Solved

Network droping packets

Posted on 2016-08-02
4
28 Views
Last Modified: 2016-08-03
Hi Guys,
My network was working fine, for instance pings to servers were not drop and under 1ms.
All of the sudden in a ping to a server in my LAN I'm seeing huge delays, for instance "time=152ms"

I have 3 main VLANs namely
VLAN 1: For all my users
VLAN 20: For VoIP
VLAN 50: For some video recording security cameras and server
VLAN 88: For all my servers. (The servers are in a VMware Cluster).

These are my tests using a host in VLAN 1: (10.10.70.53)

ping 10.10.70.4
Reply from 10.10.70.4: bytes=32 time<1ms TTL=64
As a matter of fact any IP in this VLAN is under 1ms.

ping 10.10.88.10
Reply from 10.10.88.10: bytes=32 time=149ms TTL=63

ping 10.10.50.10
Reply from 10.10.50.10: bytes=32 time=150ms TTL=127

I just tested and the ping times are back to <1ms for everything.
As far as I can tell this lasted for about 1 hour.

My Opinion:
It looks as if there is a program in a computer somewhere generating absurd quantities of traffic in the network.

My Question:
If I'm right How can I identify the culprit?

One weird thing though is why there was no delay while pinging inside the VLAN 1?

Thanking you in advance,
Cargex
0
Comment
Question by:cargex
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:Bryant Schaper
ID: 41739797
I would suspect your router/layer 3 switch that is handling the inter-vlan traffic.  What kind of device is this?  We can maybe isolate the traffic source,
0
 

Author Comment

by:cargex
ID: 41739858
It is a Cisco 3750 Stack.
I was asking around and I think I found the culprit, it was a Video Editor that was saving his work as he was making changes in a network folder.

But I would like pretty much to know what tools can I use to identify a computer that is creating excessive traffic in a LAN.

This time I was lucky but in the future I would like to be able to pinpoint the culprit without the asking around part.
0
 
LVL 12

Accepted Solution

by:
Bryant Schaper earned 500 total points
ID: 41739900
that would make sense.  You can use a few tools, some will recommend wireshark, however no a fan, and you have Cisco so that opens up a bit more too.

You can start with the full nms solutions like prtg, solarwinds or manageegine OpManager.  PRTG and OpManager have a free tier that may work for you.  They have SNMP hooks and give the details of traffic per port and such.  Good for proactively monitoring and sending alerts.

But I would start at the switch, you can use a "show interface summary" and look at RXBS and TXBS, same data as a "show interface gig1/0/" would give, but for all interfaces so you can spot it.

You can also setup netflow, would have the check the 3750, my 3560 does not have support.

Another useful one is "show processes cpu" and read the first line, it shows 5 minute utilization and will let you know if the device is getting hammered.

We recently had an issue with the backups killing the network, we saw high CPU on the router, and then used IP top-talkers to see what device was sending/receiving all the traffic, it was the backup server, and the intervlan traffic was killing us midday, so we moved that to a layer 3 switch off the 2921 router.  Routers just dont do it as fast, they are designed to talk to the edge network
1
 

Author Closing Comment

by:cargex
ID: 41740597
Thank you very much Bryant, your information is really helpful.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
fabric 1 35
Cisco switch replacement sizing based on CPU, PPS, memory utilization, etc. 3 41
Some help with Network Design 4 50
software inventory tools 3 42
AWS has developed and created its highly available global infrastructure allowing users to deploy and manage their estates all across the world through the use of the following geographical components   RegionsAvailability ZonesEdge Locations  Wh…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question