cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
16983
Views
0
Helpful
6
Replies

Any advice on where to start when troubleshhoting a slow network (users complaints)?

p_salmon01
Level 1
Level 1

We currently have users from one of our branch office that complains around network performance issues (slow network). Troubleshooting issues like this one was not the focus of my CCENT studies (got certified 2 weeks ago) but I was assigned that ticket last Friday (first assignment). I was thinking to call one of the users and ask him to connect on another computer to see if he still encounters the same issue (that would tell me if it is related to his computer or not - probably layer 1, 2 issue), ask him to try another application (to help determine if it is a Layer 7 issue) and then if it is not related to neither one of these I was thinking to start looking at the switch interface to which the computer is connected to. I would like to know if someone could tell me if I am on the right path and what else I should verify/investigate? Are there root cause analysis tools that exist to help solve/troubleshoot such issues?

Thanks in advanced.

6 Replies 6

paolo bevilacqua
Hall of Fame
Hall of Fame

Define "slow" ?

I didn't communicate with the users yet.  I wanted to get some ideas before doing so.  I will for sure try to have them define what the consider "slow".

Thanks for the advice.

darren.g
Level 5
Level 5

Patrick Salmon wrote:

We currently have users from one of our branch office that complains around network performance issues (slow network). Troubleshooting issues like this one was not the focus of my CCENT studies (got certified 2 weeks ago) but I was assigned that ticket last Friday (first assignment). I was thinking to call one of the users and ask him to connect on another computer to see if he still encounters the same issue (that would tell me if it is related to his computer or not - probably layer 1, 2 issue), ask him to try another application (to help determine if it is a Layer 7 issue) and then if it is not related to neither one of these I was thinking to start looking at the switch interface to which the computer is connected to. I would like to know if someone could tell me if I am on the right path and what else I should verify/investigate? Are there root cause analysis tools that exist to help solve/troubleshoot such issues?

Thanks in advanced.

This is a pretty wide open question, and could be caused by a myriad of things. I'm going to make a couple of assumptions (yeah, I know, make an ass out of you and umption) such as the branch office is linked to head office by soem kind of dedicated link, and uses that dedicated link for internet access via the head office instead of having a local internet link. You may not have this, but the process should be similar - just the weight of the diagnosis of different stages may be different.

First off, get the user to define "slow". Compare the expectations of the user to the actual infrastructure at the site - if he's expecting a 10 MB/s download rate from the internet (100 mb/s) and you've only got a T1 or E1 link (1.5 mb/s), then it doesn;t matter WHAT you do, he's going to complain it's "slow".

Then move to the basics. Have the PC's investigated. Are they connected at the rate you expect? 100 Mb/s? 1 gig? Full duplex? The most common problem I've seen of this type is incorrect duplex negotiation - PC thinks it's full fuplex, switch thinks it's half duplex, and the result is lots of dropped packets and retries, resulting in "slow" connections almost everywhere. There's also the possibility of speed auto negotiation failing - something capable of 1 gig negotiating 10 Mb/s makes a *big* difference, especially if it's internal infrastructure being accessed.

Do some PING tests - ping a known local host - the local default router, for example - and see what kind of RTT you get. Then ping a known "intra" company host - one which is within the company but not on the local branch office site. What kind of RTT's do you get there? Finally, test a known external site - www.google.com, or a public DNS like the one at 4.2.2.2 - what kind of PING RTT's do you get to them?

Then traceroute - do the same ting, and look for weird hops, or really slow responses - is the workstation getting hooked up on something, protocol-wise, which does a reverse lookup (SSH is a classic example) before accepting connections - and when the RDNS doesn't exist, it "pauses" for several seconds.

Then it gets complex - start looking into the routers involved, and check for dropped packets or errors in the log. Check with the link provider and ask them if they see any errors on the link.

Where you go from there depends really on what you find up to now. ISP, management to, erm, educate the user to the realities of life in remote locations, or maybe you've actually got some faulty hardware somewhere you need to fix. You never know, it does happen! :-)

Good luck.

Cheers.

Thank you Darren.  Your answer is very helpfull and is exactly the sort of advices that I was looking for.  I will work on this issue this week and I will try to let you know how it was resolved.

Thank your for your time and your help.

Have a great day!

A handy tool to have around:

http://cisconet.com/traffic-analysis/throughput/104-tcp-throughput-calculation-formula.html

You would be suprised at what changes at the workstation level can do.

Another handy tool to have is iperf.exe -

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: