Network saturation problem

Discussion in 'NZ Computing' started by Craig Shore, Nov 16, 2006.

  1. Craig Shore

    Craig Shore Guest

    Just wondering if anyone has any ideas on this problem.

    My media pc keeps on occasion saturating it's network connection to the network
    switch. It started happening about 4 weeks ago, before that it's run fine for a
    long time. I can't say if I installed anything new into it or not, but it's had
    lots of updates on stuff already in it, especially WinXP.
    Every time it's done it so far it's gone no further than the network switch,
    however that appears to have changed as of today. The traffic seemed to be
    hitting the adsl modem today, but I don't think it was going any further.

    The machine scans clean with Avast antivirus, and a rootkit scanner says it's
    clean too.

    Netstat doesn't reveal anything either.

    Once started I don't think it stops doing it on it's own, but a reboot seems to
    stop it. It can go days on end with nothing then it starts happening again.

    It's running on Windows XP home.

    Thoughts?
     
    Craig Shore, Nov 16, 2006
    #1
    1. Advertising

  2. In message <>, Craig Shore wrote:

    > My media pc keeps on occasion saturating it's network connection to the
    > network switch. It started happening about 4 weeks ago, before that it's
    > run fine for a long time. I can't say if I installed anything new into it
    > or not, but it's had lots of updates on stuff already in it, especially
    > WinXP. Every time it's done it so far it's gone no further than the
    > network switch, however that appears to have changed as of today. The
    > traffic seemed to be hitting the adsl modem today, but I don't think it
    > was going any further.


    Try running a sniffer like Ethereal/Wireshark on another machine and
    collecting some statistics on which ports/addresses it might be hitting (or
    trying to hit), maybe look at a few sample packets to try to get an idea of
    what the traffic is about.
     
    Lawrence D'Oliveiro, Nov 16, 2006
    #2
    1. Advertising

  3. Craig Shore

    Craig Shore Guest

    On Thu, 16 Nov 2006 20:39:50 +1300, Lawrence D'Oliveiro
    <_zealand> wrote:

    >In message <>, Craig Shore wrote:
    >
    >> My media pc keeps on occasion saturating it's network connection to the
    >> network switch. It started happening about 4 weeks ago, before that it's
    >> run fine for a long time. I can't say if I installed anything new into it
    >> or not, but it's had lots of updates on stuff already in it, especially
    >> WinXP. Every time it's done it so far it's gone no further than the
    >> network switch, however that appears to have changed as of today. The
    >> traffic seemed to be hitting the adsl modem today, but I don't think it
    >> was going any further.

    >
    >Try running a sniffer like Ethereal/Wireshark on another machine and
    >collecting some statistics on which ports/addresses it might be hitting (or
    >trying to hit), maybe look at a few sample packets to try to get an idea of
    >what the traffic is about.


    So i'd have to physically wire the two machines together with a crossover cable
    to do this right?
     
    Craig Shore, Nov 16, 2006
    #3
  4. Craig Shore

    Dave Doe Guest

    In article <>,
    says...
    > On Thu, 16 Nov 2006 20:39:50 +1300, Lawrence D'Oliveiro
    > <_zealand> wrote:
    >
    > >In message <>, Craig Shore wrote:
    > >
    > >> My media pc keeps on occasion saturating it's network connection to the
    > >> network switch. It started happening about 4 weeks ago, before that it's
    > >> run fine for a long time. I can't say if I installed anything new into it
    > >> or not, but it's had lots of updates on stuff already in it, especially
    > >> WinXP. Every time it's done it so far it's gone no further than the
    > >> network switch, however that appears to have changed as of today. The
    > >> traffic seemed to be hitting the adsl modem today, but I don't think it
    > >> was going any further.

    > >
    > >Try running a sniffer like Ethereal/Wireshark on another machine and
    > >collecting some statistics on which ports/addresses it might be hitting (or
    > >trying to hit), maybe look at a few sample packets to try to get an idea of
    > >what the traffic is about.

    >
    > So i'd have to physically wire the two machines together with a crossover cable
    > to do this right?


    Don't see why you just can't run Ethereal on *the* machine.

