This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Network Very Slow

0

Hi Guys,

I'm a new user to wireshark and was wondering the best way to diagnose a very slow network in our office. Since last week users have been complaining of file transfers to and from the file servers to be very slow. I have personally checked them as well and they take forever to transfer an average sized file (less than 10mb)tahe couple of minutes.

I see a lot of ARP traffic when I run wireshark. The IP indicates our print server. I have tried restarting the server as well.

Any guidance would be greatly appreciated.

asked 14 Apr '14, 13:04

marusiraa's gravatar image

marusiraa
1●1●1●1
accept rate: 0%

This is unfortunately a fairly loaded question and would require a lot more in-depth knowledge of TCP and network flow to truly come up with the exact reason. Do you have a sample pcap which might shed some light on the file-transfers? Have you checked things on the server itself, like logs for potential errors? Check the disk I/O related error or failing equipment? It might not be the network at fault.

(14 Apr '14, 13:19) mire3212

One Answer:

0

There can be a variety of reason for a slow network. Some common reasons are

  • a loop in the Layer2 architecture (connecting switches to each other to build a circle). If this is the case, you will see a lot of duplicate frames. The ARP frames you mentioned could be first sign for this. If you see the same ARP request in consecutive order in the capture file, with very little delay, you should first check if there is a loop somewhere.

  • a broken device, flooding the network with broken frames

  • dumb user, trying hacker tools on the coporate network, like ARP flooding tools to capture network traffic, essentially 'converting' your switch into a HUB that forwards frames to all ports.

I could imagine some other reason, but those are the first that pop up in my mind, based on your description.

Regards
Kurt

answered 14 Apr '14, 14:10

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%