we have 10 mbps lease line in our office.we have replace one 24 port switch with onother 24 port switch due to lt became faulty.now we have two 24 port switch in our network.we have nearly 100 users.now during peak hour speed is very slow.even face book does not open .how can i rectify the faullt how does one use wireshark to slove the problem.Kindly help
singhneeraj421 0 Newbie Poster
Dani AI
Generated
Brief expert summary: this looks like two overlapping problems — chronic oversubscription plus a new LAN/edge fault. The office is sharing a small leased line among many users (noted by and highlighted by and ), so peak congestion is expected. The recent switch replacement and the intermittent nature of the outages point to a newly introduced Layer‑1/Layer‑2 issue (duplex/cable errors, trunk/VLAN misconfig, STP flaps or a broadcast storm) or gateway/resource exhaustion rather than only an ISP speed quota.
Recommended triage (order matters):
- Isolate WAN vs LAN: perform a direct test at the service demarcation (bypass internal switches). Good WAN numbers there mean the issue is internal.
- Check gateway/firewall: inspect CPU, memory, NAT/session table and firewall logs for spikes or exhausted connection counts.
- Inspect switches: review interface counters for CRC/FCS/late collisions and look for duplex mismatches and port flaps on uplinks added when the replacement was installed.
- Look for layer‑2 problems: check STP logs for topology changes and for excessive broadcast/multicast traffic.
- Identify top talkers: use NetFlow/sFlow or a short packet capture on the uplink to find heavy users (cloud backups, P2P, malicious hosts) and large numbers of concurrent short TCP sessions.
Wireshark quick checklist (capture at the gateway/uplink, short run, ring buffer):
- Use Statistics → Endpoints/Conversations to spot the heaviest IPs and protocols.
- Useful display filters:
tcp.analysis.retransmission dns tcp.port == 80 || tcp.port == 443 - High TCP retransmissions + otherwise normal capacity normally indicates packet loss on the LAN or a duplex/cable problem; many tiny concurrent sessions may indicate NAT exhaustion or a misbehaving application.
Short fixes and next steps: repair/replace suspect cables, force correct duplex on mismatched ports, fix trunk/VLAN configuration or remove accidental loops, apply temporary QoS/egress policing to protect interactive traffic, and schedule large backups off peak. For ongoing visibility consider flow/monitoring tools (NetFlow/PRTG/LANGuardian/SparrowIQ) and plan a realistic WAN upgrade for a 100‑user office if usage patterns require it.
Recommended Answers
Jump to Post— Slavi 94I don't think wireshark can help you with that at all, it is used to analyse packets. What you could start up with is do the following in
cmdand get back to us with the resultsping www.google.com -t
let it run for about 10-15 seconds then usectrl+Cand …
Jump to Post— rubberman 1,355So you have 100 users. What is your internet connection speed? If 100 users are hitting the internet pretty constantly, divide that speed by 100 and you will get what your personal throughput would be. IE, 6mbps / 100 == 60kbps. Timeouts and retries increase exponentially as well. You need …
Jump to Post— rubberman 1,355To continue my previous post - I re-read your original post an see that you have a 10mbps link to the internet. Divide that by 100 users, and at peak times, you are getting only 100kbps for each user. You also don't mention if that is symmetric (10 up and …
All 11 Replies
Slavi 94 Master Poster Featured Poster
I don't think wireshark can help you with that at all, it is used to analyse packets. What you could start up with is do the following in cmd and get back to us with the resultsping www.google.com -t
let it run for about 10-15 seconds then use ctrl+C and paste the results here
Further, go to Click Here and post the results back to us as well.I can give you further explanation of what they are if you want me to(unless you already know)
rubberman 1,355 Nearly a Posting Virtuoso Featured Poster
So you have 100 users. What is your internet connection speed? If 100 users are hitting the internet pretty constantly, divide that speed by 100 and you will get what your personal throughput would be. IE, 6mbps / 100 == 60kbps. Timeouts and retries increase exponentially as well. You need at least a 25mbps link to support 100 users at a reasonable level of service. More is better. Even at 25mbps internet download speed, that is only 250kbps per user at peak loads, and if some are uploading (cloud storage), then that drops significantly.
singhneeraj421 0 Newbie Poster
Pinging google.co.in [74.125.236.95] with 32 bytes of data:
Reply from 74.125.236.95: bytes=32 time=73ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Reply from 74.125.236.95: bytes=32 time=80ms TTL=56
Reply from 74.125.236.95: bytes=32 time=78ms TTL=56
Reply from 74.125.236.95: bytes=32 time=90ms TTL=56
Reply from 74.125.236.95: bytes=32 time=92ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Reply from 74.125.236.95: bytes=32 time=121ms TTL=56
Reply from 74.125.236.95: bytes=32 time=83ms TTL=56
Reply from 74.125.236.95: bytes=32 time=98ms TTL=56
Reply from 74.125.236.95: bytes=32 time=71ms TTL=56
Reply from 74.125.236.95: bytes=32 time=70ms TTL=56
Reply from 74.125.236.95: bytes=32 time=83ms TTL=56
Reply from 74.125.236.95: bytes=32 time=83ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Reply from 74.125.236.95: bytes=32 time=104ms TTL=56
Reply from 74.125.236.95: bytes=32 time=99ms TTL=56
Reply from 74.125.236.95: bytes=32 time=88ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Request timed out.
Reply from 74.125.236.95: bytes=32 time=72ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Request timed out.
