To Much Traffic on the network.

[Quinn06]

Ok so I have a client that has 4 locations.

3 of the locations have a Direct Pipeline that is 2MB/2MB to the main office where the server resides.

At first we were getting like 1MB transfer rates which was pretty alright.
Now we are getting 15KB transfer rates between the File Server and the Workstations.

One thing to note is that there is a domain, but these computers are not connected to it. They are just using work groups(We came into this mess). There are approximately 5 computers at each location, they are mainly using Quickbooks Pro and POS.

Is 2MB/2MB to little for sharing files from the server and basic internet usage? Are they just bottle necking? Or is there a way to clean up the network traffic so that it goes back to 1mb Transfer Rates instead of 15KB.

Would switching them from work groups to a Domain clean up the network traffic enough to be significant?

Any Ideas? Thanks!

 

[NYJimbo]

You gotta sniff that network and see whats going over it. To go from 1 or 2 mgbit to 15k has to show something if you observe traffic. If 2/2 was ok but now its horrible, something is going on and you won't know until you watch it.

Last month we had some incoming "chargen" (port 19) traffic killing one of our links here, but it was only bots trying to do something on only windows machines that had port 19 open and responding. Once we shut down "chargen" we saw traffic drop and a few days later everything went back to normal. Bots and zombies are always looking for exploits, you could have that on your network and have no clue without checking out what is going in and out.

So in a nutshell, you could have any possible kind of traffic, but without looking at it you won't know how to address it.

 

[Quinn06]

What is the best way to monitor the traffic? They are currently using a Sonic Wall, and 16 Port Unmanaged Gigabit Switch.


Thanks for your Input

 

[Encrypted Existence]

What is the best way to monitor the traffic? They are currently using a Sonic Wall, and 16 Port Unmanaged Gigabit Switch.


Thanks for your Input

The best way to monitor traffic would be to use port mirroring and a program like wireshark. The switch that your customer is currently using doesn't support port mirroring. If you have or can get your hands on a managed switch that supports port mirroring then you'd be golden. You can also use a good ole hub with the right setup.

 

[YeOldeStonecat]

What model routers are doing the VPN tunnel?
Cheaper routers have little QoS on the VPN tunnels....so if someone at one of the offices decides to fire up Pandora online radio...BAM....they got the connection and squash it for all others. Better models will have the ability to dedicated a % of the bandwidth to the VPN tunnel (which I know many Sonicwall models have)....so end users cannot abuse the internet pipe and squash the VPN tunnel.

I've done plenty of WANs where the workstations still log into the domains (IP address of the server at the central office). Works fine...and allows you to better control them.

Is netbios allowed to pass through the tunnels? If so..kill it, very chatty and clogs the pipes.

Windows updates controlled?

Antivirus managed?

Look at how DNS is setup..both on the satellite workstations and via the routers and even DHCP relay if being used.

 

[union122]

Use wireshark or ethereal and sniff the traffic, see what ip address is busy,..

 

[Quinn06]

Do I load wireshark on each workstation or on the main server to track the whole network? Thanks.

 

[teksquad]

If your sonic wall supports it try using netflow and export the data to a collector. Netflow can tell at a minumum the top talkers, source/destination ip's and dns names, protocols etc. PRTG is free for up to 10 sensors.

 

[YeOldeStonecat]

Have you looked into the DNS settings and seeing if the Sonicwall routers have VPN bandwidth management turned on and what it's set at? And netbios hopefully not enabled in the tunnels (they should be using DNS to navigate the other end of the tunnel). These are a couple of things that you can check in literally a matter of minutes...remotely even.

 

[teksquad]

Also are these 2MB circuits point to point links (leased lines) or are you using a vpn through the internet? Your initial post didn't say it was a vpn. If its a P2P then you may also want to get with your service provider and also look at your interface statistics for errors and logs (CRC, resets, etc) Dont discount bouncing that interface either.