October 1, 2007; 07:11 AM
Slow network is a common phenomenon. For the diversity of the reasons causing slow network, to troubleshoot slow network is one of the most common and troublesome work in daily network management.
According to analysis, major reasons for slow network are:
1. loopback
2. Broadcast/Multicast storm
3. Virus attack
4. Server slow response
5. Too many clients
6. Application slow response
7. Error client mask
How can we fast locate the source when slow network happens? After analysis and practice, we found it’s a good solution to capture and analyze packets with a network analyzer.
Deep Analysis of Slow Network
Network analyzer works in sniffing mode. It can capture and analyze network communications in real time. After analysis, we can find reasons for slow network. Here we use Colasoft Capsa 6.5.
The following table lists the reasons, phenomenon of slow network in Capsa 6.5, and corresponding solutions:
Reason
| Phenomenon
| Solution
|
Loopback
| A lot of retransmission packets in Packet View, all field values are same, such as: IP identification, TCP seq-number, TCP ack-number. Utilization of network is increasing obviously
| Check connection of switching device in network, pull out the line directly connecting two ports
|
Broadcast/Multicast storm
| There are a lot of broadcast/multicast packets in Packet View. Broadcast/Multicast traffic is higher than 20% of total traffic in Summary View.
| Find retransmission packets in Capsa 6.5, view source MAC address. Then disconnect the problem host.
|
Virus Attack
| There are a lot of connections with same source MAC address, different destination address and same destination port, but in short intervals.
| View source address of these connections and disconnect the suspect hosts.
|
Server Slow Response
| In packets view shows that SYN/ACK response time too long in TCP three handshakes process
| Adjust server configuration and optimize the parameter
|
Too Many Clients
| Too many nodes in Project Explorer and Endpoints view.
| |
Application Slow Response
| Response time of packets to applications is too long in Packets View
| Adjust server configuration and optimize the parameter
|
Error Client Mask
| In Packets View, data that should be transmitted through layer 2 are retransmitted through layer 3.
| Change IP address and mask of the client.
|
Conclusion
Reasons causing slow network are diversified, there is no absolute way to guarantee normal network operation. With Colasoft Caspa you can easily find the date that you can identity the reasons. If you have additional questions, please visit http://www.colasoft.com .
PRESS BY MONTH
EDITOR'S DESK
SUBMIT PRESS
