Get IT Done: Locate and correct bottlenecks on the network

Examines the root cause of slow networks and offers suggestions on how to improve connectivity

A few years ago, when the use of twisted pair cabling for Ethernet was still a young science and RG-58A/U coaxial cable was the norm, I was working for a state agency that supported many local school districts. One of the techs at a different school district needed to get network connectivity between two buildings that were within a couple of hundred feet of each other. This was before wireless was the easy answer.

Not wanting to just run the cable across the grass, he needed another alternative. He looked up and noticed that there were power lines on poles connecting the two buildings. “Aha!” he said, realizing that he had found a solution to his problem. After running the cable, he spent quite a significant amount of time trying to figure out why he was still having so much trouble and such a slow speed on both networks.

After asking for help, a more knowledgeable IT pro told him that while using the poles seemed like a good idea, wrapping the coaxial Ethernet cable around the high-voltage power line to hold it in the air was not. The electricity from the power lines was adding an enormous amount of noise on the network. If he'd had the proper knowledge and tools, this poor tech might have discovered the cause of the problem without having to suffer the embarrassment of having this flaw pointed out. Here I will explain how to identify some of the common causes of network slow downs. I will also introduce you to some basic tools you can use to locate where such problems originate.

What causes slow networks?
Sometimes, the nature of networking makes slow network problems seem intermittent. Network traffic also has a habit of “peaking” from time to time, which may result in a slowdown. Once you've determined that there is a consistent network slowdown or bottleneck, the hard part is pinpointing the location of the problem. Here is a list of some of the basic possible causes of network slowness. Please remember that the causes of such problems can be numerous and sometimes more than one problem occurring at once can make it even more difficult to pinpoint where the problem originated.

Network interface card
Troubleshooting slowdowns or bottlenecks depends on the network devices. In some cases, you may need to use specialized equipment, which I’ll explain later in this article. One common cause of network slowdowns is the result of a bad network adapter on a PC, which has been known to bring down an entire network.

When a network adapter goes bad, it may begin to broadcast junk packets (useless packets of data) onto the network. If this is broadcast traffic, any device in the same broadcast domain as the offending network interface card may experience problems, including slowdowns. I have experienced a “junk spitting” NIC more than once. In the worst case, a PC with a bad network adapter was bringing down all student PCs in the buildings within a particular VLAN.

By using the Ping command, I found I was only able to send packets of data so far down the network before they stopped at a certain point. This point was the device with the NIC problem. I was then able to go to the building, find the switch port with a solid light indicating it was sending out constant traffic, and disconnect it. As soon as I disconnected the offending NIC, the problem went away. So I informed the student that he needed a new network adapter.

More reliable solutions
Had I been in my office, I could have used the management server running HP OpenView, a network monitoring software product. This would have told me the MAC hardware address of the offending NIC. You can also detect a bad NIC by using a packet sniffer or other specialized network troubleshooting hardware, such as the Gigabit Observer Probe.

Bad network cabling can lead to a whole host of issues, including a slow network. When the prevalent speed of an Ethernet network was 10 Mbps over Category 3 or 5 cabling, a little problem here and there wasn’t as big a deal as it is today. With more modern networks running at 100 Mbps or even 1,000 Mbps, you must take more care in the design and maintenance of the cable plant.

Many cable installation jobs come with a warranty for a specific period. Most common cabling problems aren't related to those installations; however, I have seen odd cases where the vendor tied all of the cables to the high voltage electrical service in the ceiling. And then there are cabling problems like the one I mentioned that involved wrapping the coaxial Ethernet cable around the high-voltage power line.

Most cabling problems won't be a result of strange issues like these. The bulk of them are likely to involve the patch cables that connect the PC to the network jack. A badly or improperly crimped cable, loose ends, or the wrong type of cable connecting the PC to the network jack can create a network slowdown.

The easiest way to determine if the patch cable is causing the problem is to replace it and see what happens. In many cases, the inclusion of a bad patch cable on the network can be determined by looking at statistics on the network equipment and checking to see if there are excessive Cyclical Redundancy Check (CRC) errors on a given port.

If you replace a patch cable that you suspect is bad, and the network is still slow, the problem may lay in the autonegotiation of network speed and duplex that many of today's dual-speed hubs and switches support. These devices are configured to automatically determine the speed and duplex at which the remote PC is capable of communicating on the network. In certain circumstances, even though the two ends correctly negotiate their parameters, errors are still generated, resulting in a slower network connection.

