Because he said:
"I am also lacking proper testing equipment."
It takes more than just stuff on a PC to really test a network.
Not necessarily. First off, begin by removing variables from the environment. Pull the switches off the router and test the bandwidth with only YOUR computer using the internet. That eliminates anyone else sucking bandwidth from the test.
If that tests out to be about 1.2 mbps or so (about all you're going to get from the t1), then begin working backwards..
Add one switch.. two switches, etc.
As you add switches, you can use something as simple (and free) as wireshark - set up one port to mirror traffic that is tied to the router... see what's going on.
Another troubleshooting tool you can use is opendns.org. Set them up to use that DNS server and look at the domains they are going to. That can make it pretty simple to see where traffic is going (at least a godo portion of it). You can also see some domains where virus traffic typically goes to.
What type of router do they have? Does it provide stats? Can you send syslog data to a syslog server? Set up kiwi syslog on your laptop and start watching the traffic.
If they have a 'home office' firewall like a low end linksys, netgear, dlink, they could be getting crushed with traffic.
Is all firmware updated? Are the switches manageble? If so, make sure their firmware is up to date also. I just had a customer who's internet was SLOW all the time.. what they didn't notice was their local traffic was irregular also because they used mostly wan resources. Upon looking at wireshark's captures, I noticed that I could see alot of point to point traffic - not just the broadcast traffic one expects to see on a switched network. Guess what - a simple firmware upgrade to their 3com switches - and viola! I'm the hero.
Take it step by step. Remove variables and work your way back. Its easy when you break it down.
After you clean up the network, you also have to realize they cannot control the computers on their network - so block everything you can so you can give a decent level of service to most people. Opendns will help monitor traffic as well as syslog data (which they should do anyways - if people are downloading child porn they want to be protected by log files).
Also, recommend a router that can have a dual wan interface to load balance traffic.. then throw some cheap bandwidth like dsl or cable at it as a secondary. You can do this with several different firewall / routers... dlink, sonicwall, linksys / cisco...
Good Luck!
