-   Linux - Networking (
-   -   Help with network slowdown (fragmentation?) (

c4onastick 06-30-2007 11:30 AM

Help with network slowdown troubleshooting.
I've run into a interesting network slowdown recently. Its really beyond me at this point. I have a server that's serving both SMB clients and NFS. SMB is ridiculously slow, it took about 60 minutes to transfer ~1.2Gb of files to the server. The thing is, I had the exact same network topology setup at my last apartment (recently moved) and at the new one I've got nothing for speed. I've took a look at tcpdump while transferring files and it seems to transfer in chunky bursts, with lots of "callbook" ports conversations in between (which I traced back to PuTTY). NFS wasn't even able to list the remote directory. Where else could I look to start to diagnose this problem? Have others run into this before?

kaelthas 07-01-2007 06:48 PM

I would recommend you first check your hardware. Make sure your network wires aren't pinched or cut, or running alongside power wires, or cable tv lines (they generate a lot of noise). If it's wireless, make sure your or one of your neighbors aren't using a cordless phone on the same frequency (like 2.4 ghz or 5.8 ghz, etc).

Some other things to check. See if you moved close to a tv or radio transmitter. Or if there's some kind of noise creating motor on the same electrical circuit. you could try noise reducers at any rate.

A strange issue I ran into once with SMB similar to what you described baffled me for a couple of days. Apparently a lot of NICs that come built in to motherboards aren't really full duplexing, and for some reason Samba really doesn't like that. I ran out and bought a $12 pci NIC, installed it, and it worked great.

twantrd 07-01-2007 11:56 PM

I would check if the interface is negotiating at 100 Full Duplex and if there were any collisions.


c4onastick 07-03-2007 10:05 AM

Thanks for your suggestions. I'm pretty sure that its not the nic, I used this exact same setup at my last apartment. Really the only thing that's changed is my internet provider (who I'm definitely not in love with) and I've got a few more machines on the network (went from 4 plus server to about 8 plus server). I'm not seeing any collisions (ifconfig is the only place I know to look for that):

# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX
          inet addr:  Bcast:  Mask:
          RX packets:6941477 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7649286 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3344886312 (3189.9 Mb)  TX bytes:3778224105 (3603.1 Mb)
          Interrupt:11 Base address:0xcc00

tcpdump has some interesting output though (I'm not too familiar with this tool, to be honest this is the first time I've used it):

198 packets captured
836 packets received by filter
356 packets dropped by kernel

That seems like a lot of drops or way too few. Its either dropping a lot of packets which is adversely affecting my network performance or there's a lot of garbage running through my network (something I'm hoping the kind souls here will help me find) and its not dropping enough.

I do see a few of these:

08:57:01.506898 IP > ALL-ROUTERS.MCAST.NET: igmp leave
Which is interesting. That address isn't in my subnet and I'm not sure that kind of traffic should get through the router.
Aside from that, it looks pretty normal (for what I would consider normal), there are a few "callbook" port entries, but I traced that back to PuTTY which I'm using to ssh in.

Where can I check to make sure its in full duplex? (I'm 99% sure that's not the problem, but it'd be nice to know where to check for future problems.)

Thanks in advance for your help, any help would be great!

kaelthas 07-03-2007 11:10 AM

Try this
There is some good info at about getting more useful information out of tcpdump. It might help you find out where all those excess packets are coming from. Perhaps one of the computers you added has an issue of some kind.

As far as the entry, that can mean one of a couple of things. It is normally found when there are redundant routers (most likely from your isp) talking to each other to be sure they're still up. It's basically a call to discover other routers that are out there. It can also be something like a WINS server doing partner autodiscovery. Point is, I don't think that is causing your problem.

farslayer 07-03-2007 12:00 PM

169.254.x.x is typically an address a Windows machine would auto-configure for itself if it doesn't have a static IP address set and cannot find a DHCP server.

If you are using a wireless router that may be a neighbors machine with the Windows Zero Config Service running.. that service is evil it automatically scans for any available wireless network in the area on some sort of a polled interval..

c4onastick 07-04-2007 03:36 PM

Thanks for your replies! I decided to take a step back and work backwards (starting at layer 1), I swapped out my 24-port switch (D-link) for a little 8-port netgear switch I had laying around reconnected everything (except for a drop to a laptop that wasn't being used) and lo-and-behold, my problems disappeared; NFS came back up and I was able to move data with ease, and Samba behaved much better (~3Gb transfer took about 3-5 minutes: much better). I'm now about 90% sure that my 24-port switch isn't behaving well. This foray did expose some other problems that I'll have to address on the network such as the windows machine that keeps loosing track of the DHCP server (thanks for the insight into that farslayer). I'll keep ya'll posted as I think I'll get in touch with D-link later this week to get some diagnostics running or warranty the switch. Thank you all for your help.

c4onastick 07-11-2007 11:34 PM

Update: I talked with D-link tech support and they say it most likely sounds like a defective unit.

All times are GMT -5. The time now is 01:34 PM.