    --
    Duncan
     
    Dave Doe, Nov 16, 2006
    #4
  5. Craig Shore

    steve Guest

    Craig Shore wrote:

    > Just wondering if anyone has any ideas on this problem.
    >
    > My media pc keeps on occasion saturating it's network connection to the
    > network
    > switch. It started happening about 4 weeks ago, before that it's run fine
    > for a long time. I can't say if I installed anything new into it or not,
    > but it's had lots of updates on stuff already in it, especially WinXP.
    > Every time it's done it so far it's gone no further than the network
    > switch,
    > however that appears to have changed as of today. The traffic seemed to
    > be hitting the adsl modem today, but I don't think it was going any
    > further.
    >
    > The machine scans clean with Avast antivirus, and a rootkit scanner says
    > it's clean too.
    >
    > Netstat doesn't reveal anything either.
    >
    > Once started I don't think it stops doing it on it's own, but a reboot
    > seems to
    > stop it. It can go days on end with nothing then it starts happening
    > again.
    >
    > It's running on Windows XP home.
    >
    > Thoughts?


    Could be your network card is failing......
     
    steve, Nov 16, 2006
    #5
  6. In message <>, Craig Shore wrote:

    > On Thu, 16 Nov 2006 20:39:50 +1300, Lawrence D'Oliveiro
    > <_zealand> wrote:
    >
    >>In message <>, Craig Shore
    >>wrote:
    >>
    >>> My media pc keeps on occasion saturating it's network connection to the
    >>> network switch. It started happening about 4 weeks ago, before that
    >>> it's run fine for a long time. I can't say if I installed anything new
    >>> into it or not, but it's had lots of updates on stuff already in it,
    >>> especially WinXP. Every time it's done it so far it's gone no further
    >>> than the
    >>> network switch, however that appears to have changed as of today. The
    >>> traffic seemed to be hitting the adsl modem today, but I don't think it
    >>> was going any further.

    >>
    >>Try running a sniffer like Ethereal/Wireshark on another machine and
    >>collecting some statistics on which ports/addresses it might be hitting
    >>(or trying to hit), maybe look at a few sample packets to try to get an
    >>idea of what the traffic is about.

    >
    > So i'd have to physically wire the two machines together with a crossover
    > cable to do this right?


    No, just plug the sniffer machine into another port on your switch.
     
    Lawrence D'Oliveiro, Nov 16, 2006
    #6
  7. Craig Shore

    ~misfit~ Guest

    Craig Shore wrote:
    > Just wondering if anyone has any ideas on this problem.
    >
    > My media pc keeps on occasion saturating it's network connection to
    > the network switch. It started happening about 4 weeks ago, before
    > that it's run fine for a long time. I can't say if I installed
    > anything new into it or not, but it's had lots of updates on stuff
    > already in it, especially WinXP.
    > Every time it's done it so far it's gone no further than the network
    > switch, however that appears to have changed as of today. The
    > traffic seemed to be hitting the adsl modem today, but I don't think
    > it was going any further.
    >
    > The machine scans clean with Avast antivirus, and a rootkit scanner
    > says it's clean too.
    >
    > Netstat doesn't reveal anything either.
    >
    > Once started I don't think it stops doing it on it's own, but a
    > reboot seems to stop it. It can go days on end with nothing then it
    > starts happening again.
    >
    > It's running on Windows XP home.
    >
    > Thoughts?


    This could be related to my problem too. I'm running XP pro and I have to
    keep rebooting to get good connection speeds. It started a few weeks ago as
    well. It seems to bog down after a few hours. I have a combo, 4-port ADSL
    router. I thought it might be something to do with one of the Windows
    updates of late as well.
    --
    Shaun.
     
    ~misfit~, Nov 16, 2006
    #7
  8. Craig Shore

    Richard Guest

    ~misfit~ wrote:

    > This could be related to my problem too. I'm running XP pro and I have to
    > keep rebooting to get good connection speeds. It started a few weeks ago as
    > well. It seems to bog down after a few hours. I have a combo, 4-port ADSL
    > router. I thought it might be something to do with one of the Windows
    > updates of late as well.


