Network Slowness

[efector]

I inherited a mess and I am unsure as to the issue. We have multiple subnets in our LAN. Currently we have a 192.168.190.0 and 192.168.181.0 networks in the same building. Both networks terminate into the SAME interface on the router that we have. I believe its a 2811. Nothing is made into VLANs or anything like that. Could the problem with network browsing, etc be because both networks are going into the same router/connection? The crux of the issue is that we have macintoshes(a problem unto itself) on the 181 network, and while the G5 computers are ok, the 2 G3 computers are not. This morning, while we had less people on the network, the G3 computers were acting fine. The issue is with file transfer and general network browsing.

thanks for any help. I can post the config if that helps

 

[watchguardmonkey]

is it a switched network or are you still on hubs, also do a sh int on the interfacew and post up the output.

 

[efector]

Its a switched network, they are HP ProCurve 4100's 10/100 switches(junk if you ask me). I will post the config.

Give me about an hour.

 

[vipergg]

you say they are both going into the same interface , if thats the case they must just be using a secondary address on the connection if they both feed from the same interface. The place to start would be to look at the interface on the router where they come in look at the utilization on the port . Also look to see if there are any errors on that link , should be none if running correctly on a FE full-duplex . When you say network browsing are you talking internet ? If so then you have to look at the internet connection , if that's slow.

 

[NetworkGhost]

Another issue may be virus/adware/spyware. Take a look at the amount of translations on the router. See who your top talker is also. Defintly do what the previous poster said by doing a sh int on the all of your interfaces on the router. Make sure there are no interface errors. I have seen recently that there has been alot of virus traffic going on lately. Like I said this can be easily identified by looking at translations.

 

[efector]

Building 1: 192.168.181.0/192.168.190.0
Building 2: 192.168.185.0
Building 3: 192.168.188.0

We are experiencing issues with 'slowness'with network browsing from buildings 2 & 3 TO building 1. In building 1, we also are experiencing 'slowness' issues. As I said before, the 181 and 190 networks are on the same interface on a single router. Buildings 2 & 3 come into Building 1 on a Point to Point T-1.

Is the issue that the router is trying to handle the 181 & 190 on the same interface? Here is the config:

version 12.0
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname USEXRT782-INT
!
boot system flash starting-config
logging buffered 4096 debugging

!
username
ip subnet-zero
!
!
!
interface Ethernet0
ip address 192.168.190.203 255.255.255.0 secondary
ip address 192.168.181.201 255.255.255.0 secondary
ip address 192.168.190.210 255.255.255.0
no ip directed-broadcast
no ip route-cache
!
interface Ethernet1
ip address 10.168.231.1 255.255.255.0
no ip directed-broadcast
no ip route-cache
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.168.231.2
ip route 172.31.31.0 255.255.255.252 192.168.190.1
ip route 172.31.31.4 255.255.255.252 192.168.190.1
ip route 192.168.185.0 255.255.255.0 192.168.190.1
ip route 192.168.186.0 255.255.255.0 192.168.190.1
ip route 192.168.188.0 255.255.255.0 192.168.190.1
ip route 192.168.189.0 255.255.255.0 192.168.190.1
ip http server
!
access-list 100 permit tcp 0.0.0.1 255.255.255.0 any eq telnet
access-list 100 permit tcp 0.0.0.244 255.255.255.0 any eq telnet
access-list 100 permit tcp any 0.0.0.1 255.255.255.0 eq 3128
access-list 100 permit tcp any any eq ftp
access-list 100 permit tcp any any eq ftp-data
access-list 100 permit tcp any any eq smtp
access-list 100 permit tcp any any eq domain
access-list 100 permit tcp any any eq echo
access-list 100 permit tcp any any eq 1352
access-list 100 permit tcp any any eq 389
access-list 100 permit tcp any any eq 3890
access-list 100 permit tcp any any eq 45535
access-list 100 permit tcp any any eq 30
access-list 100 permit tcp any 0.0.0.1 255.255.255.0 eq 44

I did not configure this router, we had a consultant do it, and inherited this mess. Also, why use an access-list on this router? these routers are behind a firewall and proxy.

 

[NetworkGhost]

The same interface issues shouldnt matter. In the end its all packets. The best thing to do in this scenario is to work it out piece by piece.

Look at the logs: sh log -- Anything weird going on?
Look at the interfaces: sh int -- Any errors?
Look at your translations: sh ip nat trans -- If you doing Nat. You may be better off looking at your FW to determine outbound translations.

Like I said in the previous post, There are a few things that are really hitting the net right now as far as viruses go. Port 445 is a popular port. A properly placed virus can easily slow down a network. Also if you have a "Switched Network" Check out spanning tree.

 

[efector]

The issue isnt with surfing the web....its internal network surfing..network browsing, application responsiveness. Should we shut the STP off?

 

[vipergg]

If you look at the router if you get even 1 person doing any kind of file transfer or such this will slow everyone as the router interfaces are 10 meg half duplex interfaces . Doesn't take much to slow 10 half interfaces , once it gets over even 30% utilization you will see a noticeable slow down.

 

[vipergg]

One thing you could check on the router is some of the later 10 meg ethernet interfaces could be set as full duplex so if thats possible you could change the interfaces to full duplex but you will also have hardcode your switchport links the same way can't leave them as auto . Also if that is your complete config the access list isn't doing anything because it is not applied to any interfaces so that can be taken out if you wanted.

 

[NetworkGhost]

The issue doesnt have to be with surfing the web. But now that you say that there may be other issues beyond the network equipment. Depending on the Network os you guys use I would definitly take a look at WINS/DNS/Active Directory/Netbios. WINS can be a kicker. Get rid of stale records that may not need to be there. Make sure people arent mapping to servers that are no longer there. I would make sure client PCs have the correct WINS/DNS settings.

Dont shut STP off. You would have to look at your switches to see if you are getting stp errors. During off time try :

Debug ip packet detail

Look for any broadcast storms. But if the problem is strictly internal I would look more torward your name to IP resolution.