WTF is eating my bandwidth

[Vectracious]

OK - so the shop has 9 PC's plus a 2003 server. ADSL 1500/256.

Around about 5pm onwards, the internet gets ridiculously slow. Speedtest.net brings up speeds of about 0.18 Mbps. In the morning, its 1.5Mbps. Our IT people swear its nothing they are uploading that eating up the bandwidth. I've checked all the PC's and cant seem to see anything that's set off to download or upload at this time.

What can I do to find out whats going on?

[poita]

I have a program called netlimiter, shows every single program that is connecting to the net and what its using

Not 100% but I think you can data log with it

[gmonkey]

check with ur provider might be something with the line or something?? or there might be a cross in your phone line or even theres been reported cases of peak hour traffic effecting phone lines for some reason

does your eftpos update/download at this time perhaps??

[MAD-16V]

Most likely congestion on your exchange - A lot of isp's oversell ports and it causes problems ( most usually from 5 - 7pm onward ) when too many people connect and there is not enough total bandwidth it grinds to a halt.

I had a similar problem with TPG on my home broadband - I called them and got them to move me to a different port - Problem solved.

I would start with your ISP and ask them if they know of any current congestion issues at your local exchange.

[dglewis80]

I'm tipping its the exchange loading up after everyone getting home from work.

Edit - What MAD-16V said....

[gmonkey]

i thought that only really happens on Adsl+ and adsl2+ where its "upto" speeds.. p2 said he has 1.5mbs which "should" be a near solid connection

[Bloodnok]

OK - so the shop has 9 PC's plus a 2003 server. ADSL 1500/256.

Around about 5pm onwards, the internet gets ridiculously slow. Speedtest.net brings up speeds of about 0.18 Mbps. In the morning, its 1.5Mbps. Our IT people swear its nothing they are uploading that eating up the bandwidth. I've checked all the PC's and cant seem to see anything that's set off to download or upload at this time.

What can I do to find out whats going on?

Log the traffic.

Correct place to do that will be the ADSL router. Hopefully you've got one that has some logging or reporting features. It should at least be able to tell you what IP address (i.e. internal machine) is talking to what external host at the current time, if not record a log of historic traffic for you to look at. This functionality may not be exposed on it's web interface, so you may have to go digging.

If your router doesn't have any way of logging the traffic directly, then you'll need to get creative.

Easiest way of doing this is getting a hub (and yes, it has to be a genuine hub, not a switch), and putting it between the router and the network. Then you can connect another PC to this hub, and run Wireshark on it - and it'll tell you exactly what's talking to what...

[gmonkey]

its either any of the above... or its just guy in the alley way looking at porn

[Bloodnok]

i thought that only really happens on Adsl+ and adsl2+ where its "upto" speeds.. p2 said he has 1.5mbs which "should" be a near solid connection

Not so much that - but this is a business, which should mean a business connection, which in theory doesn't suffer the same contention issues at the exchange as a home grade connection.

[dglewis80]

Not so much that - but this is a business, which should mean a business connection, which in theory doesn't suffer the same contention issues at the exchange as a home grade connection.

But if the equipment leading into that exchange is reaching capacity then the whole exchange will slow down.

Had that issue at my last exchange.

[Vectracious]

Thanks guys - will call ISP on Thursday and ask them about the port issue.

P1 - is netlimiter freeware?

James - unfortunately our ADSL modem is just your basic Billion with wireless - had a look around on the setup page yesterday and couldnt really find any data logging. Cant even use the server because the modem is the gateway. Will do what you suggested if all else fails...

[Bloodnok]

But if the equipment leading into that exchange is reaching capacity then the whole exchange will slow down.

If it's done right*, then the business connections should be given QOS priority - so they still don't slow down - just the residential connections slow down.


* Of course, that relies on Telstra doing things properly. Which is admittedly unlikely...

[Vectracious]

* Of course, that relies on Telstra doing things properly. Which is admittedly unlikely...

Telstra unfortunately does not do many things correctly out in Berwick :(

[Bloodnok]

James - unfortunately our ADSL modem is just your basic Billion with wireless - had a look around on the setup page yesterday and couldnt really find any data logging.

I've got a Billion home router with wireless - and it can be made to do some basic logging (albeit you have to do some setup first). In 'configuration', there's an entry for 'firewall', within which there is a 'firewall log' - everything disabled by default.

Unfortunately it doesn't log successful packets, but it can be made to log failures - so assuming you have the same config, while you've got the slow speed problem, turn on this logging, and temporarily block the entire internet. You'll get a log of every failed connection - which will be everything. After a short duration, you can turn the internet back on, and look at the logs it recorded.

I'm sure if I got in to it on the command line it'd log everything - they pretty much all do underneath, it's just the web interface that doesn't expose it. But that may be a little complicated to explain how...


Cant even use the server because the modem is the gateway. Will do what you suggested if all else fails...

Yeah, I suspected that - it would be unusual (but possible) to route all traffic through the server in a small business / branch office setup like you've described.

[gmonkey]

u have passworded ur wireless right? / still is secured

[Vectracious]

u have passworded ur wireless right? / still is secured

yep - was the first thing I checked - the only wireless connection according to the router was my laptop (and no - MAC address has not been spoofed because when I disconnected my laptop, the session didn't persist)

[leighb0103]

There are a few things that could cause this:

Generally around that time, likewise with traffic, is classed as peak time. Its when most corporations start backups and heavy exchange traffic. This could be causing your issue.
As a result of this, the exchange might not be coping. Grab a copy of wireshark, and check out what is going on on your network at that time. I would quite happily take a look at the results if you wanted me to.

Let me know if you need anymore help, im a computer engineer student with CCNA, should be able to sort this out. :D

[Vectracious]

Thanks mate - will hopefully get some time to look at this tomorrow.