Odd Network Problem- network comes to a halt when server is connected

[evlfred]

I setup this network a couple years ago and now it's having a major problem. There are about 10 PC's, 3 printers, and one application dedicated server that just hosts an application they use for patient billing, the application is accessed via HTML and runs solely on the server. There server doesn't handle the network. Everything is connected to a 24 port gigabit switch and the router ( now a DIR-827) handles DHCP. The server is on a static IP below the DHCP range. It seems that the network stops functioning after a while when the server is connected. At first I thought the router was at fault, because they could not get internet access, and the router was taking 10 minutes to power cycle, super slow. I replaced the router but still couldn't get internet access, UNTIL I unplugged the server and rebooted everything. Reconnected the server and everything is fine for a day, then no internet traffic or pinging of the router again. One other symptom, they have to print to the network printers from inside the server hosted application, but the prints stopped coming later in the day and finally printed hours later. Then that night the internet stops working again. It's almost like the server is sending tons of data around and locking everything up, but I have no direct evidence of that. Anyone got any suggestions? I don't admin the server as it's completely handled by the application company.

[Martyn]

Are you sure the nic on the server hasn't gone faulty and is flooding the network with packets? Have a look with Wireshark. Just a quick thought.

[ProTech-MN]

Originally Posted by Martyn

Are you sure the nic on the server hasn't gone faulty and is flooding the network with packets? Have a look with Wireshark. Just a quick thought.

+1 for sniffing the network. Also, try swapping out the cables, try a different switch port, etc.

-Randy

[kwisher]

Does the server have dual NIC's? If so try the other one if you can access it and make the appropriate changes.

[YeOldeStonecat]

Is it a decent switch? Might be failing.
cables
server might have malware
workstation(s) may have malware

[evlfred]

I did just find a trojan with a backdoor on the server, so let's see if it wasn't participating in a DDOS or something. It would be nice if it were that simple.

[rsarceno]

+1 for sniffing the network and avoid guessing.

Disconnect the server form the switch.
Connect a HUB to the switch
Connect the server to the hub
Connect your laptop w/wireshark to the hub
Run Wireshark and analyze the capture.
Wireshark comes with smart analyst if your not familiar reading the capture files.