    I have had that happen, it seems to be something goes wrong between the
    switch and the nic, one end was showing 100 meg half duplex while the
    nic icon in windows was on gigabit. Lights all flashing, nothing
    happening. - pulling and replugging solves it.
     
    Richard, Nov 16, 2006
    #8
  9. Craig Shore

    Malcolm Guest

    ~misfit~ wrote:

    > Craig Shore wrote:
    >> Just wondering if anyone has any ideas on this problem.
    >>
    >> My media pc keeps on occasion saturating it's network connection to
    >> the network switch. It started happening about 4 weeks ago, before
    >> that it's run fine for a long time. I can't say if I installed
    >> anything new into it or not, but it's had lots of updates on stuff
    >> already in it, especially WinXP.
    >> Every time it's done it so far it's gone no further than the network
    >> switch, however that appears to have changed as of today. The
    >> traffic seemed to be hitting the adsl modem today, but I don't think
    >> it was going any further.
    >>
    >> The machine scans clean with Avast antivirus, and a rootkit scanner
    >> says it's clean too.
    >>
    >> Netstat doesn't reveal anything either.
    >>
    >> Once started I don't think it stops doing it on it's own, but a
    >> reboot seems to stop it. It can go days on end with nothing then it
    >> starts happening again.
    >>
    >> It's running on Windows XP home.
    >>
    >> Thoughts?

    >
    > This could be related to my problem too. I'm running XP pro and I have to
    > keep rebooting to get good connection speeds. It started a few weeks ago
    > as well. It seems to bog down after a few hours. I have a combo, 4-port
    > ADSL router. I thought it might be something to do with one of the Windows
    > updates of late as well.

    Hi
    It may be broadcast traffic, install wireshark (ethereal) and do some
    captures. There are some other tools here;

    http://www.microsoft.com/technet/sysinternals/default.mspx

    --
    Cheers Malcolm °¿° (Linux Counter #276890)
    SLED 10.0 x86_64 Kernel 2.6.16.21-0.25-smp
    up 1:52, 2 users, load average: 0.05, 0.06, 0.09
     
    Malcolm, Nov 16, 2006
    #9
  10. Craig Shore

    Stu Fleming Guest

    Richard wrote:

    > I have had that happen, it seems to be something goes wrong between the
    > switch and the nic, one end was showing 100 meg half duplex while the
    > nic icon in windows was on gigabit. Lights all flashing, nothing
    > happening. - pulling and replugging solves it.


    Autonegotiation is generally broken. Force both ends to be known
    speed/duplex settings.
     
    Stu Fleming, Nov 16, 2006
    #10
  11. Craig Shore

    thingy Guest

    Lawrence D'Oliveiro wrote:
    > In message <>, Craig Shore wrote:
    >
    >> On Thu, 16 Nov 2006 20:39:50 +1300, Lawrence D'Oliveiro
    >> <_zealand> wrote:
    >>
    >>> In message <>, Craig Shore
    >>> wrote:
    >>>
    >>>> My media pc keeps on occasion saturating it's network connection to the
    >>>> network switch. It started happening about 4 weeks ago, before that
    >>>> it's run fine for a long time. I can't say if I installed anything new
    >>>> into it or not, but it's had lots of updates on stuff already in it,
    >>>> especially WinXP. Every time it's done it so far it's gone no further
    >>>> than the
    >>>> network switch, however that appears to have changed as of today. The
    >>>> traffic seemed to be hitting the adsl modem today, but I don't think it
    >>>> was going any further.
    >>> Try running a sniffer like Ethereal/Wireshark on another machine and
    >>> collecting some statistics on which ports/addresses it might be hitting
    >>> (or trying to hit), maybe look at a few sample packets to try to get an
    >>> idea of what the traffic is about.

    >> So i'd have to physically wire the two machines together with a crossover
    >> cable to do this right?

