First a rundown of the network we're dealing with, from the top down:

I have a 6 Mb DSL connection at a provider-supplied modem. It normally has a NAT in it, but I have switched it to bridge mode because I am using my own NAT and want to be able to forward ports easily. It is connected to the WAN side of a Belkin "router" (actually a little NAT box with a switch and 802.11G access point in it). The 4-port switch in it holds a networked officejet, a linux server running Suse 11.1 64-bit, a "torrent box" running XP pro that has uTorrent running around the clock (carefully throttled), and the last port is uplinked to a D-Link 8-port switch. The switch holds a soup-to-nuts Core i7 desktop that dual-boots Suse 11.1 64-bit and Windows 7 64-bit (I call it Hal), an HTPC in my living room running XP Pro and MediaPortal, and a TVPC in my bedroom armoire running XP Pro, Boxee, Hulu Desktop, etc. There are also 2 relatively new laptops running XP Home and Windows 7 64-bit/Suse 11.1 64-bit as well as a relic laptop running XP Pro. They all have 802.11G adapters (2 internal, 1 usb).

And now the problem:

Very suddenly a few days ago my ability to stream videos from the server or the internet, which had always worked fine, went pear-shaped. Videos are taking forever to load, and then they are choppy and stammering the whole way through so badly that all you can do is give up on watching. The exception is the nitrous-powered Hal. It can still play videos well. However, file copies to or from the server or the torrent box are PATHETIC for every computer, including Hal. A file that once took 5 minutes to copy or move now takes 2 hours.

The torrent box stores its data on a 5400 RPM disk connected to an ATA/33 interface. It is a Celeron 233 with 192 MB of RAM, and its NIC is a 3com 10/100 unit in an ISA slot. Data transfers to and from it are slow and always have been and I have no reason to expect otherwise until I upgrade it. The problem is that they are LESS than slow now. If I download a new 4.5GB linux iso from a torrent, I don't like having to wait 8 hours for it to copy to the server where things are fast enough for me to work with it. It used to only take 30 or 45 minutes to copy that much data from the torrent box to the server. In fact, I used to be able to stream videos from the torrent box if I wanted to (even though it's obviously a bad idea). That is no longer an option unless I use Hal. I can't even stream from the fast server, much less the jalopy torrent box.

For completeness: The server is an Athlon 64 3000+ with 2GB of RAM. The OS runs on an ATA disk, but the data storage is a 7200 RPM SATA300 disk. I'm using a 10/100 NIC on the mobo. I've been running that puppy into the ground for years and bandwidth has never been a problem before, at least on the level it is now. Space is becoming an issue, so a new SATA card and three 1TB drives in a raid5 are planned for the future (as soon as I have the funds), as is a gigabit NIC when I upgrade the rest of the network. For now, I've got what I've got, and I know it is capable enough to do the job. I even cleaned house and got it up to 30% free.

Oddly, RDP seems to work fine. The torrent box and the server are both headless, and I use mstsc or rdesktop (depending on what OS I'm in) to work on them. I have noticed not one iota of slowdown in the remote access to those 2 machines, either from the laptops or Hal.

It sucks to have a computer that can boot Suse or Win7 in less than 30 seconds take 90 minutes to extract an 80MB archive. It will do it fast if I copy it to a local hard drive, but that takes an hour!

Is there a good FOSS or free commercial app that I can use to watch the traffic on my network and figure out where things are jamming up?

TIA,

J

wireshark. ntop.

I tinkered with Ethereal a little bit a few centuries ago. I didn't know it had evolved into wireshark. It looks great!

I suck at compiling (something ALWAYS goes wrong for some reason) so will have to live with the limited version of ntop when working in windows, but it looks pretty nice.

Consider yourself thanked.

OT: Have a great summer. It's a dry heat, right? I'm glad I live close to the Gulf, where it's nice and humid and sultry.

J

Cool. Glad it worked for ya... If you want to see something really neat, point your browser to localhost:3000 while ntop is running. I just recently found that little gem.

Well, I've run a few captures during various conditions (booting the TVPC, streaming on one of the lappies, etc.) and I am still sifting through the results. Sadly, I haven't found a problem yet, but there are only a few thousand packets to parse on each capture...

I'll check out the easter egg in ntop when I start playing with it. Right now wireshark is making my fuzzy head want to pop.

J

I did notice something that I thought I would ask about:

If I use Hal in Windows 7 to copy ~2.6GB of data from the torrent box to the server, the speed is predictably bad as I described in the OP.

I tried RDP'ing into the torrent box and copying the data to the server from its XP Pro GUI, thinking I would remove the intermediate step of Hal between the two boxes.

The transfer was still pretty slow, so I fired up wireshark on Hal and watched for problems. To my surprise, there was no traffic between the torrent box and the server. Traffic between each of them and Hal was off the charts!

Since when does using a terminal services client cause the terminal host to detour all of its network traffic through the client???

J

start with a baseline with all your systems off... then slowly start turning things on.. bring up your computers without logging in at first... then start logging into them.. that should help ease your pain of trying to isolate the problem.

I've run numerous tests using wireshark with various combinations of machines running at various states, as well as monitoring the traffic during activities such as boot-ups, shutdowns, file copies, and streaming videos. I simply can't find a (major) problem.

Let's take a step back and look at it from another angle. The TVPC has the most visible trouble, especially when streaming a video, which is exactly what it was built for.

I started a fairly high-res xvid-encoded avi home movie playing on it via WMP and FFDSHOW. The file was being streamed from the linux server. Once I was sure that the movie was stammering and skipping as expected, I opened the task manager and watched the CPU, RAM, and Network utilization rates. It has kind of a flimsy CPU, but it never spiked past about 50%. It has 768MB of DDR and a dedicated 2GB "swap" partition for the XP paging file. RAM never got past 200MB. Network (100Mb) danced around between 5% and 12%.

With numbers like that, I am forced to wonder (a lot) about my server...

Any thoughts?

J

I avoid copying anything or transferring any data from within a windows terminal session.. it always want's to cache the data before transferring it, and tends to take 10 times as long.. and once it starts caching the data you can't do anything to interrupt it..

So you are not the only one to see this happen..

I agree it's extremely annoying.




Don't forget to look at your network interface stats..
you can view the error counters to see if there are any tx or rx errors.
ifconfig -a
on Windows
netstat -e
A defective NIC can cause havoc on a network.



I would also reboot the router, and make sure it's secure. theres a worm going around that can infect routers IF you have access to the router open from the outside.
http://www.linuxquestions.org/questi...light=firmware


Best of luck in your troubleshooting.

Quick update for posterity:
It turns out it was a botched XP installation on the TVPC.

I have since wiped/reinstalled from scratch and all of my miseries seem to have been largely mitigated.