Slow Internet. How do you troubleshoot?

[Gongalong]

Hi folks,

 

I'm sure most of us have had "the internet's a bit slow today" from staff without any detail.

 

Ironically, I've had that exact problem yesteday afternoon and today and I'm struggling to find anything that spots a problem. We have 1Gb internet with VMB through a Smoothwall appliance.

 

In terms of monitoring, I use an old version of The Dude to keep an eye on devices being up, but I also monitor link speeds, and nothiing is saturated. I use PRTG to monitor both crucial websites and also servers etc. Since around midday yesteday, PRTG showed most websites as offline, yet I can access them on the server, and on client PCs. Still, things seem sluggish. It seems oddly coincidental that PRTG is showing this downtime. I've tried good ole fast.com, and that shows the internet speed to be as expected.

 

I have set the Smoothwall to reboot at 2am, but might bring that forward to a school day break if I get lots of complaints. I've never needed to reboot Virgin's hardware, but could also do that.

 

Any other suggestions for how to troubleshoot?

 

Thanks

[dhicks]

19 minutes ago, Gongalong said:

Any other suggestions for how to troubleshoot?

 

A basic-but-still-useful test is to run Google's built in internet speed test (just type "internet speed test" into Google search, it should pop up its own built-in tool). If you can run it on a device connected directly to your core switch / router (which should give you pretty much the speed of your core internet connection) and then try with an office / classroom (which might be a few more edge devices away from your core) you can see if there's a difference between the two. Anything connected to your core should probably get to 1Gb, but wireless devices might only be 100Mbps or less, depending on exactly which wireless version protocol they are using.

[JazzFlute]

20 minutes ago, Gongalong said:

Hi folks,

 

I'm sure most of us have had "the internet's a bit slow today" from staff without any detail.

 

Ironically, I've had that exact problem yesteday afternoon and today and I'm struggling to find anything that spots a problem. We have 1Gb internet with VMB through a Smoothwall appliance.

 

In terms of monitoring, I use an old version of The Dude to keep an eye on devices being up, but I also monitor link speeds, and nothiing is saturated. I use PRTG to monitor both crucial websites and also servers etc. Since around midday yesteday, PRTG showed most websites as offline, yet I can access them on the server, and on client PCs. Still, things seem sluggish. It seems oddly coincidental that PRTG is showing this downtime. I've tried good ole fast.com, and that shows the internet speed to be as expected.

 

I have set the Smoothwall to reboot at 2am, but might bring that forward to a school day break if I get lots of complaints. I've never needed to reboot Virgin's hardware, but could also do that.

 

Any other suggestions for how to troubleshoot?

 

Thanks

 

I do the below as a starting point which can then help diagnose/rule out issues.

Ping to 8.8.8.8 (Google DNS)

Running: ping 8.8.8.8 -t

How to interpret:

• Stable (e.g. 10–30ms, no drops) → Internet likely fine
• High spikes (e.g. 100ms+) → congestion / slow connection
• Request timed out → packet loss / dropouts
• Constant high latency → general slowness

Ping your gateway

ipconfig

Find your Default Gateway (e.g. 192.168.1.1)

ping 192.168.1.1 -t

 

What this tells you:

• ✅ Local network health (Wi‑Fi / LAN)
• ✅ Router performance

✅ Why you should compare BOTH

This is the key part:

Test	If problems occur	Meaning
Gateway ping bad	High latency / drops	❌ Local issue (Wi‑Fi, router)
Gateway OK, 8.8.8.8 bad	❌ ISP / internet issue
Both bad	❌ Likely Wi‑Fi/router overload
Both good	✅ Network fine (problem elsewhere e.g. PC/app)

 

 

✅ Extra tips (very useful)

Test a website name too:

ping google.com

• If this fails but 8.8.8.8 works → DNS issue

---

Use this combo (best quick test)

Open 2 command prompts:

ping 192.168.1.1 -t
ping 8.8.8.8 -t

Watch them side‑by‑side → instant diagnosis

[Gongalong]

Thanks both.

