slow website only with one ISP

SYNbit - I am not sure we are saying the same thing. With ISP-1 I only have problems with one particular web site. Everything else is fine including other secured [https] sites. Only this one site gives problems and it is erratic. We are in it all day long. For short periods - a few minutes to maybe 1/2 hour - performance will be acceptable but then the wheels just fall off. It might take 10 minutes to load a screen that normally takes 3 or 4 seconds. This can last a couple of hours.

I did get a Wireshark capture file last night while performance was good but I'm not really capable of looking at the two and figuring out any differences. Plus, it may not be useful since I only captured traffic between the workstation and the website. That may not be useful. I don't know.

Yes, there is a Linksys firewall between the internal network and the cable connection but I have tested by connecting directly to the cable modem and still see the performance issue so I do not think it is a router issue.

I use the same ISP for my residential connection and see the same performance symptoms at home with or without my home router.

I have been to two other locations with a different ISP and worked for hours without seeing the same symptoms while people at the office were having problems. I had them on the phone and we were hitting the same screens simultaneously. Interestingly to me, at the office the website is 9 hops away according to tracert and at the main location I have tested at on ISP-2, it is 15 hops aways.

Only the last two hops are common between the tracerts. The website appears to be hosted with Rackspace. ISP-1 looks to control all the routers up to the handoff to Rackspace.net. I can't really tell if that is true for ISP-2. There is one hop that times out, the next is *.pnap.net and then rackspace with ISP-2.

Could there be some funky peering problem, which seems to be what packethunter is suggesting? What would explain the erratic behavior? BGP I suppose or something else that is causing traffice to traverse multiple routes. Would any of this even show up in a Wireshark capture from my location?

If you did actually look at a trace or two, what would I need to capture to get started? Also, what delivery mechanism is typically used? I don't have an ftp server or anything like that.

I the meantime, I have already ordered a second Internet connection from the ISP that has been working. I'm hoping to have redundancy this way and then direct all the traffic for this one site down the ISP-2 path. It is not really an expense I planned on but it makes sense from a DR or continuity perspective. Any thoughts on a router/firewall for a small business that can handle two Internet connections? I did find a Fortinet 60C that doesn't seem outrageously priced but I don't know much about the company or product.

packethunter - "friendly ISP" - isn't this like a unicorn?

Thanks for the feedback, though!

side note: I really don't want to see what all crap is flowing on my LAN, do I? There sure is a lot of background chatting going on. My first look at a capture showed my machine constantly arping and a ton of other noise. I turned off UPnP on the router and killed some network discovery junk on my PC, leftover I think from the initial setup of the Linksys, but it did not seem to make any difference. One should never look under the hood unless one is prepared to get dirty, eh?

Fortunately looking glass servers are easier to find than unicorns: Try http://www.bgp4.as/looking-glasses for a directory. On second thought, intermittent link failure are usually found and fixed by the ISP.

Your workstation spitting out ARP requests sounds like bad news. Did you check for signs of botnet activity, like SPAM transmission?

Keep on hunting!

I have not done indepth debugging of the arp activity. It is not the biggest item on my todo list right now. I did run malwarebytes and one online a/v with no problems found. I know I have installed several things over time related to networking and there is probably one of those still running I have not yet found. One for sure was the linksys client software which had a util like nmap that does network discovery. I thought killing it would stop the arps but it appears there is something else lurking. It might even be something like the network printer/scanner software trying to find new printers. Hard to say right now.

Is there a util that will tell me exactly what piece of software is doing the talking? I know netstat will do some diag but I'm not terribly familiar with the options on it.

I thought I walked away from all this network analysis well over a decade ago. Sigh.

(I changed your "answer" to a "comment", as that's the way this site works best, see the FAQ)

OK, if this is the only site you have problems with and the problems are intermittent. I think having a tracefile of a slow session and one of a normal session will be fine to work with as a start.

Unfortunately there is no file upload feature (yet) on ask.wireshark.org. You could use www.cloudshark.org or www.pcapr.net or maybe any other public file sharing site. However, since you masked the ip-addresses in your post, it might not be possible for you to post it publicly. If you want you can mail me the tracefiles and I will have a (short) look at them. My address can be found in my profile...