This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark expert needed - URGENT

0

we have a pesky problem with our Internet up and download speed. this problem has brought our business to it's knees. I've spoken to a half-dozen tech support people... including our ISP and no one can diagnose the problem.

our isp says it is caused by outgoing traffic from one or both of our computers. Wireshark may be able to identify the problem but I don't know how to use it.

I'm willing to pay a consulting fee if someone can logon to one or both of our computers to diagnose the problem.

call me at 360.264.5248 [email protected] www.ingmancompany.com

asked 17 May '13, 14:26

jeffingman's gravatar image

jeffingman
11112
accept rate: 0%


3 Answers:

1

I've sent you an email. However, if the link is really saturated, it will be difficult to take over your computers.

Are you using any file-sharing software? Online backup services? Online storage that synchronizes (dropbox, etc).

It could also be that you are infected and that your computer(s) are part of a botnet. Are you running a good virus scanner and malware scanner?

answered 17 May '13, 15:57

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

I've had several techs logon to this machine and run it remotely... usually our speed is good enough to do that much

We have Norton Internet Security updated daily. We have paid support from them and they've checked my computer completely.

We use BackBlaze. We do have a sql server database hosted by our application provider in Texas. Data gets passed back and forth thru the day. But I'd say our generated and received data would pale when compared with most kids phone activity.

I'll be at my desk by 7 Pacific tomorrow. Call me at 360.264.5248.

jeff

(17 May '13, 16:40) jeffingman

OK, if the link is not saturated, how do you describe the "pesky problem with our Internet up and download speed"? What actions on the Internet have a problematic speed? And is it bad continuously or intermittently?

Tomorrow at 7 AM pacific is 16:00 CEST I believe. I'm not available at that time. I will be available later tomorrow (3PM pacific time or so) or on Sunday. Is that an option too?

(17 May '13, 16:52) SYN-bit ♦♦

The pesky problem is download speeds ranging from 1-8 megs. When it slows below 4k our database access slows. That's the basic issue.

There is no detectable pattern.

I should be here all weekend. 3 tomorrow works... please confirm. you have my email [email protected]

(17 May '13, 17:12) jeffingman

0

I don't want to interfere with the work @SYN-bit is doing for you as I'm sure he will identify the problem for you.

Nevertheless here are some thoughts to consider.

our isp says it is caused by outgoing traffic from one or both of our computers. The pesky problem is download speeds ranging from 1-8 megs. When it slows

well, if you have download problems, then the outgoing traffic should not be the root cause of the problem, unless that outgoing traffic totally fills up the whole pipe (bandwidth), which makes is hard/impossible for the ACKs of the incoming/downloading traffic to get through to the server. That would be rather unusual and unlikely.

There is no detectable pattern.

Sounds like 'something' uses the same pipe.

By any chance, your are not connected to the internet via a cable TV network, are you? If so, then that's a known and common problem in certain setups, as the TV cable is a shared medium up to a certain point and if someone else in the same building starts a large download all other users of the same connection will suffer from that download. The same holds true for DSL in certain setups.

So, how exactly are you connected to the internet?

Regards
Kurt

answered 20 May '13, 03:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 20 May '13, 03:54

Kurt:

I am still working on this issue with @SYN-bit. So far we have not solved the issue.

We have DSL service from a local telephone company. They have monitored outgoing traffic and at times see enough going out that they believe it is blocking the incoming pipe.

Jeff Ingman [email protected]

(20 May '13, 05:30) jeffingman

We have DSL service from a local telephone company. T

well, as there is no pattern for the traffic problems, please think about the shared link from the DSLAM up to the ISP network/backbone. Sometimes ISPs sell more bandwidth to their customers as that link can provide in a worst case scenario (all users requesting their 'promised' bandwidth). If that is the case and (several) other DSL users (connected to the same DSLAM) start large downloads, you will be affected as well. If there is enough bandwidth for the up-link it could be cross-talk between some wire pairs (however that's a rather unusual technical problem!). Please ask your ISP if they can rule out those two scenarios. But don't expect to get a 'fully honest' answer, if they do over-provisioning ;-))

They have monitored outgoing traffic and at times see enough going out that they believe it is blocking the incoming pipe.

that is not impossible, but rather unlikely. Nevertheless, if they see that kind of problem, you should be able to see the same with Wireshark on your local LAN. The problem is to catch a situation where it happens. @SYN-bit will help you with that. I just wanted to bring in some thoughts you might not have come up with yet.

Regards
Kurt

(20 May '13, 06:14) Kurt Knochner ♦

0

Good Morning, If there is a router or modem in the mix, I's say verify your layer 1 statistics on your circuit. It's very likely it could be dirty. (CRC, Drops, and such)

There is also the option of introducing Quality of Service / Policing for traffic.

answered 20 May '13, 06:52

b1b3tt3r's gravatar image

b1b3tt3r
11
accept rate: 0%