 

I forgot that the usual problem is DNS. We use the NCSC's Protective DNS, and I note that of the two forwarders configured for that, one shows as unable to resolve on our Windows server. Not sure if that could be connected?

[BucksITguy]

If there is one thing I have learnt in my career, it is always DNS! 😆

[AlphamaleZed]

Check your upload speeds, I know that if you got to 95-100% upload speed in use the rest of the network throttles right down and can sometimes kick people off the network.

Set a Limit to 90% of the max upload speed to be used.

[Gongalong]

14 minutes ago, JazzFlute said:

 

I do the below as a starting point which can then help diagnose/rule out issues.

 

Ping to 8.8.8.8 (Google DNS)

Running: ping 8.8.8.8 -t

 

Internal pings are fine, but I can't ping externally. I've added a rule to allow ICMP on the Smoothwall's firewall, still no joy, so I'll follow up on that with Smoothwall.

[JazzFlute]

5 minutes ago, Gongalong said:

 

Internal pings are fine, but I can't ping externally. I've added a rule to allow ICMP on the Smoothwall's firewall, still no joy, so I'll follow up on that with Smoothwall.

 

Id definitely contact them and ask them to remote in if possible to do some tests rather than you testing everything as they'll probably spot the issue faster.

[BKGarry]

16 minutes ago, Gongalong said:

Thanks both.

 

I forgot that the usual problem is DNS. We use the NCSC's Protective DNS, and I note that of the two forwarders configured for that, one shows as unable to resolve on our Windows server. Not sure if that could be connected?

 

Ah OK, so it is the pages are slow to respond, such no traffic but it can take a while for it to start going through. Like a slow start them boom?

 

I was having this with the NCSC Protective DNS, I changed my DNS Forwarders back to Google's ones and not had the issues since (well after I upped the memory on the top level DNS servers/domain controllers and waited a day or so for it to catch up)

[Ditto]

27 minutes ago, JazzFlute said:

 

I do the below as a starting point which can then help diagnose/rule out issues.

 

Ping to 8.8.8.8 (Google DNS)

Running: ping 8.8.8.8 -t

How to interpret:

• Stable (e.g. 10–30ms, no drops) → Internet likely fine
• High spikes (e.g. 100ms+) → congestion / slow connection
• Request timed out → packet loss / dropouts
• Constant high latency → general slowness

 

Ping your gateway

 

ipconfig

Find your Default Gateway (e.g. 192.168.1.1)

ping 192.168.1.1 -t

 

What this tells you:

• ✅ Local network health (Wi‑Fi / LAN)
• ✅ Router performance

 

✅ Why you should compare BOTH

This is the key part:

Test	If problems occur	Meaning
Gateway ping bad	High latency / drops	❌ Local issue (Wi‑Fi, router)
Gateway OK, 8.8.8.8 bad	❌ ISP / internet issue
Both bad	❌ Likely Wi‑Fi/router overload
Both good	✅ Network fine (problem elsewhere e.g. PC/app)

 

 

 

 

✅ Extra tips (very useful)

Test a website name too:

ping google.com

• If this fails but 8.8.8.8 works → DNS issue

---

Use this combo (best quick test)

Open 2 command prompts:

ping 192.168.1.1 -t
ping 8.8.8.8 -t

Watch them side‑by‑side → instant diagnosis

White ticks on  green background! ChatGPT or Co-pilot!?! I'm all in favour - but it's proving a struggle to convince some of my colleagues to use AI - with care of course!

[Olliedawg]

12 minutes ago, Gongalong said:

 

Internal pings are fine, but I can't ping externally. I've added a rule to allow ICMP on the Smoothwall's firewall, still no joy, so I'll follow up on that with Smoothwall.

What about if you try ping a domain name? Like ping google.com -t

[Gongalong]

3 minutes ago, BKGarry said:

 

Ah OK, so it is the pages are slow to respond, such no traffic but it can take a while for it to start going through. Like a slow start them boom?

 

 

Exactly that. Is that since midday yesterday, or has it been longer?

 

I've spotted that the Smoothwall appliance does have a ping function built-in, and that seems fine, but would be good to test from a client PC. Lots of the Smoothwall's diagnostic tests are failing, even though it describes most of the DNS resolution speeds as "speed is optimal". They're all at the tens of milliseconds level, not larger.