    >
    > No, just plug the sniffer machine into another port on your switch.


    that may only show the broadcast stuff....if its aiming at a specific
    IP...the switch should mask it....I'd run the sniffer on the box itself...

    regards

    Thing
     
    thingy, Nov 16, 2006
    #11
  12. Craig Shore

    jasen Guest

    On 2006-11-16, Craig Shore <> wrote:

    >>Try running a sniffer like Ethereal/Wireshark on another machine and
    >>collecting some statistics on which ports/addresses it might be hitting (or
    >>trying to hit), maybe look at a few sample packets to try to get an idea of
    >>what the traffic is about.

    >
    > So i'd have to physically wire the two machines together with a crossover cable
    > to do this right?


    you need to get the packets to the machine doing the monitoring, so yeah
    setting it up as a bridge, or gateway, or putting it on a hub (not switch)
    with the machine you want to monitor are required.


    Bye.
    Jasen
     
    jasen, Nov 16, 2006
    #12
  13. Craig Shore

    Steven Ellis Guest

    Craig Shore wrote:
    > Just wondering if anyone has any ideas on this problem.
    >
    > My media pc keeps on occasion saturating it's network connection to the network
    > switch. It started happening about 4 weeks ago, before that it's run fine for a
    > long time. I can't say if I installed anything new into it or not, but it's had
    > lots of updates on stuff already in it, especially WinXP.
    > Every time it's done it so far it's gone no further than the network switch,
    > however that appears to have changed as of today. The traffic seemed to be
    > hitting the adsl modem today, but I don't think it was going any further.
    >
    > The machine scans clean with Avast antivirus, and a rootkit scanner says it's
    > clean too.
    >
    > Netstat doesn't reveal anything either.
    >
    > Once started I don't think it stops doing it on it's own, but a reboot seems to
    > stop it. It can go days on end with nothing then it starts happening again.
    >
    > It's running on Windows XP home.
    >
    > Thoughts?


    What type of network switch is it plugging into. I find that my switch
    occasionally screws up autonegatiation and all my computer switch to
    10Meg Half Duplex. I have to power cycle the switch to fix it.

    Steve
     
    Steven Ellis, Nov 16, 2006
    #13
  14. Craig Shore

    ~misfit~ Guest

    Richard wrote:
    > ~misfit~ wrote:
    >
    > > This could be related to my problem too. I'm running XP pro and I
    > > have to keep rebooting to get good connection speeds. It started a
    > > few weeks ago as well. It seems to bog down after a few hours. I
    > > have a combo, 4-port ADSL router. I thought it might be something
    > > to do with one of the Windows updates of late as well.

    >
    > I have had that happen, it seems to be something goes wrong between
    > the switch and the nic, one end was showing 100 meg half duplex while
    > the nic icon in windows was on gigabit. Lights all flashing, nothing
    > happening. - pulling and replugging solves it.


    (Also to Stu and Malcolm)

    When this first started happening I of course tried rebotting the router
    (Alcatel/Thompson Speedtouch 510v4). In fact I did it several times,
    umplugging it for up to 10 minutes before restarting. I also
    unplugged-replugged cables, replaced the cable.... Then I thought it could
    be the NIC. It's an on-board nVidia thing so I disabled it in BIOS and
    installed a PCI 3Com 3C905C-TX. Sadly no change. :-(

    I then overwrote the boot drive from an image I took on the 31st of October.
    On rebooting Windows told me that there were updates so I downloaded and
    installed them.

    What was happening, a lot more frequently/quickly than even a few days ago,
    is; Last night at just after midnight I started Azureus which had a few
    torrents queued. (I have the max number of half-open connections raised from
    10 to 50). For a while there, over a period of a couple of minutes traffic
    built up steadilly to around 150kB/s peaking at over 200. It stayed at that
    speed for a minute or two, then tailed off. Over the next 10 minutes it
    would climb briefly to 60 or so, then drop back to nothing. After 10 minutes
    it stayed at nothing showing on Azureus but DU Meter showing around 6kB/s
    each way.

    Rebooting the PC 'fixed' it, in that it did exactly the same thing, ground
    to a halt after around 10 minutes.

