Switch to switch causing traffic problems?

Did the switches cost less than $99 ?

Do they run the latest software ?

Is this a windows ActiveDirectry system ? If so, I think you have the wrong DNS entry in the PC that see long delays.

You use the word "switch" and I suspect they are really routers. Are they all on the same subnet ?

I imagine there could be other DNS/WINS problems.

Does office 1 access the NW server ?

I've seen problems when inexpensive equipment intended for cookie-cutter configurations get used in ways that are not shown in the manufacturer's glossy literature, as you are.

I've been burned connecting a cheapo switch to a Big Name switch (Cisco in my case) and the Most Senior network engineer I know has taught me that doing switch-to-switch connections on the cheap is a No-No. He insists the the cheap end be a hub. FWIW.

Reply to
Al Dykes
Loading thread data ...

The question is where the bottleneck lies.

Cheap things to check.

First, run virus, adware, and spyware scans on _everything_ for which you have a utility available. If you've got malware of some sort broadcasting tons of traffic on your LAN then nothing's going to work right until you fix that.

Ping each computer from each other computer and see if there is unusual latency in either direction. Download a copy of qcheck , install it on a Windows box, read the readme, and download the appropriate endpoints from the link in the readme, then see what speed you're really getting between machines and if you're getting the same speed both ways--if you're not then find out why--most common cause would be a configuration error--either speed or a duplex mismatch.

Windows server includes a tool called "network monitor". Go into the Windows Server help and search on that and install it on your servers and then watch the traffic going to and from them and see if you're seeing anything coming in or going out that doesn't get a response. The free version only monitors traffic to and from the server on which it is installed, which is a significant limitation, but it's still a useful tool.

There's a tool called "Ethereal" which is a general-purpose network analyzer similar in purpose to "network monitor"--ethereal is a free download--install it on one of your machines that is experiencing the slowdown and watch the traffic and see if it's sending anything for which it is not getting a response or receiving anything to which it should be responding and isn't.

With those tools and some time you should be able to identify most network problems--the trouble is that they're complex tools and it takes time to learn to use them--there's a book, "Ethereal Packet Sniffing"

which may help. While you're about it, if you haven't already read them try "Ethernet the Definitive Guide" by Charles Spurgeon

and "TCP/IP Illustrated" .

If you don't already have managed switches (and if you did and knew how to use them you'd already know whether the link between them was the problem--they'll tell you statistics on it) you might want to consider picking up a couple of them off of ebay--Catalyst 2924s go for under $200 and sometimes under $100. I see Procurve 4000s, which for your use are serious overkill but a bit noisy, for about the same.

Reply to
J. Clarke

If the OP has two switches then using a traffic monitor will be impossible unless the switches have management. If the switches have management then you'll get counters, which might show something interesting.

Assuming dumb switches I think the blinkenlights are as useful. If the lights are not blinking he's got a problem with a timeout, not a high traffic problem. DNS problems would show up as the former. If you do have lots of blinking lights then the traffic monitor on a Windows box may tell you something but because you have a switch it can only see it's own traffic. ISTR that MS Monitor had software that could be installed at other points in the network and feed data back to the server for aggregation and analysis. That would solve the switch limitation.

You can use perfmon.exe on any Windows box (except 98/me/dos) to analysis in great detail what it's doing.

If your server (CPU and disk as shown by permon) is idle and the lights are not blinking then you do';t have a capacity problem, you've got a network design problem. IMO probably DNS.

You can put ethereal on each and every box (except NW) and analysis the traffic and protocols.

Agreed. Procurve boxes have a lifetime warranty so you can't go wrong. As for my issue with cheap/noname switch-to-switch connections, If you match brands, HP or Cisco you should be OK.

Reply to
Al Dykes

If he's trying to monitor traffic on the entire network this is true. However if he has a specific machine that is having problems then monitoring traffic to and from that specific machine, which can be done by putting the monitoring software on that machine, can sometimes tell a great deal about its specific problem.

They can tell you that "something is wrong"> If

If the problem is internal to the machine. If it's sitting waiting for a response that never comes perfmon may tell you that it's waiting but it won't necessarily tell you what it's waiting _for_.

