Slow net browsing on small business network?

[MPM]

Hi all,

Ok, i give up - i've spent the best part of the last couple of weeks trying to get to the bottom of this problem at work - can someone help me?? Plleeease!

We have a small network of less than 20 machines. Mostly XP clients (a couple of Win7'ers), with Server 2008 as DHCP, DNS & Domain Controller, another 2008 box as a VM for VPN, and another couple of server 2003 boxes for file storage & sharepoint duties.

Firewall responsibilities are left to Fsecure on the clients and the main router.

Now, the problem is, as the first person arrives in the morning, they will find the connection perfectly fine with speedtest.net giving a nice & healthy 4MBs download speed. Gradually as people switch on and log in that 4Mb is munched away at until it's below 0.5Mb! It stays like that for the rest of the day.

It's almost like each machine 'takes' some bandwidth on switch on, and doesn't give it back - leaving an almost unusable connection for all people.

Does anyone have any ideas of what i can try/look for?

We do have 2 managed switches (Linksys SRW2024) but i haven't a clue how to use the management console to diagnose a problem. (i'm learning on the job )

I'm hoping there's some diagnostics i can do without having to sit on every machine...

Thanks in advance - i hope that's enough info - if not, i can supply more!
MPM

[badass]

Set up a proxy server for web access and block all clients from having internet access at the firewall. Monitor using the proxy server.
In all likelihood, it's either malware or the users taking the mick.
ANY place with more than 5 employees and unrestricted internet access will have at least one person taking the absolute **** and both abusing the internet connection and their employers by spending more time messing around on facebook than actualy working.

[MPM]

Ah, i hadn't thought of proxy servers - i had considered inserting a linux box or similar between the ADSL modem and the network but not adding proxy s/w to our existing setup...

*goes off to look into setting up a proxy server*

Any other ideas?

Thanks,
MPM

[Moby-Dick]

Ah, i hadn't thought of proxy servers - i had considered inserting a linux box or similar between the ADSL modem and the network but not adding proxy s/w to our existing setup...

*goes off to look into setting up a proxy server*

Any other ideas?

Thanks,
MPM

removing direct web access for users is an absolute must.
I wonder how many users are running applications like MSN / iPlayer or other streaming applications ? I'd suggest getting a good software inventory together along with some proxy logs ( no need to block everythign just ye , monitor first then you can proove what people where doing )

if you've got a VM environment , get hold of an ntop virtual appliance and do some traffic monitoring on your network (you'll need to put a switch port into promiscuous mode ) and see what is going on with your network.

[scaryjim]

Another consideration is how many applications are running background updates. Sure, for one or two machines it might not have too much impact, but I'm assuming that since you've specified "less than 20" machines that actually means somewhere between 15 and 20 - it sounds like your sustainable bandwidth is only 4Mb anyway, so if 16 machines are all downloading windows updates, software updates, antiviruses and the like in the background, as well as user web traffic, that's going to eat into 4Mb bandwidth pretty quickly. All you need is a couple of people on spotify / last.fm / youtube / bbc iplayer to hammer the bandwidth further, and presto! No more high speed connection.

... by spending more time messing around on facebook than actualy working. ...

Or, you know, trawling through Hexus handing out useful advice

[Moby-Dick]

Updates *might* not be an issue if you are running WSUS.

[abaxas]

Just a quick thought....

If your adsl is a home based product, you'll find peak times are in the evevning. On a business product it's during 9-5 hours.

Eg I have a demon business adsl line. Super turbo at night, slows down a bit until peak at ~4:30. Then everyone goes home and it becomes 'faster' again.

Also it could be traffic shaping on your ISP side. Demon do this to me... 1 download = 100k/s 2 downloads 2x 100k/S etc etc..

Also dont expect the full 4mps from any line, it simply wont happen 100% of the time.

[smargh]

Well, the easy way would be to watch for the permanently-active blinky lights on the switch(es).

Or look for which who has uploaded+downloaded the most packets.

[badass]

Or, you know, trawling through Hexus handing out useful advice

I didn't start work till 10:00 am that day

[scaryjim]

I didn't start work till 10:00 am that day

Fair enough, although the comment was more self-referential than trying to point the finger at other people!

I'm so glad Hexus has sub-forums about programming so that I can reasonably claim some of the time I spend on here as work related, though...