Run wireshark to detect slowness on SMB and printing

Hi Experts,

I purchased a wireshark book ans still I am not very familiar on how to identify the cause of slowness on SMB access files and printing running wireshark,
Can you please explain to me what to look for when running wireshark?

Thanks
chenzoviccAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
Check prioritization of files and services within the network card properties.
Wireshark will capture the packet received and will need to be compared to a wireshark capture of the packet sending side.
Ledger type of sent time, received time.
Issues often deal with type of network, connections,
You could check whether the issue is actually in the transfer or leading up to meaning, credential check whether .........
Existing load on the system
What other functions does this system perform.

Has this issue been ongoing or has it recently started?
chenzoviccAuthor Commented:
How do I check? prioritization of files and services within the network card properties.
This computers were in a different location and this issues started after they were moved.
We just transfer the same equipment to the new location and plug it the same way.
arnoldCommented:
Plug in meaning at each location the wires were there.
Check what speed the systems are connected at.
I.e. Used to be 1GB now 100MB
Speedtest.net has a mini version that you can use by placing it in a system that has a web server (iis with or without php) and test the transfer rate.

How the switch/router were setup, if VLANed, connections might have not maintained....


Slowness with the same server/workstation/switches and presuming it is a flat non VLAN setup, the issue then narrows it down to the connection speed and he transfer rates will reflect a poorer connection.
Properties of the network card should reflect the rate at which it operates/negotiated.
Usually on a 1GB connection using the speed test you should see 80-90Mbytes upload and download in the test.
If the networking cabling is deficient the transfer performance rate will suffer and reflect it.
Need More Insight Into What’s Killing Your Network

Flow data analysis from SolarWinds NetFlow Traffic Analyzer (NTA), along with Network Performance Monitor (NPM), can give you deeper visibility into your network’s traffic.

chenzoviccAuthor Commented:
I checked the wire connection on both locations, checked router, switch interfaces and we have no errors on the interfaces. I will narrow down to either the cable speed or cabling or the wiring is badly done. Can wireshark see cable issues?
arnoldCommented:
Possibly by receiving retransmitted packets that were delayed.

What is the reflected connected rate on the network card 1GB or 100MB?
Interface errors are separate issue.

Do you have a network test tool i,e. You connect a loop on one end and run the tool test  from the other?
chenzoviccAuthor Commented:
Unfortunately I am not in the Location and I won't be there at all. It's mostly remotely that I have to try to fix the issue. It's a 1GB connection and they connect through a cisco ip phone. The phone runs 1GB.
jorge diazSECommented:
chenzovicc,

there are many things that could go wrong to cause an issue like this, it does not necessarily have to be smb itself. it could be associated with DNS of you are accessing the resources by name, QoS the gives your file transfer a lower priority, re-transmissions, etc. Wireshark can help you identify the problem but it not always tells where the problem is.  It could also be a L1 or L2 issue, you mentioned they were working before after they were moved ( i am assuming to a different area in the remote location) they are not working any more.

what i suggest is:
* isolate the problem. is it only on a handful of devices from the remote site or all of them?
* did you mentioned you are bridging through a phone, correct? I will bypass the phone and connect directly to the switch if possible. Even if it means telling someone to use a laptop, eliminate the "middle man" as much as you can.
* run wireshark on the device and capture the traffic.
* Check the communication from the remote host to the server as it tries to access the files. Again, I'd check for things like name resolution process, retransmissions, the window size <--- very important.
that'll get you started...

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pgm554Commented:
What's the switch?

Most high end switches have a status reporting system that will give you a readout of any errors.
chenzoviccAuthor Commented:
3750
chenzoviccAuthor Commented:
The problem has been solve and the issue was a Profile issue and once the profile was recreated the issue was fix. I troubleshoot all the devices in between and QOS as well and my last resource was to recreate the profile and BINGO.
Thanks guys for all your suggestions
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.