Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
Host:
OptimumOnline
Users Find Hot Deals
Users find Hot Dea..
Requests for Hot D..
| Slow Connection
I use a computer in a shared office space (multiple offices, same connection).
There's only about 5 users (max) right now sharing a T1.
Outside of business hours, I get full speed and ping times 20ms. During business hours, I'm dropping to 40KB/sec or less sometimes and the ping times jump to the 100ms range. The drop is pretty much sustained throughout the day and is really impacting my ability to do what I need.
Obviously, someone is doing something they probably shouldn't be on this circuit or someone has a hijacked computer.
Is it even possible that one user could hijack that much bandwidth? If it's one other user and myself on at a particular time, shouldn't the router evenly split the bandwidth or can the other user have multiple connections whereby they might get a much higher percentage of the bandwidth than me?
A T1 should easily be able to handle business use for 5 users.
Without access to the router, is there any way to figure who what IP is using up the bandwidth?
Are there any good, free tools that I can use to monitor my ping times so I could easily see, by day, what time the connection got bad and what time the connection got good again?
I've talked to the building management, but I'll have to escalate higher to get them to research it further. They recently cut from 2 T1s to 1 T1, but there's probably 1/4 of the people using the 1 T1 than when there were 2 T1s.
They did send out a generic email about how file sharing or video can slow down the connection for everyone else, but I also don't want to get into a thing of who is doing what with their computer. That's everyone's own business. I'm sure the building management doesn't want to do that either.
This connection also does provide a wifi access point for the building. I don't see people sitting around on wifi in the open areas much, but it's possible someone on the 2nd floor or somewhere I can't see is using the connection.
Any other ideas? |
|
tschmidt
Premium,MVM
join:2000-11-12
Milford, NH
 ·Hollis Hosting
 ·Verizon Online DSL
·Fairpoint Communic..
| Without some kind of QoS router handles packets on a first come first serve basis. It is also possible another user is saturating upload causing ACK to be delayed when you browse or download. Bottom line if T1 connection is overloaded it is difficult to determine exactly how capacity will be shared.
You may be able to use a tool like angryIP to find other users but it will not be able to snoop traffic. However it may let you determine which systems are using the network during periods of slow down.
Keep in mind you will only be able to see computer name when a broadband router is not being used. If there is a router you will only be able to see it, not the computers behind. If connection is configured with proper security angryIP will not be able to see any other users, but it is worth a try.
/tom
|
|
Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
Host:
OptimumOnline
Users Find Hot Deals
Users find Hot Dea..
Requests for Hot D..
| reply to Lex Luthor
Yes, my guess is it's probably someone who's saturating the upload.
I started up ping plotter and am pinging an IP just outside the local network. I was getting about 3ms until 10:02am at which time it jumped up significantly. My average ping now is running around 100ms. I think that'll provide me the reporting that I was asking for and the reason for my original post.
Webpages are very slow to come up and downloads are in that 40KB/sec range.
Not quite sure how to use angry IP. My gateway is x.74.30.97, with a 255.255.255.224 netmask. My IP is x.74.30.110.
So in IP range, I used x.74.30.96 through x.74.30.127.
The only host alive that it saw was the .97 router.
I think I'll have to compile data for a few days as to when it starts and stops and then take this up further with building management.
Any other ideas, please let me know. |
|
jimbopalmer
Tsar of all the Rushers
join:2008-06-02
Greenwood, MS
 ·Windjammer Cable
| reply to Lex Luthor
The Dude has a limited ability to monitor network traffic, just hover over the device you suspect.
»www.mikrotik.com/thedude.php
--
I tried to remain child-like, all I achieved was childish. |
|
carp
join:2002-10-30
clubs:
·RoadRunner Cable
1 edit | reply to Lex Luthor
1 user can definitely jam up a T1(1.3-1.5Mbps). A tuned server or desktop can easily jam up a DS3(44.5Mbps).
If you can get the admin for the router to send you netflow you can download a free netflow viewer from solarwinds or manage engine. It will easliy show you Source-destination traffic, rate, and volume |
|
Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
Host:
OptimumOnline
Users Find Hot Deals
Users find Hot Dea..
Requests for Hot D..
| reply to jimbopalmer
Do I need to first get myself out from behind my own router to get programs like thedude and angryip to see anything else on the network?
Will it work better if I just take the public IP on my PC directly? Right now, I have the public IP assigned by the building in my router and I'm on a 192.168.0.x network behind my own router. |
|
Bink
join:2006-05-14
Denver, CO
·Qwest.net
| reply to Lex Luthor
Your slowdowns can be due to high usage from other internal users or oversubscription on your ISP’s end. One user can easily saturate a T1 and, like you mentioned, TCP will back off and even the bandwidth usage across all connections, but if you have five connections and the other user is doing P2P with 500 connections, obviously you’ll have far less bandwidth than he will. If you don’t have access to the router, you’ll need to configure your switch to mirror the port the router is using if you really want to understand what’s going on. Leveraging a connection to the router or a mirrored port, what you really want is a simple piece of software that can do SNMP bandwidth monitoring and report back on your usage. With a little technical acumen and the free and venerable open source MRTG, »oss.oetiker.ch/mrtg/, you’ll have graphs generated in no time—no questionable Angry IPs or Dudes needed.
Alternatively, because of the large margins on T1 and related lines, most ISPs will be happy to provide you with bandwidth reports of your connection—especially if they think they can get more revenue out of you/you’ll upgrade to a faster connection. Additionally, like carp  mentioned, if you have the NetFlow data from the router (this could be provided to you assuming it is captured or, if you’re technically inclined, you can capture it yourself), you can slice and dice the data in hundreds of ways and produce reports on everything from individual traffic flows to how much bandwidth was used for viewing web content. |
|
Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY | reply to Lex Luthor
Bink,
Not sure I want to spend that much time on it. I'll take a look at that when I can.
It's not ISP oversubscription. The ISP has provided utilization reports showing very high utilization coming from our side of the circuit. |
|
jimbopalmer
Tsar of all the Rushers
join:2008-06-02
Greenwood, MS
·Windjammer Cable
| reply to Lex Luthor
You can ask The Dude (and the Angry IP Scanner) to discover other networks than your own, it is not advertized as such as it does not want to be a 'hacking' tool, just a network administration tool.
--
I tried to remain child-like, all I achieved was childish. |
|
Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
Host:
OptimumOnline
Users Find Hot Deals
Users find Hot Dea..
Requests for Hot D..
1 edit | reply to Lex Luthor
I think I know who it is now anyhow.
There's only 1 person still here right now and my speeds are slow and ping times high.
It still could be someone else on the wireless too though.
I'll have to think about how to handle this here then.
I still might try the Dude next week. |
|
Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY | reply to Lex Luthor
Looks like it's fixed. I think enough people complained that they got an IT guy in to look at the router and someone was leeching the wireless. |
|
