Troubleshooting sporadic internet connection

Question

I am having a problem with random webpages not loading. I started a continuous ping to Google DNS 8.8.8.8 and get a lot of time outs. I manage a LAN of about 100 computers. We are running a few 24 port unmanaged switches going through a Sonicwall NSA 2400. Here's the network:

Computers -> Switches -> Sonicwall -> Internet

The test I do is just continuous ping to 8.8.8.8 from my laptop. I plugged directly into the ISP router and it works fine. If I remove the network and just plug directly into the LAN side of the Sonicwall then everything works fine there. But as soon as I plug in the network switches I get a lot of timeouts. I am planning to reboot all switches later in the day but I was wondering what other troubleshooting steps I can take if that doesnt fix it. I plan on unplugging everything and slowly plugging things in one at a time to find the problem but I wonder if there is an easier way. Is my sonicwall just messing up because of the amount of traffic or is there something on the network causing the issue like a broadcast storm type situation

Answer 1

You may have a bad switch or cable someplace...

...or perhaps you are running into an "Arp Storm". Basically what this means is you have a loop someplace. When a machine says "Hey... who has IP x.x.x.x" (a broadcast packet) the attached switch throws that out to all ports it has... and switch #2 gets it & throws it out to all ports... (another port of which is plugged into the first switch) and the first switch sees it again and throws it back out all it's ports again... repeated indefinitely. Eventually this consumes all available CPU power and/or bandwidth on the switches causing it to lockup/drop packets/reset/etc... Most "un-managed" switches do not have a feature called "Spanning-Tree" (STP/lots of other names) which is capable of locating loops & turning off ports if it detects a loop preventing such situations. (it actually only turns off 1 port in the loop... so you don't lose connectivity... just the loop)

It seems you're nearing that precipice to where you need to start leaning towards managed switches & some basic network management software.

Answer 2

It's a case of being very methodical to get to the bottom of it I'm afraid. Can you sniff the network on your laptop and look for broadcast or suspicious traffic? A faulty device might show up too.

--edit--

When checking duplex settings on the switches try and check live port configs as opposed to 'running-config' settings. They can be different and confused on a failing device.

On each uplink port look for collisions, fragments and anything out of the ordinary like too many broadcast it multicast packet relative to other ports. Start with uplinks then look at other ports.

Answer 3

As a first step, make sure the links between the firewall and core network are operating at the same duplex setting and speed. If that looks OK then follow TheCompWiz's suggestion and look for evidence of a switch loop, broadcast storms, ARP floods, etc.

--edit--

When checking duplex settings on the switches try and checking live port configs as opposed to 'running-config' settings. They can be different and confused on a failing device.

On each uplink port look for collisions, fragments and anything out of the ordinary like too many broadcast it multicast packet relative to other ports. Start with uplinks then look at other ports.