Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Network droping packets

Posted on 2016-08-02
4
Medium Priority
?
42 Views
Last Modified: 2016-08-03
Hi Guys,
My network was working fine, for instance pings to servers were not drop and under 1ms.
All of the sudden in a ping to a server in my LAN I'm seeing huge delays, for instance "time=152ms"

I have 3 main VLANs namely
VLAN 1: For all my users
VLAN 20: For VoIP
VLAN 50: For some video recording security cameras and server
VLAN 88: For all my servers. (The servers are in a VMware Cluster).

These are my tests using a host in VLAN 1: (10.10.70.53)

ping 10.10.70.4
Reply from 10.10.70.4: bytes=32 time<1ms TTL=64
As a matter of fact any IP in this VLAN is under 1ms.

ping 10.10.88.10
Reply from 10.10.88.10: bytes=32 time=149ms TTL=63

ping 10.10.50.10
Reply from 10.10.50.10: bytes=32 time=150ms TTL=127

I just tested and the ping times are back to <1ms for everything.
As far as I can tell this lasted for about 1 hour.

My Opinion:
It looks as if there is a program in a computer somewhere generating absurd quantities of traffic in the network.

My Question:
If I'm right How can I identify the culprit?

One weird thing though is why there was no delay while pinging inside the VLAN 1?

Thanking you in advance,
Cargex
0
Comment
Question by:cargex
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:Bryant Schaper
ID: 41739797
I would suspect your router/layer 3 switch that is handling the inter-vlan traffic.  What kind of device is this?  We can maybe isolate the traffic source,
0
 

Author Comment

by:cargex
ID: 41739858
It is a Cisco 3750 Stack.
I was asking around and I think I found the culprit, it was a Video Editor that was saving his work as he was making changes in a network folder.

But I would like pretty much to know what tools can I use to identify a computer that is creating excessive traffic in a LAN.

This time I was lucky but in the future I would like to be able to pinpoint the culprit without the asking around part.
0
 
LVL 12

Accepted Solution

by:
Bryant Schaper earned 2000 total points
ID: 41739900
that would make sense.  You can use a few tools, some will recommend wireshark, however no a fan, and you have Cisco so that opens up a bit more too.

You can start with the full nms solutions like prtg, solarwinds or manageegine OpManager.  PRTG and OpManager have a free tier that may work for you.  They have SNMP hooks and give the details of traffic per port and such.  Good for proactively monitoring and sending alerts.

But I would start at the switch, you can use a "show interface summary" and look at RXBS and TXBS, same data as a "show interface gig1/0/" would give, but for all interfaces so you can spot it.

You can also setup netflow, would have the check the 3750, my 3560 does not have support.

Another useful one is "show processes cpu" and read the first line, it shows 5 minute utilization and will let you know if the device is getting hammered.

We recently had an issue with the backups killing the network, we saw high CPU on the router, and then used IP top-talkers to see what device was sending/receiving all the traffic, it was the backup server, and the intervlan traffic was killing us midday, so we moved that to a layer 3 switch off the 2921 router.  Routers just dont do it as fast, they are designed to talk to the edge network
1
 

Author Closing Comment

by:cargex
ID: 41740597
Thank you very much Bryant, your information is really helpful.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question