Solved

Network droping packets

Posted on 2016-08-02
4
33 Views
Last Modified: 2016-08-03
Hi Guys,
My network was working fine, for instance pings to servers were not drop and under 1ms.
All of the sudden in a ping to a server in my LAN I'm seeing huge delays, for instance "time=152ms"

I have 3 main VLANs namely
VLAN 1: For all my users
VLAN 20: For VoIP
VLAN 50: For some video recording security cameras and server
VLAN 88: For all my servers. (The servers are in a VMware Cluster).

These are my tests using a host in VLAN 1: (10.10.70.53)

ping 10.10.70.4
Reply from 10.10.70.4: bytes=32 time<1ms TTL=64
As a matter of fact any IP in this VLAN is under 1ms.

ping 10.10.88.10
Reply from 10.10.88.10: bytes=32 time=149ms TTL=63

ping 10.10.50.10
Reply from 10.10.50.10: bytes=32 time=150ms TTL=127

I just tested and the ping times are back to <1ms for everything.
As far as I can tell this lasted for about 1 hour.

My Opinion:
It looks as if there is a program in a computer somewhere generating absurd quantities of traffic in the network.

My Question:
If I'm right How can I identify the culprit?

One weird thing though is why there was no delay while pinging inside the VLAN 1?

Thanking you in advance,
Cargex
0
Comment
Question by:cargex
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:Bryant Schaper
ID: 41739797
I would suspect your router/layer 3 switch that is handling the inter-vlan traffic.  What kind of device is this?  We can maybe isolate the traffic source,
0
 

Author Comment

by:cargex
ID: 41739858
It is a Cisco 3750 Stack.
I was asking around and I think I found the culprit, it was a Video Editor that was saving his work as he was making changes in a network folder.

But I would like pretty much to know what tools can I use to identify a computer that is creating excessive traffic in a LAN.

This time I was lucky but in the future I would like to be able to pinpoint the culprit without the asking around part.
0
 
LVL 12

Accepted Solution

by:
Bryant Schaper earned 500 total points
ID: 41739900
that would make sense.  You can use a few tools, some will recommend wireshark, however no a fan, and you have Cisco so that opens up a bit more too.

You can start with the full nms solutions like prtg, solarwinds or manageegine OpManager.  PRTG and OpManager have a free tier that may work for you.  They have SNMP hooks and give the details of traffic per port and such.  Good for proactively monitoring and sending alerts.

But I would start at the switch, you can use a "show interface summary" and look at RXBS and TXBS, same data as a "show interface gig1/0/" would give, but for all interfaces so you can spot it.

You can also setup netflow, would have the check the 3750, my 3560 does not have support.

Another useful one is "show processes cpu" and read the first line, it shows 5 minute utilization and will let you know if the device is getting hammered.

We recently had an issue with the backups killing the network, we saw high CPU on the router, and then used IP top-talkers to see what device was sending/receiving all the traffic, it was the backup server, and the intervlan traffic was killing us midday, so we moved that to a layer 3 switch off the 2921 router.  Routers just dont do it as fast, they are designed to talk to the edge network
1
 

Author Closing Comment

by:cargex
ID: 41740597
Thank you very much Bryant, your information is really helpful.
0

Featured Post

What, When and Where - Security Threats from Q1

Join Corey Nachreiner, CTO, and Marc Laliberte, Information Security Threat Analyst, on July 26th as they explore their key findings from the first quarter of 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are thinking of adopting cloud services, or just curious as to what ‘the cloud’ can offer then the leader according to Gartner for Infrastructure as a Service (IaaS) is Amazon Web Services (AWS).  When I started using AWS I was completely new…
Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question