Help - Slow network

[bodminman]

Hi there,

 

I have inheritted a network that consists of x2 domains, 1= RM CC3 and 1=Native Windows Server 2003 domain. There is a trust between the 2 domains for email access.

 

Basically very early yesterday both domains became very slow.

 

The Admin domain were complaining of very slow file saving/opening times and also had huge issues accessing SIMS.

 

One of the CC3 DCs restarted itself reporting s mRAIDx35 error. Looking on the web, the advice for this was to upgrade drivers for the hardware.

 

Anyway, I have been running AngryIP and WireShark to try and detect anything spurious but nothing is obvious!

 

The servers themselves don't appear to be working too hard. The max CPU we had at one point was on our SIMS box which got to 67% for a few seconds.

 

All servers and switches (Mixture of very old 3Com and newer Netgear kit) have been restarted and will be checking the firmware on them today.

 

But still cannot locate the cause of the slow down.

 

Can anyone please give me some pointers? I'm used to looking at Procurve Manager to identify switch issues but not sure if there are similar tools for older 3Com and Netgear kit.

 

Thanks in advance

[p858snake]

The speeds of the switches/hubs used?

Cabling used?

viruses on the systems?

When were the systems last ghosted/looked after (defrag ect)?

The speeds of the physical drives in the server arrays?

[jsnetman]

We had a slow down yesterday morning, the authority have conficker wild on the admin part of the network. Although all are curriculum network machines and servers are patched against conficker I presume the slowdown was something to do with the virus.

[bodminman]

hi there,

 

the core switches are 1gb but on or two out on the periphery are 10/100.

 

The cabling from the core to the cabs is fibre and then Cat5e from there.

 

PCs and servers are scanned every day and nothing has been reported.

 

All the servers were fully updated and defraged at the end of August.

 

As for the drives, they are enclosed in a caddy but will find out and update this post in a bit.

 

Cheers

[mossj]

cable loop?

[jamin100]

dont have any loopbacks do you?

Got storm broadcast control turned on the switches?

 

EDIT: Beat me to it moss

[bodminman]

No cabling work has been done for several weeks although that wouldn't stop a kid tinkering somewhere!

 

Is there a way to scan for a possible loop?

[bodminman]

Ah ha!

 

After an evening over removing fibre links etc, the fault was traced to a classroom that is only used for evening classes for so called mature students.

 

After accessing the room we moved the few PCs that are in that room away from the wall and hey presto, someone had removed the patch cable from the rear of one of the PCs and plugged it into another socket!

 

Best of all, as that room is currently only used once a week by the same people, we can easily work out who was in the room at the time of the event and therefore bans the idiot from the premises!

 

Thanks for your input though guys and gals!

 

Cameron

[TSCL]

If your switches support it you should enable spanning tree to stop it happening again.

[mossj]

If your switches support it you should enable spanning tree to stop it happening again.

 

Although spanning tree can have some issues with ip telephoney(our Avaya phones didn't like it).. so be careful with this. If you have 'bad' kids make sure not to let them know this was the problem, if they are truely bad you made find it happening more.

 

Also doll out the rep

Edited October 1, 2009 by mossj