Connection Problems

[damo]

Hi, wondering if anyone can help ...

I've been helping a mate set up his BB connection and network. We started off with 3PCs, Netgear Router, Netcomm 1300 DSL Modem. I managed to get it up and running OK and at full 256Kb speed. The problem is that after a few minutes the connection will drop to say 5Kb or so. It is actually still a live connection, reaching the DNS etc. and loading a standard page after a few minutes of trying.

I stripped the configuration right down to one PC, a netgear switch (ditched the router), and the netcomm. Everything was running fine for a few minutes then I introduced another PC. The connection died back to 5Kb. Even after taking the second computer out, resetting and re-booting the modem, re-booting the PC a few times and changing between server-side and static IPs on the PC, I just couldn't get the connection to run faster than around 5Kb.

I gave up ...

What could cause a connection to be live but dog slow? Can't be an IP conflict on the network side as only one PC was online. The modem says that it was connected and the connection does actually exist.

Thx for any thoughts.

[3cakes]

if you're running xp/2k have you patched against the nachi/welchia and blaster viruses?

[damo]

No, although the connections isn't being choked with virus-generated data, it just isn't pushing much data at all.

[3cakes]

damo,

is that, no you haven't patched against the worms, or no, you're not running 2k/xp?

if you're running 2k/xp:

what does the performance graph show for the network card? (admin tools, performance, etc etc)
could it be the remote end? some people in here have mentioned a test file on swiftel's ftp site (I don't know the details), maybe you could try that.

if you haven't done the patches:
personally, I would install the patches. check the ms website for security advisories and follow the links. even if this isn't the cause, it's still a good idea.

[damo]

Cool, it is a W2K box so I'll look into those patches. The Telstra guy came over and tested the line. It's fine.

One thing I did notice is that the PC just kept sending packets and receiving stuff all response packets. It's like the server at the other end just dies. Even hitting the swiftel and swiftdsl web sites is dog slow.

[3cakes]

what happens when you reset the connection and use only 1 PC? does it still run slow?
how's the connectivity between the PCs?
can you post a trace route to one of the swiftel websites (preferably taken while the 2 PCs are attached to the network)?

if you're using a switch, does it have any port monitoring facility (spanning in cisco parlance) or is it just a basic switch?

if you can get traffic from one port to another (or if you have a hub) you might like to try using a packet analyser to see what's happening. now, I'm guessing you don't have access to a sniffer box, so try this. go to this website: http://www.ethereal.com/

install the packet analyser on a second pc and capture the traffic. it will give you a better idea of what's going on.

another option (depending on whether your firewall does this) is to block everything and see what shows up in the logs. you could install a software firewall like zone alarm or sygate and check the packet logs - this will also tell you what's going in/out of the nic.

if it's ICMP traffic, followed by port 69, 137, 445 or one in the range of 666-766 then it's possible you've been infected with one of these worms. of course, these are also valid ports (being tftp, netbios, SMB and others) so there's also a chance that it's valid traffic (it should be pretty obvious - you wouldn't normally be swapping tftp or netbios traffic with an IP address you don't recognise.)

are there any error messages generated in the firewall logs?