Network Slowness

[John Schwindt]

I think I am in the right area for this.

Description of the issue:

My company experiences network slowness (3000ms+ ping times). It typically happens on Monday mornings between 8am and 11am(times are not exact). But in the last 2 weeks it seems to happen other days. We have 2 bonded T1s coming into the building which connects to a Cisco 2800 router and that connects to a SonicWall firewall. The switches are all Cisco. I have had SonicWall look at the FW config and logs multiple times but nothing looks "odd". We have had our ISP remote into the 2800 router, during the slowness, and they were able to ping out with normal responses (~30ms) and showing we are only using about 25% of our bandwidth. I have connected directly to the lan port on the FW and I receive normal ping times to the internet but within 3-5 minutes of plugging the core switch back in, the slowness reappears. The issues first appeared somewhere around the time when we replaced all of our switches, which was about 3 months ago.

What we are looking for:

Basically, we are looking for some way of being able to monitor our network traffic during this period of slowness to track down what is causing the issue.

If you need more detail to be able to help, let us know and we will get it!

Any ideas or thoughts will be appreciated.

Thank you in advance for your help!

[Ven Taylor]

A good start would be to post a quick diagram of your topology.

Console into your core switch/router and see if your problem is wan traffic or lan traffic.  Once you determine which direction the problem is, keep cutting your search in half until you find the problem device/connection.

However, if it's a Monday morning thing consistently, I'd recommend talking to your server folks to see if they're kicking off cron jobs or SQL backups or something like that.  They may not even know they're doing it.

It's recommended to do things like this on off-peak times to avoid interrupting day to day traffic.

Ven

[mvsheik123]

Hello,

In addition to Ven's suggestions , you can use Solarwinds network performance monitor (NPM) to monitor the network

gear response time & utilization of links. There are many other existing (including Cisco works) though. You download a trail version from 'Solarwinds' website and try that way as well.

hth

MS

[John Schwindt]

@ Ven Taylor

I dont know if you can enlarge the image in my post or not. I'm not sure how I would go about finding wether it is wan or lan traffic by consoling into the switch but from what we have found is it seems to only be the wan traffic. I have only had users complain about trying to get to internet sites, not documents on our company servers. I am one of the server folks and we have no backups or scans set to run during normal business hours (at least from what we know) except for antivirus on each PC but that would only slow down the local PC not the whole network.

@mvsheik123

I have looked at Solarwinds a little bit but from what I recall the Netflow traffic analyzer needs to be installed on the switches and I didnt see our Cisco 3750's as a supported switch. It is very possible that I just missed it or I was looking at an incorrect version but I do plan on looking again to make sure. I will also take a look at Cisco works.

[mvsheik123]

Hi,

if it is only internet, see if soniwall or 2800experiencing any high utilization (in terms of CPU/memory) during that time.

Also, as far as Solarwinds NPM, you do not need any netflow for basic monitoring & utilization reports.

Thx

MS

[John Schwindt]

I have been on the Sonicwall device during this time and the CPU usage was very low. We dont have access ourselves to the router as it is our ISPs router.