 

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=5.78 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=3.34 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=116 time=3.32 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=116 time=3.29 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=116 time=3.31 ms

[Gongalong]

1 minute ago, Olliedawg said:

What about if you try ping a domain name? Like ping google.com -t

 

Ah, that works! Without the firewall rule switched on that I just created. So ICMP *is* being allowed through the firewall.

[JazzFlute]

1 minute ago, Ditto said:

White ticks on  green background! ChatGPT or Co-pilot!?! I'm all in favour - but it's proving a struggle to convince some of my colleagues to use AI - with care of course!

Co-pilot - To type and explain what i posted probably about 15 minutes in my own words.  Copilot took seconds and then just make sure its correct as to your knowledge and post it....

[BKGarry]

2 minutes ago, Gongalong said:

 

Exactly that. Is that since midday yesterday, or has it been longer?

 

Mine was a while ago, check how your resources are on your DNS Servers, I think it is going to be there and the forwarding resolvers, which is why it feels like slow starts, but I do believe it may be the forwarded DNS requests. I just turned the protective DNS off, as when moving to smoothwall, we didn't see anymore NCSC block pages, as Smoothwall seemed to get there first.

[Gongalong]

We've got three DNS servers (VMs) configured with dual CPUs and 4GB of RAM. All seems OK (CPU use is low, 50ish% RAM usage) and PRTG does monitor them for load.

 

I've logged a ticket with Cloudflare, as I can't spot in the dashboard the servers I should be using. Whether coincidental or not, of the two configured forwarders, the first says it's unable to resolve.

[Gongalong]

30 minutes ago, AlphamaleZed said:

Check your upload speeds, I know that if you got to 95-100% upload speed in use the rest of the network throttles right down and can sometimes kick people off the network.

Set a Limit to 90% of the max upload speed to be used.

 

Upload looks good. We've got a synchronous connection, and with a speed test it's actually faster than download.

[gaz350b]

I would check out your top domains on smoothwall. Resource usage on the dashboard and the real time network traffic on the smoothwall and see if there is just a large number of hungry clients.

 

[AlphamaleZed]

35 minutes ago, Gongalong said:

 

Upload looks good. We've got a synchronous connection, and with a speed test it's actually faster than download.

Is this when the internet is slow or fast though? If its fluctuating can be related? maybe run a few speedtest.nets at the same time and see what happens.

[TechMonkey]

Can you plug directly into your Smoothwall or beyond?  Doing a speedtest from beyond Smoothwall and then plugged into Smoothwall would show you any difference in speed.  If they are mostly the same but much faster than from your desk you have a network issue, if they are the same as at your desk, it is your internet or beyond connection and if they are wildly different it is your smoothie

[BKGarry]

Ah one stupid though, you using any DAC cables anywhere in the mix? I have seen weird things when they start to fail too

[TheRobins]

Also to try (especially if filtering is involved) is to do developer tools in chrome and then network view, see if you can spot any slow downs. You can drill down quite a bit and look at points where things are slow to respond for web browsing at least anyway.

 

[Davit2005]

2 hours ago, Ditto said:

White ticks on  green background! ChatGPT or Co-pilot!?! I'm all in favour - but it's proving a struggle to convince some of my colleagues to use AI - with care of course!

Doubtful about the use (not the usefulness) of AI sometimes, lol.

[ZeroHour]

One thing I use to test whole bandwidth removing DNS (ping the domain to get the current ip) is a WSL ubuntu instance I have with iperf3 (Windows version has issues with the network stack)

 

iperf3 -c iperf.as42831.net -p 5355 -R -P 12 -t 30 -4

 

That for example usually will push to the limit of your connection. Just note the -p 5355 is the port, you may need to tweak that if the port is in use by someone else.

[Gongalong]

After the overnight Smoothwall reboot, all has been back to normal since. Coincidence? I did temporarily add google's DNS but have removed again and we're back to protective DNS. We used to get 2-3 power cuts a year here, but none at all in recent years so there's no enforced reboots of all the network gear.