The easiest solution to this problem is to manually force the speed and duplex at both ends of the network connection. Forcing the speed and duplex to specific values is generally done either in the Network Connection Settings in the operating system or in the configuration of the network equipment. For example, in Windows 2000, to manually set the duplex and speed of a network adapter, open the adapter's Properties window and click the Configure button. From the Advanced tab, set the appropriate values based on the actual speed and duplex of the switch as shown in Figure A.

Figure A
Select Link Speed And Duplex from the Properties window, and then select the proper speed and duplex from the drop-down list.

The speed and duplex on a Cisco router is user configurable. For example, to set ports 1 through 8 on module 1 at a speed of 100 Mbps on a Cisco switch, use this command (from enable mode):
set port speed 1/1-8 100

To set the duplex to Full for port 1 on module 1 of the same router, run this command (from enable mode):
set port duplex 1/1 full

Software-based troubleshooting tools
Two of the most important tools used to determine the location of a network problem are the Ping and Traceroute utilities. Ping stands for Packet Internet Groper. It issues Internet Control Message Protocol (ICMP) packets to a network device that responds with a reply if it is active. Ping also reports the amount of time that it takes for a particular device to respond, which makes it invaluable in locating network trouble spots.

Traceroute serves a similar purpose, but it tracks the entire network path, reporting similar statistics to Ping. Using these two utilities together will show you almost instantly where a network bottleneck might be because of the excessive time it takes to get a reply from a particular node.

Suppose someone tells you that a certain host on your WAN is responding very slowly. To determine if there is a network-related problem causing the perceived slowdown, you would issue this command: ping, which will respond with the type of output shown in Listing A.

Depending on the type of link, an average round trip of 493 ms could be good or bad. For this example, assume that the host is on the company’s network and no links are slower than T1 (1.544 Mbps). In this case 493 ms is a pretty bad round-trip time. But it may not necessarily be a problem with that particular host. Instead, there may be a problem somewhere along the path to that host. What the Ping utility shows is that the reply from the host is taking a long time. This is where the Traceroute command comes in.

I will use the Traceroute command to determine where along the path the problem is occurring. By issuing the command tracert -d, I will see the output shown in Listing B.

Looking at the results of the Traceroute command, I see that the last round-trip time is more than double the next longest time. The long round-trip time of the last host would indicate that the problem lies at the end node.

Hardware-based troubleshooting tools
There are specialized tools used that can help with pinpointing and correcting network-related problems. One common tool is a simple cable tester. An example of a typical cable tester can be found on the IC Network Web site. Like many other cable testers, the IC Network Enhanced Network Cable Tester RJ45 unit can be used to test the continuity between the pairs in the twisted-pair cable. There are four lights on each portion of the unit. One end is plugged in to the patch panel with a patch cable that is known to be good, and the other end is plugged in to the PC’s patch cable. If all four lights come on, the cable is good. If not, then there is a broken wire somewhere along the line in the cable.

One of my favorite network cable testers is the Microscanner Pro by Microtest. The Microscanner Pro can test the network cable for continuity, shorted pairs, and crossed pairs and can determine the length of the cable using a built-in time-delay reflectometer (TDR). The TDR can also determine how far down the cable the fault is located, which can expedite repairing a cabling problem.

While the Microscanner Pro is indispensable when it comes to solving basic network cabling plant problems, more complicated problems require even more specialized equipment. Microtest’s PentaScanner is another network cable test unit that can measure the following cabling statistics:
  • ·        Near-End Crosstalk (NEXT)—NEXT is a condition where the electrical signal from one wire is “leaked” onto another wire and can be caused by crossed or crushed wires. This condition is generally found towards the end of a cable where connectors are attached.
  • ·        Attenuation—Attenuation, also known as loss, is the reduction in the strength of the signal on the network cable as a result of long cable distances. (An Ethernet cable run should not exceed 90 meters.)
  • ·        Return loss—This is a measurement of “noise” on the network cable. While often not considered in older cabling plant designs, with Ethernet networks being deployed and expected to maintain gigabit speeds, this is becoming a more important factor. Improper connectors or network patch panels that are not up to proper specifications can cause return loss.
  • ·        Power Sum NEXT—This is similar to NEXT, but measures the effects of crosstalk from three pairs of cables on the fourth pair.

The recommended ranges for these parameters are dependent on the type of network cabling being used. If you want more information on cabling specifications, read The Siemon Company’s white paper on "De-Mystifying Category 5, 5e, 6, and 7 Performance Specifications."

Final words
When your network experiences a slowdown, make sure the problem is constant and not just a result of peaking or other intermittent issues. If the problem is ongoing, check for these basic causes first. Then, use the tools I suggested to help locate the problem or to help find out if the slowness is a result of cabling problems.

Editor's Picks