Possibly. Or possibly something specific to Windows.

Reply to
J. Clarke

The arrangement is

Office 1 - approx 12 PC's Switch 1 - router- internet | ~ 50 metres | Switch 2 Office 2 - approx 30 PC's plus 2 x Windows servers + 1 Novell 3.12 server (IPX)

All Cat5e structured cabling.

Virtually all traffic is from PC to one or other of the servers in Office 2. There are some networked printers in the system.

Traffic load should be relatively low. One central database on SQL server on one server, Word Processing and Exchange on the other and a small DOS application serving 4 users in Office 1 on the Novell server. Some but not heavy internet access via Switch 1.

Office 1 staff experience regular delays of sometimes up to a couple of minutes opening files or running an application.

The link between the switches is 100mbit (as is the rest of the network except the 10mbit cards in the Novell server).

There is a second cable running from Office 1 to Office 2 but that has not been connected and I'm not sure whether it is good practice to have a parallel run.

One company has recommended to upgrade the link to a gigabit line but I find the logic hard to follow since the servers will still have

100mbit cards.

Any helpful views welcomed.

Reply to

Replacing the noname switch with a hub is easy if you have one on hand, and they are _really_ cheap on ebay. I can't see a 10/100 hub being a serious bottleneck for the small site. It gives you a place to plug a PC running etherreal. This is a long shot.

Do you have Activedirectory on your windows servers?

ActiveDirectory makes very specific requirement for DNS services and the symptoms if you don't comply include long time delays. The easy way for a small site to comply is to make one of your windows servers your DNS server and point all the other machines at it.

I keep coming back to DNS/WINS problems. If you are not AD then who are you using for DNS ? Putting a name/ipaddress entry for all your servers in /etc/hosts on all your machines is one low-rent way to fixthings for a small network. If that improves things then you need to set up a real dns server and put things right.

Is the symptom in office1 reproducable on a specific PC ? If it is then carry the PC to office2, plug it in and see if the problem remains. If it/s on all machines or random, that tells you something but I don;t know offhave what it is.

If you unplug your ISP connection do the symptoms change ?

Please make your responses more readable.

Reply to
Al Dykes

I think you'll find it very helpful, both because it can collect statistics on port traffic and because it will let you set up a monitoring port that lets you see all network traffic that goes through that switch.

Reply to
J. Clarke

Pretty confident that machines are clean but some double checking may not go amiss.

This looks very interesting. I'll give it a go.

Well only two servers so not too much of a problem.

Many thanks - I will leave this till later. I recall it being a bigger subject than I wanted to get into on another issue last year.

It didn't at the time seem a complex enough network to require managed switches. I have a spare 2900 XL that I could hook up.

Reply to

24 PORT 10/100MBPS Unmanaged switches PLANET SWITCH FNSW2400S
2 x 24 PORT 10/100MBPS Unmanaged switches Allied Telesyn AT-FS724I-30
24 PORT 10/100MBPS Unmanaged switches PLANET SWITCH FNSW2400S Allied Telesyn AT-FS724I-30

AFAIK there are no updates available


Entries appear correct

I think they are called switches. All on same subnet.

Yes and in fact only office 1 accesses the NW server. No problems with this.

I don't understand I'm afraid what I am doing so wrong. Are you saying switch to switch is the wrong way to bridge the offices?

So I should replace the Planet switch with a hub?

Reply to

Ouch! This sounds like a config (DNS/WINS) problem. I hope you're not running NETBIOS.

One longshot -- you mentioned "structured cabling". Are you sure it's good? Proper Cat5e jacks and factory patchcords? All field/home-crimped plugs are suspect. Splitting a pair is too easy. High data errors in one direction usually result.

-- Robert in Houston

Reply to
Robert Redelmeier

No whitespace to make the inline responses visible.

Reply to
Al Dykes

Do a netstat -e on all your boxes. If the error counters are zero or single digits you don't have a cable problem. If they are higher you may have a cable problem or something else but you'll have narrowed down the problem.

