Network Slow Down in One Classroom

[FragglePete]

Got my head scratching this has.

One classroom seems to have always suffered from problems, while all the others seem fine.

Hoping that a re-image of PC's over the Summer would help, and initially things look ok, but the main issue re-appeared today. All the machines just seemed to run to a crawl and struggled trying to save files to the network. I'm waiting on some test results of a Fibre Health Check that was done over the summer to see if we have a suspect fibre feeding the room.

This room is looked after by 2 x HP ProCurve 2324 Switches which are unmanaged, so I've never been able to setup a Monitor/Mirror Port and do a bit of packet sniffing.

Now, the upgrades over the summer didn't upgrade these switches (wish I did now), however it has released an old HP ProCurve 4000M Core Switch. So, this evening I've put this in place of the two unmanaged switches in a hope that if the problems persist I can start to track things down a bit.

Now, initally logons on the machines seem 'snappier' but true test will be tomorrow when the kids are back in, but my nagging doubt is this: The 2324 have a much higher bandwidth capacity (approx 9Gbps), where as the old 4000M has only 3.6Gbps, the 2324 are unmanaged but the 4000M is managed, is this really going to be an issue? Is opening the odd Office Document and a bit of web surfing really going to cause that much strain of this old device?

Will report back tomorrow.....

Pete

[bossman]

@FragglePete:
I would suspect 3.6Gbps will be more than adequate ok as your fibre back to your core switch will probably be only 1Gbps am i right in presuming?
So however many computers divide into final bandwidth of fibre connection thats what we run and our login times are very quick.

[FragglePete]

Kinda makes sense. Switch is fed by 1Gb fibre from main Core Switch.

It's odd, as when it happened today I came down and had a look and users machines just seemed to have locked up. Head of ICT starts grumbling at me in the class "Disrupting whole lesson this is", but then all of a sudden things just sprang back into life and normal service was resumed. This afternoon had no issues either.

Pete

[Oops_my_bad]

Couldn't be a loopback somewhere on that switch could it? You know what the little sods are like..

Could even be a dodgy switch afterall

[User3204]

Have you tried running ethereal on a machine to see what traffic is passing by ?

[antoeknee]

Personally I'd take one of these machines to another suite and see how it runs.

If all is OK then it should be something related to the switches. Loopback might be an issue. Though duff switch is probably more likely.

Might be interesting if you can see what processes are running when the machines slow down.

[FragglePete]

It's an odd one, I've never really got round to sniffing that segment as it seems so random. When I get there, usually the problem has resolved.

Looking at the task manager last time, nothing was out of the ordinary, only our Prism Client was taking up a lot but this because it was trying to access the central database to see what should be installed on the PC.

Now I've got managed switches in there, I'm going to setup a spare old laptop with Wireshark sitting on the Mirror port and start capturing to see what is going on.

TBH, I suspect one of the existing switches but I'll be interested to see how it runs with it's current setup.

Pete

[User3204]

I've seen similar issues...
1) was due to multiple logons on the same username, and was when they tried to access clipart, from the user profile on the network... Solution: stop multiple logons.
2) was due to shared startmenu - or more precisely, the fact that everyone had write rights to it, and the machines were all trying to update this folder - At The Same Time -... Solution: Make the share read-only, and delete the rubbish links.

This was why I suggested ethereal, as this would show up excessive traffic for certain files/folders, DNS issues, loops, etc.

..Is Ethereal now called Wireshark ?

[FragglePete]

Shared Start Menu.... Hmmm... I believe they do.... Will look at that one.

And yes, Ethereal is I think WireShark now or is based on Etherreal.

I had no reports of any issues today, all went well, so the old 4000M is doing a sterling job.

However, had a quick look at the Event Log for the 4000M and saw an interesting collection of entries.....

'ip: Invalid Arp Target 0.0.0.0 on x.x.x.x'

Where x.x.x.x is the address of the switch. Googling the above doesn't really give much but a brief discussion on one of the HP forums about a possible loop and one person found it caused by a Novell Netware Client machine on the network????!!!

Something to watch, but I'm going to get an old laptop setup with nothing but Wireshark tomorrow and hook it up on the mirror port and do some random sniffing (oo-eerr )

Pete

[FragglePete]

Update for you all.....

Since putting in the older 4000M Switch, things seem to have settled down. Still get the odd 'it's running slow', but I believe that's more general....

However, have finally recieved my Fibre Test results that I had done over the Summer. And as I suspected, this main fibre run that feeds this end of the school is showing high levels of noise along with the run from this switch to this classroom also showing noise and possible damage! What a mess I've inherited!!!!

Looking at the summary I'm going to have to replace at least 3 Fibre runs next Summer, if not before.

Pete

[tonywesley]

I had exactly the same issue. Do the following tests

ping the server -t and see if you are loosing packets every so often from the location having issues

I was and changing the switch and it fixed the issue


If your switch is flashing like crazy then someone has patched two switches together twice or a virus problem

Other items that may be worth while is to setup test user and a different OU just to check that it's not Group policy

Lastly I have herd of some people having issues with odd excel document saving over the network slow. This was to do with the documents linked to locations no longer there or network drives.