JohnsonIT technicianCommented:
Did you resolve the IP addresses of those active sessions? This could give you a clue...
Download and run CurrPorts on the server. It's a very detailed tool that shows the applications and the active connections, with comprehensive filtering capabilities.
A. Cristian CsikiSenior System AdministratorCommented:
Hi clivie1,

You might have a network problem. If you restart the router and the internet works fine for a while it means the ISP connection is ok. You could have a router/switch issue or even a virus that uses your bandwith (mostly the upload). Do a speedtest when works bad. See if you are really using all the bandwith and if you are receiving low values try, just unplugging the network cable from the server and do another speedtest with a client connected directly on the router (assuming that router does nat or you can use public ip's).

I don't think Exchange has something to do with. Rather might be a "virus" or a faulty hardware.

Regards.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

clivie1Author Commented:
OK.
I tried a couple of things.
I've shutdown Exchange using command line commands.
It has made no apparent difference to the speed of web page loading, as an example.
I also tried connecting the router directly to the server, rather than through the switch.
This appears to have made no difference either.
Router firmware is up-to-date.
ADSL down speed is 6.5Mb.
clivie1Author Commented:
Also there are still around port 25 action sessions in the NAT table
A. Cristian CsikiSenior System AdministratorCommented:
Please use another workstation. Not the server. A laptop or another machine. Remove Exchange server from network (unplug the lan cable) and do a speed test from the other machine.

Let me know.

Cristian
clivie1Author Commented:
Unfortunately the server controls the dns, not the router (hope I've got that right), so no internet without the server.
DNs forwarded.
A. Cristian CsikiSenior System AdministratorCommented:
Does the router does the NAT? If you have 6mb, you might have an adsl connection maybe. If you manage your dns from your server, no worries.

Just do like this:

If your network is nat-ed on 192.168.0.x, then use a static ip on a different workstation:
192.168.0.x    (you can get x with dhcp, before unplugging the server)
255.255.255.0
192.168.0.y    (y should be your router)
8.8.8.8 (use open dns values)

Cristian
clivie1Author Commented:
Sorry.
DHCP is handled by the server.
If I try and set up a static route on the router it won't accept it.
A. Cristian CsikiSenior System AdministratorCommented:
You don't have to configure nothing on your router. Your router only makes nat and your server makes the dns and handles the dhcp.

Now excluding your server, you remain without dhcp and dns. If you add OpenDNS (8.8.8.8) and add the same ip offered by dhcp on one client, but static now, you avoid completly the server.
CompProbSolvCommented:
I would suggest the following:

Connect a computer directly to the router.
Browse to speedtest.net
Disconnect ALL other devices from the router.
Run Speedtest (DNS shouldn't matter at this point as it has already resolved it).

Is it fast or slow?

If fast, start reconnecting devices and rerunning speedtest until you find what is slowing the connection down.
clivie1Author Commented:
I don't know how to do this.
I've DHCP config set to disabled, rather than relaying to the server.
I've set the Dns server IP to 8.8.8.8.
Still cant set up a static route, but the ip address of my laptop is bound to its mac address. In the arp table
CompProbSolvCommented:
@clive1: I assume that your last comment is at Csiki's suggestion (which is a very reasonable suggestion).

Keep in mind that my last suggestion requires no reconfiguration.
A. Cristian CsikiSenior System AdministratorCommented:
@CompProbSolv : the same think I have suggested to Mr. Clive. However if he uses the dhcp and the dns from the server will had a connection timeout once he unplugs the server. That's why my point was to make it independent and connect it directly to router, but with static values (dns and ip).

@clivie1: Can you please provedive us the local network configuration of one of your workstation that works?
(ip, gateway)

Regards
CompProbSolvCommented:
@Csiki: Yes, our suggestions are very similar.  Have just one computer doing the test with all others disconnected.

Once the workstation is logged in and has its IP address info from the DHCP server, it shouldn't need the server for DHCP for a while (until a workstation reboot or half the lease time is expired).  DNS is a different story, of course.
If the workstation is on speedtest.net and then the DNS is disconnected, that also won't be a problem as long as speedtest.net doesn't try to access some other domain.
clivie1Author Commented:
thanks for your help

I've tried and I honestly don't know how to do what you've suggested.

I thought I would factory reset the router which I did, but I don't seem to have the broadband password. then I thought I would go and buy ba new router in the morning, but I still don't hav the password.
So I think I'm stuffed.
CompProbSolvCommented:
"what you've suggested"....  Csiki or me?
clivie1Author Commented:
Both
CompProbSolvCommented:
Can you tell me where you had a problem with the four steps that I listed?  Or was it with the fast/slow question?
clivie1Author Commented:
OK.
This is weird.
I've disconnected everything from the router barring my laptop, and I can now browse web pages - just.
It is very slow.
Speed test refuses to run - just sort hangs.
Previously I couldn't get any type of connection.
CompProbSolvCommented:
Run this from a CMD prompt:

ping -t 4.2.2.2

It should run continuously until you press Ctrl-C or close the window.

