Network bottlenecks and downtime can ruin an IT manager's day. The right arsenal of skills and tools can help you identify and fix the issue quickly. Here are some basic techniques and tools to help you out.
A few years ago, when the use of twisted-pair cabling for Ethernet was still a young science and RG-58A/U coaxial cable was the norm, I was working for a state agency that supported many local school districts. One of the techs at a different school district needed to get network connectivity between two buildings that were within a couple of hundred feet of each other. This was before wireless was the easy answer.
Not wanting to just run the cable across the grass, he looked up and noticed there were power lines on poles connecting the two buildings. “Aha!” he said, realizing he had found a solution to his problem. But after running the cable, he spent a significant amount of time trying to figure out why he was having so much trouble and such a slow speed on both networks.
A more knowledgeable IT pro told him that while using the poles seemed like a good idea, wrapping the coaxial Ethernet cable around the high-voltage power line to hold it in the air was not. The electricity from the power lines was adding an enormous amount of noise on the network. If he'd had the proper knowledge and tools, this poor tech might have discovered the source of the problem without the embarrassment of having his mistake pointed out. In this article, I’ll explain how to identify some of the common causes of network slowdowns. I’ll also introduce you to some basic tools you can use to locate where such problems originate.
What causes slow networks?
The very nature of networking can cause intermittent slowdowns. Network traffic also has a habit of peaking from time to time, which may result in a slowdown. These intermittent slowdowns are to be expected. However, if you determine that a consistent network slowdown or bottleneck exists, the hard part is pinpointing the location of the problem. What follows is a list of some of the causes of network sluggishness. Please remember that the possible causes of such problems are numerous and sometimes occur simultaneously, making it even more difficult to pinpoint where the problem originates.
Network interface card
Network slowdowns often result from a bad network adapter on a PC. Bad adapters have been known to bring down an entire network.
When a network adapter goes bad, it may begin to broadcast junk packets (useless packets of data) onto the network. If this is broadcast traffic, any device in the same broadcast domain as the offending network interface card may experience problems, including slowdowns. I have experienced a “junk-spitting” NIC more than once. In the worst case, a PC with a bad network adapter was bringing down all student PCs in the buildings within a particular VLAN.
By using the Ping command, I found I was able to send packets of data only so far down the network. The point at which they stopped was the device with the NIC problem. Armed with this information, I was able to go to the building, find the switch port with a solid light indicating it was sending out constant traffic, and disconnect it. As soon as I disconnected the offending NIC, the problem went away. I informed the student he needed a new network adapter.
More reliable solutions
Had I been in my office, I could have used the management server running HP OpenView, a network monitoring software product. This would have told me the MAC hardware address of the offending NIC. You can also detect a bad NIC by using a packet sniffer or other specialized network troubleshooting hardware, such as the Gigabit Observer Probe.
Bad network cabling can lead to a whole host of issues, including a slow network. When the prevalent speed of an Ethernet network was 10 Mbps over Category 3 or 5 cabling, a little problem here and there wasn’t as big a deal as it is today. With more modern networks running at 100 Mbps or even 1,000 Mbps, you must take more care in the design and maintenance of the cable plant.
Many cable installation jobs come with a warranty for a specific period. Most common cabling problems aren't related to those installations; however, I have seen odd cases where the vendor tied all of the cables to the high-voltage electrical service in the ceiling. And then there are cabling problems like the one I mentioned, in which the coaxial Ethernet cable was wrapped around the high-voltage power line.
Most cabling problems won't be a result of strange issues like these. The bulk of them likely involve the patch cables that connect the PC to the network jack. A badly or improperly crimped cable, loose ends, or the wrong type of cable connecting the PC to the network jack can create a network slowdown.
The easiest way to determine if the patch cable is causing the problem is to replace it and see what happens. In many cases, you can determine whether there’s a bad patch cable on the network by looking at statistics on the network equipment and checking to see if there are excessive Cyclical Redundancy Check (CRC) errors on a given port.
If you replace a patch cable you suspect is bad, and the network is still slow, the problem may lie in the autonegotiation of network speed and duplex that many of today's dual-speed hubs and switches support. These devices are configured to automatically determine the speed and duplex at which the remote PC is capable of communicating on the network. In certain circumstances, even though the two ends correctly negotiate their parameters, errors are still generated, resulting in a slower network connection.
