LAN Tool to detect traffic and broadcasts sent? 1

[SteadySystems]

I've posted a few times regarding winxp/win2k tools and cleaning up a LAN.

We share a T1 line with another company.

The problem: something on our network is dragging down the T1 connection. It is coming from our side because when we are unplugged from the patch panel the T1 speed for the other company is 100% fast.

when its normal: I do a ping google.com -t and our ms is
63ms

then all of a sudden there is a spike that last for minutes upon minutes and I do a ping google.com -t and the ms is 1028! or higher.

So I have since ordered DSL 700 so that the other company is not effected and we have our own line. Also have ordered new computers to replace the olders ones and bought a new hub. Ordered new CAT5 cables for the patch panel/hub. 3ft - 5ft. Our router will remain the same, linksys.

What I need now is a lan tool that detects all the computers on the network and see if there are any spikes and where they are coming from.

Does this exist?

Thanks in advance.

 

[bcastner]

Some to learn about and try:

http://www.tucows.com/Windows/IS-IT/Monitoring/NetworkMonitoring/?page=1&nsort=size

http://www.tucows.com/Windows/IS-IT/Monitoring/InternetMonitoring/

 

[SteadySystems]

Thanks but I have no clue where to beging and what is what.

Anyone have something specific they can recommend? I don't understand packet sniffers or anything like that. Would be nice to hav a visual tool of my network bandwidith/broadcasts.

 

[Sympology]

Take a look at Solarwinds,

http://www.solarwinds.net

It's a while since I used their stuff, but has looks of monitors ans charts. May be what you need. i believe they do free trials.

Stu..

Only the truly stupid believe they know everything.
Stu.. 2004

 

[bcastner]

Try the free 30-day trial:

http://lastbit.com/trafmeter/Default.asp

You want the Pro version.

 

[maxthedork]

Etherpeek works well but you need to run it in promiscuous mode if you're on a switched network in order to see traffic on other ports.

Sniffer works equally well. Back in the day, I used to be a big fan of LANalyzer but I don't think they even make that anymore.

 

[SteadySystems]

I have a server, dsl modem, router and about 20 computers.

Just want to see which computer is dragging us down. I notice all the lights on the hub blink at the same time and some are constantly pulsing. Thats a problem.

 

[maxthedork]

Hub? Or switch? If it's a hub, then the activity you're seeing is normal, because they're all sharing the same bus. CSMA-CD, that's Ethernet for you.

Now, if it's a switch, when all ports blink, it's a broadcast, and when one or two ports are blinking that's activity between those ports, or direct communication. But depending on what protocol you have set up you may see frequent broadcasts. Particularly if you're using NetBEUI/NetBIOS, or IPX/SPX. If possible, try to set up an all-IP network and get rid of the chattier protocols.

 

[SteadySystems]

Very nice reply Max.

They just assigned me to take over as IT guy here (another company) so I am slowly getting all the details. It is not a hub.

Here is what I have:

- Linksys 24 Port Switch Model SR224
- Just recieved the DSL modem
- Linksys Router Model BEFSR41
- about 20 computers mixed with win 98, xp and 2k.

I know there are some using netbui but not IPX.

So are you saying that all lights blinking on the Switch is normal?

 

[Sympology]

Another way with that few computers. Run your pings then pull the plug on the pc's one by one. Brutal, but effective.

Also do Spyware / Virus sweeps on all the pc's. Could be that (or a Peer to Peer client).

Stu..


Only the truly stupid believe they know everything.
Stu.. 2004

 

[SteadySystems]

Stu,

Currently doing the sweep on the PC's slowly, but for now most of the computers have been FILTERED (on the router using ip range) from accessing the internet.

 

[Sympology]

Could be a simple / Stupid as Auto Updates. Windows /AV / Spyware. Does it happen at a certain time of day?

Only the truly stupid believe they know everything.
Stu.. 2004

 

[SteadySystems]

I always turn auto updates off. No, it is intermittent. When I unplug all from the switch the connection is fine.

Even tho we will not be sharing the T1 I still want to find the root of the problem because I am sure the problem with follow when the DSL is setup.

 

[Johnthephoneguy]

I think the adding or taking away the OPC's one at a time will narrow it down for you. Then you can troubleshoot the one PC.

 

[maxthedork]

Like I said, in a switch environment, when all ports blink it indicates a broadcast. With NetBEUI running it's not surprising, since hosts announce their names through broadcasts (and lmhost requests are also sent through broadcast, then replied back with broadcast, it's a pretty inefficient system which is why most pure IP environments employ DNS and SLP).

Putting a packet tracer on the wire will tell you for certain what all your traffic consists of, but with NetBEUI I'd suspect there's a lot of broadcast traffic. You could try setting up VLANs on the switch (I don't know if the LinkSYS switch has that capability though) to cut down on broadcast traffic. By setting up VLANs you reduce the size of your broadcast domains, and still allow communication from end to end. Just a thought. Or implement DNS/SLP and get rid of NetBIOS.

 

[geeve]

There is a general site for 100 network monitoring tools at Insecure.org. This is the linnk to the 6 apps for Traffic monitoring.

http://sectools.org/traffic-monitors.html.

The app NTOP (free, open source) looks like what you might need to monitor each ip for bandwidth plus other goodies.

 

[SteadySystems]

Max, how do I setup vlans? and what is it?

We are using DSL service dynamic IP. We disabled DNS.

 

[SteadySystems]

I setup the DSL modem (westell 6100) to work with our Linksys router. Had to change the WAN connection on the router to "obtain ip auto" instead of the static ip we were using.

Running Windows 2000 Server users have internet access but cannot browse the server now. All computer clients are set to obtain ip auto, etc

I set the server ip to

192.168.1.50 (Dhcp on the router stars at 192.168.1.100)
255.255.255.0
and used Verizons DNS addresses they provided (because win2k makes you enter something in DNS entries when you set a static IP)

AM I doing this wrong?

Any help appreciated!

 

[bcastner]

The Westell 6100 should be placed in Bridge Mode. All authentication should be done by the Linksys Router (use PPoE and supply the username and password).

http://www.dslreports.com/forum/remark,13922038

http://www.dslreports.com/faq/6323

 

[SteadySystems]

Yes, bridge mode.

PP0E is only for East coast customers according to Verizon.

My question is regarding the server, the DSL is working fine.