    Thinking it may be caused by a Windows update I uninstalled the last 4 that
    were all installed on the same day, the day I restored the drive from the
    image. (The previous 4 updates are dated the same day I took the image,
    probably what prompted me to image the drive) When I restarted the PC again
    it seemed better, although there were still periods of traffic dropping off,
    then climbing again, at least it was climbing again. (For some reason my
    torrent traffic has often exhibited a cyclic trend, with an amplitude of
    around one minute, almost a sine wave, going right back to when I first
    discovered torrents). I went to bed and, this morning, find I've downloaded
    just over 1GB, all that I had queued. (Except one pesky torrent that stuck
    at 99.9%. Deleting and restarting the torrent doesn't fix it. Damn! I hate
    it when that happens)

    So I may have 'fixed' it, by uninstalling the last four updates. I'll find
    some more stuff that I want to download and I guess I'll have a better idea
    of whether it's 'fixed'. Sadly, now Windows is constantly telling me there
    are updates for my computer and I don't know which of the four it was (if it
    in fact was) so don't know which one/s to tick the "Don't remind me about
    this update again" box for.

    Fingers crossed that the problem has gone away. However, I'd like to know,
    if it was indeed one of these updates, (and it's begining to look like it
    was) which one it actually was.

    Watch this space I guess. Thanks for the suggestions.
    --
    Shaun.
     
    ~misfit~, Nov 16, 2006
    #14
  15. Craig Shore

    ~misfit~ Guest

    Malcolm wrote:
    > ~misfit~ wrote:
    >
    > > Craig Shore wrote:
    > > > Just wondering if anyone has any ideas on this problem.
    > > >
    > > > My media pc keeps on occasion saturating it's network connection
    > > > to the network switch. It started happening about 4 weeks ago,
    > > > before that it's run fine for a long time. I can't say if I
    > > > installed anything new into it or not, but it's had lots of
    > > > updates on stuff already in it, especially WinXP.
    > > > Every time it's done it so far it's gone no further than the
    > > > network switch, however that appears to have changed as of today.
    > > > The traffic seemed to be hitting the adsl modem today, but I
    > > > don't think it was going any further.
    > > >
    > > > The machine scans clean with Avast antivirus, and a rootkit
    > > > scanner says it's clean too.
    > > >
    > > > Netstat doesn't reveal anything either.
    > > >
    > > > Once started I don't think it stops doing it on it's own, but a
    > > > reboot seems to stop it. It can go days on end with nothing then
    > > > it starts happening again.
    > > >
    > > > It's running on Windows XP home.
    > > >
    > > > Thoughts?

    > >
    > > This could be related to my problem too. I'm running XP pro and I
    > > have to keep rebooting to get good connection speeds. It started a
    > > few weeks ago as well. It seems to bog down after a few hours. I
    > > have a combo, 4-port ADSL router. I thought it might be something
    > > to do with one of the Windows updates of late as well.

    > Hi
    > It may be broadcast traffic, install wireshark (ethereal) and do some
    > captures. There are some other tools here;
    >
    > http://www.microsoft.com/technet/sysinternals/default.mspx


    Ok, thanks Malcolm, post archived as it seems like it may be fixed, albeit
    with a hammer. (See my response to Richard). If it continues to play up I'll
    do as you suggest.

    Thanks again, hope you're well. :)
    --
    Shaun.
     
    ~misfit~, Nov 16, 2006
    #15
  16. Craig Shore

    Craig Shore Guest

    On 16 Nov 2006 13:57:46 -0800, "Steven Ellis" <> wrote:

    >
    >Craig Shore wrote:
    >> Just wondering if anyone has any ideas on this problem.
    >>
    >> My media pc keeps on occasion saturating it's network connection to the network
    >> switch. It started happening about 4 weeks ago, before that it's run fine for a
    >> long time. I can't say if I installed anything new into it or not, but it's had
    >> lots of updates on stuff already in it, especially WinXP.
    >> Every time it's done it so far it's gone no further than the network switch,
    >> however that appears to have changed as of today. The traffic seemed to be
    >> hitting the adsl modem today, but I don't think it was going any further.
    >>
    >> The machine scans clean with Avast antivirus, and a rootkit scanner says it's
    >> clean too.
    >>
    >> Netstat doesn't reveal anything either.
    >>
    >> Once started I don't think it stops doing it on it's own, but a reboot seems to
    >> stop it. It can go days on end with nothing then it starts happening again.
    >>
    >> It's running on Windows XP home.
    >>
    >> Thoughts?