The easiest solution to this problem is to manually force the speed and duplex at both ends of the network connection. You usually force the speed and duplex to specific values either in the Network Connection Settings in the operating system or in the configuration of the network equipment. For example, in Windows 2000, to manually set the duplex and speed of a network adapter, open the adapter's Properties window and click the Configure button. From the Advanced tab, set the appropriate values based on the actual speed and duplex of the switch, as shown in Figure A.
|Select Link Speed And Duplex from the Properties window, and then select the proper speed and duplex from the drop-down list.|
The speed and duplex on a Cisco router is user-configurable. For example, to set ports 1 through 8 on module 1 at a speed of 100 Mbps on a Cisco switch, use this command (from enable mode):
set port speed 1/1-8 100
To set the duplex to Full for port 1 on module 1 of the same router, run this command (from enable mode):
set port duplex 1/1 full
Software-based troubleshooting tools
Two of the most important tools for locating a network problem are the Ping and Traceroute utilities. Ping stands for Packet Internet Groper. It issues Internet Control Message Protocol (ICMP) packets to a network device that responds with a reply if it is active. Ping also reports the amount of time it takes for a particular device to respond, which makes it invaluable in locating network trouble spots.
Traceroute serves a similar purpose, but it tracks the entire network path, reporting similar statistics to Ping. Using these utilities together will reveal network bottlenecks almost instantly because of the excessive time it takes to get a reply from a particular node.
Suppose someone tells you that a certain host on your WAN is responding very slowly. To determine if a network-related problem is causing the perceived slowdown, you would issue this command: ping 192.168.1.7, which will respond with the type of output shown in Listing A.
Depending on the type of link, an average round trip of 493 ms could be good or bad. For this example, assume that the host 192.168.1.7 is on the company’s network and no links are slower than T1 (1.544 Mbps). In this case 493 ms is a pretty bad round-trip time. But it may not necessarily be a problem with that particular host. Instead, there may be a problem somewhere along the path to that host.
This is where the Traceroute command comes in. By issuing the command tracert -d 192.168.1.7, you’ll see the output shown in Listing B.
Looking at the results of the Traceroute command, I see that the last round-trip time is more than double the next longest time. The long round-trip time of the last host indicates that the problem lies at the end node.
Hardware-based troubleshooting tools
Specialized tools can help you pinpoint and correct network-related problems. One common tool is a simple cable tester, which tests the continuity between the pairs in the twisted-pair cable. There are four lights on each portion of the unit. One end is plugged in to the patch panel with a patch cable that is known to be good, and the other end is plugged in to the PC’s patch cable. If all four lights come on, the cable is good. If not, there’s a broken wire somewhere in the cable.
One of my favorite network cable testers is the MICROSCANNER Pro by Microtest. The MICROSCANNER Pro can test the network cable for continuity, shorted pairs, and crossed pairs and can determine the length of the cable using a built-in time-delay reflectometer (TDR). The TDR can also determine how far down the cable the fault is located, which can expedite repairing a cabling problem.
While the MICROSCANNER Pro is indispensable when it comes to solving basic network cabling plant problems, more complicated problems require even more specialized equipment. Microtest’s PentaScanner can measure the following cabling statistics:
- · Near-End Crosstalk (NEXT)—NEXT is a condition in which the electrical signal from one wire “leaks” onto another wire. Crossed or crushed wires are usually the culprit. This condition generally occurs toward the end of a cable, where connectors are attached.
- · Attenuation—Also known as loss, attenuation is the reduction in signal strength on the network cable due to long cable distances. (An Ethernet cable run should not exceed 90 meters.)
- · Return loss—This is a measurement of “noise” on the network cable. Older cabling plant designs often don’t take return loss into account. But with Ethernet networks expected to maintain gigabit speeds, return loss is becoming a more important factor. Improper connectors or network patch panels that are not up to proper specifications can cause return loss.
- · Power Sum NEXT—This is similar to NEXT but measures the effects of crosstalk from three pairs of cables on the fourth pair.
The recommended ranges for these parameters depend on the type of network cabling being used. If you want more information on cabling specifications, read The Siemon Company’s white paper on "De-Mystifying Category 5, 5e, 6, and 7 Performance Specifications."
When your network experiences a slowdown, make sure the problem is constant and not just a result of peaking or other intermittent issues. If the problem is ongoing, check for the basic causes I covered in this article. Then, use the tools suggested to locate the problem.