Reply to
Al Dykes

IMO the back-to-back noname switches may be a problem with the IPX broadcasts. This can be proved by moving a problametic PC to site2 and hooking ot up to the local LAN. I

The OP has not described what tests and results he has. I'd expect that by now he's ruled out physical cable problems and sypware. If not then I suspect he's not troubleshooting methodically.

As for traffic analysis, I expect he's either got too much (saturating a respurce) or zero traffic flowing between a problametic PC and a server. I vote for the latter in which case he may have a multiprotocol stack binding proble, or DNS or WINS. None of which I am really good at troubleshooting.

Reply to
Al Dykes

Never had that complaint before. Is it because you replied to my reply to J. Clarke and not my reply to you which I thought was reasonably sensibly snipped in the context of your comments? :)

Reply to

The machines are running Novell's Client32 which has Netbios for IPX/SPX. There is no Netbios in use against TCP/IP .

I was sure. Reputable and long standing specialist cabling company {not the local electrician :) }. I believe they supplied their own patch cords pre-made. No hardship to swap a few around though.

Reply to

Aren't those at least partially broadcast protocols? I'm not very familiar with them, but it sounds like there maybe a response issue (not fast enough). Can you tune any parameters?

Well, there is both kinds of traffic on the network. Browsers re pure TCP/IP and so [usually] is email.


-- Robert

Reply to
Robert Redelmeier

Both ? Either ? I'd guess that by themselves the noname switch and AT would handle IPX and broadcasts OK, and AT is an OK brand. It's the combination. I don't want to make too much of this, but I've seen noname LAN equipment miss behave wne used in ways the manufacturer did't anticipate, and it's easy to swap a switch out for a hub if you have a replacement.

Goog luck.

Reply to
Al Dykes

Unknown protocols would't worry me offhand, expecially when you've got an IPX box on the LAN. YOu should always show these numbers with the overall numbers to get an idea of percentage.

If you're going to be a LAN technicial you should have a laptop with etheral (and other tools) on it and a small 4 port 10/100 HUB in your bag. YOu can always insert this hub in-line in a CAT5 circuit you need to monitor and this will give you a jack to plug the laptop into.

You can buy hubs on eBay. Warning. Some items desribed as a hub are really switches. When you buy one confirm for your self that is really is a hub. The only cost a few bucks.

Reply to
Al Dykes

Results as below for netstat -e -s Would you agree they seem ok?

Interface Statistics

Received Sent

Bytes 54984005 9219268 Unicast packets 58290 45282 Non-unicast packets 4144 561 Discards 0 0 Errors 0 0 Unknown protocols 3912

IPv4 Statistics

Packets Received = 61189 Received Header Errors = 0 Received Address Errors = 254 Datagrams Forwarded = 0 Unknown Protocols Received = 0 Received Packets Discarded = 9 Received Packets Delivered = 61177 Output Requests = 45799 Routing Discards = 0 Discarded Output Packets = 0 Output Packet No Route = 0 Reassembly Required = 0 Reassembly Successful = 0 Reassembly Failures = 0 Datagrams Successfully Fragmented = 0 Datagrams Failing Fragmentation = 0 Fragments Created = 0

ICMPv4 Statistics

Received Sent Messages 83 80 Errors 0 0 Destination Unreachable 1 1 Time Exceeded 3 0 Parameter Problems 0 0 Source Quenches 0 0 Redirects 0 0 Echos 8 71 Echo Replies 71 8 Timestamps 0 0 Timestamp Replies 0 0 Address Masks 0 0 Address Mask Replies 0 0

TCP Statistics for IPv4

Active Opens = 65 Passive Opens = 5 Failed Connection Attempts = 11 Reset Connections = 2 Current Connections = 4 Segments Received = 58122 Segments Sent = 45013 Segments Retransmitted = 86

UDP Statistics for IPv4

Datagrams Received = 2376 No Ports = 1222 Receive Errors = 39 Datagrams Sent = 616

Reply to

Is it primarily the noname that you suspect or also the use of back-to-back switches?

I'm not located on-site. Therefore at this stage it is an exercise of gathering information, putting together a plan and looking at those things that I can remotely.

Reply to

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.