    >
    >What type of network switch is it plugging into. I find that my switch
    >occasionally screws up autonegatiation and all my computer switch to
    >10Meg Half Duplex. I have to power cycle the switch to fix it.


    Dell PowerConnect 2216 16port 10/100.
    I've tried moving it to a different port, and tried cycling the power on the
    switch. Neither work.
    While it's going wrong (excluding this time where it was hammering the modem) I
    can still use the other machines on the network and the internet without a
    problem, going through the same switch.
     
    Craig Shore, Nov 17, 2006
    #16
  17. Craig Shore

    Lonney Guest

    That wont work unless its broadcast traffic.

    Switches are Layer2 devices, you need a Layer1 device to sniff such as
    a hub.


    Lawrence D'Oliveiro wrote:

    >
    > No, just plug the sniffer machine into another port on your switch.
     
    Lonney, Nov 17, 2006
    #17
  18. Craig Shore

    Peter Ingham Guest

    On 17 Nov 2006 00:50:35 -0800, "Lonney" <> wrote:

    >That wont work unless its broadcast traffic.
    >
    >Switches are Layer2 devices, you need a Layer1 device to sniff such as
    >a hub.


    Or, if you have a good quality commercial switch (as opposed to an
    el-cheapo home-user switch) use port mirroring to obtain a second
    place to view the data going to/from a host.

    --
    Please remove '_SpamTrap' when replying. You know why :-(

    Peter Ingham
    Lower Hutt
    New Zealand
     
    Peter Ingham, Nov 17, 2006
    #18
  19. On Fri, 17 Nov 2006 00:50:35 -0800, Lonney wrote:

    > That wont work unless its broadcast traffic.
    >
    > Switches are Layer2 devices, you need a Layer1 device to sniff such as
    > a hub.


    Set your switch to send a duplicate copy of the traffic to the port that
    the sniffer is plugged into.

    Problem solved there.


    Aquilegia Alyssum

    --
    "The only way Vista client and Longhorn server would make sense
    would be if [the] company was doing a 'forklift upgrade' on its
    entire client-server infrastructure."
     
    Aquilegia Alyssum, Nov 18, 2006
    #19
  20. Craig Shore

    Craig Shore Guest

    On Sat, 18 Nov 2006 14:17:38 +1300, Aquilegia Alyssum
    <> wrote:

    >On Fri, 17 Nov 2006 00:50:35 -0800, Lonney wrote:
    >
    >> That wont work unless its broadcast traffic.
    >>
    >> Switches are Layer2 devices, you need a Layer1 device to sniff such as
    >> a hub.

    >
    >Set your switch to send a duplicate copy of the traffic to the port that
    >the sniffer is plugged into.
    >
    >Problem solved there.


    Only if you've got a managed switch. Most of us haven't.
     
    Craig Shore, Nov 18, 2006
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Tom Miller

    Saturation Party on Thursday!

    Tom Miller, Dec 10, 2003, in forum: Computer Support
    Replies:
    3
    Views:
    381
    M Mullen
    Dec 11, 2003
  2. Morgan Ohlson
    Replies:
    4
    Views:
    338
    Morgan Ohlson
    Oct 17, 2003
  3. DirtRoadie

    Default Contrast, Sharpness, Saturation Settings?

    DirtRoadie, Oct 25, 2003, in forum: Digital Photography
    Replies:
    5
    Views:
    3,688
    Flycaster
    Oct 25, 2003
  4. Malcolm L. Franklin

    Saturation compensating camera manufacturer

    Malcolm L. Franklin, Jul 21, 2004, in forum: Digital Photography
    Replies:
    4
    Views:
    326
    Malcolm L. Franklin
    Jul 22, 2004
  5. Steve
    Replies:
    0
    Views:
    591
    Steve
    Apr 25, 2004
Loading...

Share This Page