Do you all replies come back?  What sorts of numbers do you get for "time="?

If the laptop is the only thing connected to the router and you are having speed issues (I believe that this is what you have indicated) then the problem is with the router, ISP, or cabling inbetween.
clivie1Author Commented:
Times average 95 seconds.
Quickest was 88 seconds.

I have had the line restarted and checked.

And I replaced all the cabling and the microfilter yesterday.
I'm going to order a new router.
CompProbSolvCommented:
Seconds or ms?

I'm running 35-45ms.
clivie1Author Commented:
Sorry Ms.
With quite a few timeouts.
CompProbSolvCommented:
4.2.2.2 is usually very reliable, but I'm seeing an occasional timeout right now.

Try:
ping -t 50.38.0.167
(That is one of the google.com servers.  I'm not seeing any errors now after 100 tests.)

You might also reconnect the server (so that it and the router are the only connected devices), browse to speedtest.net on the laptop, click on "BEGIN TEST", and disconnect the network cable to the server as soon as the test starts.  That should give you a fair idea of download and upload speed characteristics.

You mentioned that you replaced the microfilter.  Can you reconnect the DSL line without the filter, leaving all other (phone) devices disconnected?  This is all just for testing.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
clivie1Author Commented:
About 185ms
Speed test gave 5.61Mbps download, 0.52 upload.
That's without the server connected.
I unplugged the phone, but can't connect the dsl cable without the microfilter.
clivie1Author Commented:
Now I'm watching movie trailers on imdb and pages load very fast!
the only thing I have done is factory reset the router a few times and reloaded the previous configuration.
David Johnson, CD, MVPOwnerCommented:
usually the microfilter goes on the phone lines to filter out the dsl noise from the telephone users, and the dsl modem requires the full audio bandwidth. If you put it before the dsl modem you will have problems.
clivie1Author Commented:
the dsl cable connector from the router isn't a phone connector.
On adsl there have always been microfilters that plug directly into the bt socket, or built into it.
Have I had this wrong all these years?
No separate modem.
clivie1Author Commented:
Thanks very much for all your help.
It appears to be fixed. Speed is back to normal. Emails are flowing normally.
No real idea why, unless it was unplugging the phone.
I plugged it back in and things still seem fine.

Moving to Office 365 soon.
David Johnson, CD, MVPOwnerCommented:
the way it should be is:


telephone jack   - splitter ----- router/dsl modem
                                             ----- filter - phone
                                              ----- filter - phone
CompProbSolvCommented:
I agree w/David.  I have seen splitters that have a modem port and a phone port where the filter is built in to the phone port.  The modem port is a pass-through.  The splitter can be removed if the modem is the only device being connected.

I've always seen a standard RJ-11/12 jack as the input do a DSL modem or modem/router.  What sort of jack is there on the modem/router for the DSL signal?  What is the make and model of the modem/router?  I'm wondering if there might be some clue here.

While I agree that it is great that it is working now, I always have concerns in these situations (where I don't know what may have fixed it) that the problem will come back and I'll be starting all over again.
clivie1Author Commented:
BT socket has 1 rj45 socket.
Microfilter plugs into that.
Phone plugs into the microfilter along with the adsl cable with rj11 at each end.
The router is a Draytek Vigor 2280n.

Are you saying that the phone should not be plugged into the microfilter?
This is the microfilter I bought yesterday.
http://www.maplin.co.uk/p/rj11-adsl-microfilter-a24cg
David Johnson, CD, MVPOwnerCommented:
If you want to hear the DSL noise then don't plug the phone into the microfilter! This filter is a low-pass filter that only allows frequencies below a certain threshold. The dsl modem requires all frequencies above that threshold.. as shown in my simplified diagram. a filter goes before every phone but not the dsl modem. Here the DSL provider gives you 3 filters with their DSL package.
CompProbSolvCommented:
The microfilter that you selected appears to have RJ-11/12 (4- or 6-wire) connectors, and no RJ-45 (8-wire) connectors.

According to the manual I found at http://www.draytek.co.uk/support/downloads, the DSL port on the router is also an RJ-11/12.  There is an RJ-45 port, but it is for an incoming Ethernet connection.

You should be able to connect a standard telephone cord from the wall jack to the DSL port without any filter.
clivie1Author Commented:
I can see I'm out of my depth.

With the telephone cable straight into the BT socket, the up and down speeds are improved.
As we don't really ever use the telephone in that location, that is excellent.
Thank you.
David Johnson, CD, MVPOwnerCommented:
that is exactly what you need. as now the modem gets all of the audio frequencies that it requires.. In your circumstances you don't require a microfilter.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.