Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I manage a Windows Small Business server network of 12 computers including desktops & laptops all running Windows XP (Pro). We use a D-Link Switch connected to a router for internet connectivity. Recently the network speed slows down to the point of making our core sales & inventory management software unusable. I have tried switching off the router & network switch and re-starting the server but this does not help much. What could be causing the slowdown?

share|improve this question
slowdown as in all systems consistently slow, or at certain times? – Bart Silverstrim Sep 29 '09 at 13:42
The slow down occurs at random times during the day and doesn't seem associated with any particular client computer. – Jack Njiri Sep 30 '09 at 8:30

There are a few things you could try, including but not limited to:

  1. Does the same slowdown happen if you connect directly into the switch?
  2. What kind of wiring does the building have? If it is old, this could be the issue.
  3. Run wireshark to see if you have any strange traffic on a slow machine, whether that be collisions or some other packets out of the ordinary.
  4. Do you have some sort of monitoring/graphing on the router? It is possible one of the connected PCs is running P2P, malware, or other software which could be using up the local or internet bandwidth?
  5. If all else fails, what happens if you replace the network equipment?

I would break this problem down into parts - start at the core of the network and work your way out until you figure out what the problem is. And please share the ultimate fix! :)

share|improve this answer
Yes, definitely share what the cause is if you find it... – Bart Silverstrim Sep 29 '09 at 13:42
I'd bump WireShark up to number 1. Quickly see what's flowing through your network. Also, is this a permanent slowdown or is it occurring at specific times throughout the day? – JohnyD Sep 29 '09 at 16:57

Kind of related to what Dave suggested, but another idea is to take a Linux machine with dual nics and turn it into an inline router that just monitors traffic while forwarding all network traffic like a bridge. Go from your router to the gateway device (in one nic, out the other) and have it run wireshark, ntop, etc. to monitor traffic flow. See if you're flooding your network because a system is infected with something.

Another test is to turn on one machine at a time to see if the "slowdown" is inherent on all machines or just with Bob's system is turned on. If they're all slow, that points to a bottleneck on your router/gateway/network infrastructure, OR your systems are all infected with something. If it happens as soon as "Bob's" system comes online for a couple minutes, you may have found one (or the first) system infected and flooding the network.

Tools on an infected system itself will be unreliable. They could have been altered or have OS components altered to hide activity. That's why the third-party system...the suggested Linux "go between"...would see activity that is being cloaked on infected systems, if you don't have SNMP available on your existing switches.

Another idea is to use a bootable disc...bootable linux like RIP (google Rescue Is Possible Linux) or Ubuntu or some vendor run virus scans without the OS starting up so you bypass memory-resident cloaks. Linux uses ClamAV. Do whatever you can use to get updated signatures on the bootable disc though. Also try running Spybot on systems while in safe mode to see what they detect. If you have infected systems you may not be able to trust anything on the system and might need to consider falling back on your backups otherwise you might have keystroke loggers, passwords compromised, or hidden/cloaked software downloading more components in the background to re-infect.

share|improve this answer

In the last couple of years I have seen multiple small Ethernet switches (no-name, Linksys, D-Link, and Netgear) all "go nuts" and start blasting out nearly wire-speed traffic out one or more ports for no reason. Usually, this is accompanied by one or more activity lights being lit solidly (or, if that switch indicates activity by blinking a light, furious blinking to the point that the light appears "dim").

If you have a spare switch you can put in place of your switch I'd give that a shot.

Whatever you do, make notes as you troubleshoot and approach it in a methodical and scientific manner. Making multiple random changes simultaneously and not testing the result doesn't do you any good.

share|improve this answer

If you have Antivirus software on the client PCs, make sure it isn't scanning network drives. I've seen situations where when one person opened a file on the server, the AV on all the clients scanned it.

share|improve this answer

I agree with Evan, I've experienced small switches that have caused our network to go haywire. At about 4:03 pm every day we couldn't figure out what was wrong. We also ran wireshark to no avail.

In our case, 2 situations cause this problem:

  1. It wasn't a cheap switch, but one of our executives installed a laptop port replicator, with its own NIC. Whenever he plugged in we would have network troubles (though link-lights weren't ablaze).

  2. A rogue WINS server was blasting all ports and making our switches light up mad.

Isolate the problem. Document your troubleshooting, verify network devices first. Swap out switch/router (heck, return it if it's not the problem). Check for IP Conflicts.

Hope that helps, good luck!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.