Any advice on where to start when troubleshhoting a slow network (users complaints)?

Question

We currently have users from one of our branch office that complains around network performance issues (slow network). Troubleshooting issues like this one was not the focus of my CCENT studies (got certified 2 weeks ago) but I was assigned that ticket last Friday (first assignment). I was thinking to call one of the users and ask him to connect on another computer to see if he still encounters the same issue (that would tell me if it is related to his computer or not - probably layer 1, 2 issue), ask him to try another application (to help determine if it is a Layer 7 issue) and then if it is not related to neither one of these I was thinking to start looking at the switch interface to which the computer is connected to. I would like to know if someone could tell me if I am on the right path and what else I should verify/investigate? Are there root cause analysis tools that exist to help solve/troubleshoot such issues?
Thanks in advanced.

Answer 1

Patrick Salmon wrote:We currently have users from one of our branch office that complains around network performance issues (slow network). Troubleshooting issues like this one was not the focus of my CCENT studies (got certified 2 weeks ago) but I was assigned that ticket last Friday (first assignment). I was thinking to call one of the users and ask him to connect on another computer to see if he still encounters the same issue (that would tell me if it is related to his computer or not - probably layer 1, 2 issue), ask him to try another application (to help determine if it is a Layer 7 issue) and then if it is not related to neither one of these I was thinking to start looking at the switch interface to which the computer is connected to. I would like to know if someone could tell me if I am on the right path and what else I should verify/investigate? Are there root cause analysis tools that exist to help solve/troubleshoot such issues? Thanks in advanced.
This is a pretty wide open question, and could be caused by a myriad of things. I'm going to make a couple of assumptions (yeah, I know, make an ass out of you and umption) such as the branch office is linked to head office by soem kind of dedicated link, and uses that dedicated link for internet access via the head office instead of having a local internet link. You may not have this, but the process should be similar - just the weight of the diagnosis of different stages may be different.
First off, get the user to define "slow". Compare the expectations of the user to the actual infrastructure at the site - if he's expecting a 10 MB/s download rate from the internet (100 mb/s) and you've only got a T1 or E1 link (1.5 mb/s), then it doesn;t matter WHAT you do, he's going to complain it's "slow".
Then move to the basics. Have the PC's investigated. Are they connected at the rate you expect? 100 Mb/s? 1 gig? Full duplex? The most common problem I've seen of this type is incorrect duplex negotiation - PC thinks it's full fuplex, switch thinks it's half duplex, and the result is lots of dropped packets and retries, resulting in "slow" connections almost everywhere. There's also the possibility of speed auto negotiation failing - something capable of 1 gig negotiating 10 Mb/s makes a *big* difference, especially if it's internal infrastructure being accessed.
Do some PING tests - ping a known local host - the local default router, for example - and see what kind of RTT you get. Then ping a known "intra" company host - one which is within the company but not on the local branch office site. What kind of RTT's do you get there? Finally, test a known external site - www.google.com, or a public DNS like the one at 4.2.2.2 - what kind of PING RTT's do you get to them?
Then traceroute - do the same ting, and look for weird hops, or really slow responses - is the workstation getting hooked up on something, protocol-wise, which does a reverse lookup (SSH is a classic example) before accepting connections - and when the RDNS doesn't exist, it "pauses" for several seconds.
Then it gets complex - start looking into the routers involved, and check for dropped packets or errors in the log. Check with the link provider and ask them if they see any errors on the link.
Where you go from there depends really on what you find up to now. ISP, management to, erm, educate the user to the realities of life in remote locations, or maybe you've actually got some faulty hardware somewhere you need to fix. You never know, it does happen! :-)
Good luck.
Cheers.