Reply from 74.125.236.95: bytes=32 time=74ms TTL=56
Reply from 74.125.236.95: bytes=32 time=76ms TTL=56
Reply from 74.125.236.95: bytes=32 time=97ms TTL=56
Reply from 74.125.236.95: bytes=32 time=85ms TTL=56
Reply from 74.125.236.95: bytes=32 time=73ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Reply from 74.125.236.95: bytes=32 time=94ms TTL=56
Reply from 74.125.236.95: bytes=32 time=74ms TTL=56
Reply from 74.125.236.95: bytes=32 time=69ms TTL=56
Reply from 74.125.236.95: bytes=32 time=94ms TTL=56
Reply from 74.125.236.95: bytes=32 time=97ms TTL=56
Reply from 74.125.236.95: bytes=32 time=102ms TTL=56
Reply from 74.125.236.95: bytes=32 time=73ms TTL=56
Reply from 74.125.236.95: bytes=32 time=78ms TTL=56
Reply from 74.125.236.95: bytes=32 time=99ms TTL=56
Reply from 74.125.236.95: bytes=32 time=74ms TTL=56
Reply from 74.125.236.95: bytes=32 time=72ms TTL=56
Reply from 74.125.236.95: bytes=32 time=71ms TTL=56
Reply from 74.125.236.95: bytes=32 time=89ms TTL=56
Reply from 74.125.236.95: bytes=32 time=105ms TTL=56
Reply from 74.125.236.95: bytes=32 time=101ms TTL=56
Reply from 74.125.236.95: bytes=32 time=70ms TTL=56
Reply from 74.125.236.95: bytes=32 time=99ms TTL=56
Request timed out.
Reply from 74.125.236.95: bytes=32 time=92ms TTL=56
Reply from 74.125.236.95: bytes=32 time=68ms TTL=56
Reply from 74.125.236.95: bytes=32 time=70ms TTL=56
Reply from 74.125.236.95: bytes=32 time=104ms TTL=56
Reply from 74.125.236.95: bytes=32 time=91ms TTL=56
Request timed out.
Reply from 74.125.236.95: bytes=32 time=72ms TTL=56
Reply from 74.125.236.95: bytes=32 time=107ms TTL=56
Reply from 74.125.236.95: bytes=32 time=99ms TTL=56
Reply from 74.125.236.95: bytes=32 time=102ms TTL=56
Reply from 74.125.236.95: bytes=32 time=81ms TTL=56
Reply from 74.125.236.95: bytes=32 time=103ms TTL=56
Reply from 74.125.236.95: bytes=32 time=83ms TTL=56
Reply from 74.125.236.95: bytes=32 time=83ms TTL=56
Reply from 74.125.236.95: bytes=32 time=87ms TTL=56
Request timed out.
Reply from 74.125.236.95: bytes=32 time=100ms TTL=56
Reply from 74.125.236.95: bytes=32 time=87ms TTL=56
Reply from 74.125.236.95: bytes=32 time=70ms TTL=56
Reply from 74.125.236.95: bytes=32 time=110ms TTL=56
Reply from 74.125.236.95: bytes=32 time=112ms TTL=56
Ping statistics for 74.125.236.95:
Packets: Sent = 68, Received = 63, Lost = 5 (7% loss),
Approximate round trip times in milli-seconds:
Minimum = 68ms, Maximum = 121ms, Average = 85ms
Control-C
^C
singhneeraj421 0 Newbie Poster
2/24/2015 6:42 AM GMT 0.50 Mb/s 3.49 Mb/s 131 ms Mohali ~ 100 mi Share
2/24/2015 6:43 AM GMT 0.47 Mb/s 1.11 Mb/s 149 ms Mohali ~ 100 mi Share
2/24/2015 7:42 AM GMT 1.80 Mb/s 3.23 Mb/s 149 ms Solan ~ 100 mi Share
2/24/2015 7:43 AM GMT 1.13 Mb/s 2.09 Mb/s 151 ms Solan ~ 100 mi Share
2/24/2015 7:49 AM GMT 0.01 Mb/s 2.63 Mb/s 178 ms Solan ~ 100 mi Share
2/24/2015 9:49 AM GMT 0.64 Mb/s 2.66 Mb/s 170 ms Solan ~ 100 mi Shar
2/24/2015 9:50 AM GMT 0.68 Mb/s 1.66 Mb/s 157 ms Solan ~ 100 mi Share
2/24/2015 10:59 AM GMT 0.05 Mb/s 0.90 Mb/s 136 ms Solan ~ 100 mi Share
2/24/2015 11:01 AM GMT 0.24 Mb/s 0.83 Mb/s 150 ms Solan ~ 100 mi Share
2/24/2015 11:29 AM GMT 0.99 Mb/s 2.72 Mb/s 160 ms Solan ~ 100 mi Share
2/24/2015 11:30 AM GMT 1.19 Mb/s 2.67 Mb/s 138 ms Solan ~ 100 mi Share
2/24/2015 11:39 AM GMT 0.26 Mb/s 1.74 Mb/s 208 ms Solan ~ 100 mi Share
2/24/2015 11:40 AM GMT 0.31 Mb/s 0.90 Mb/s 114 ms Solan ~ 100 mi Share
2/25/2015 11:25 AM GMT 2.28 Mb/s 3.50 Mb/s 119 ms Baddi ~ 100 mi Share
2/25/2015 11:30 AM GMT 0.68 Mb/s 3.22 Mb/s 133 ms Baddi ~ 100 mi Share
darragh.delaney 0 Newbie Poster
Hi there,
The wireshark suggestion is not a bad one as packets never lie. The problem is that it will generate so much output it will be hard to understand what is happening.
Another option is to try something like LANGuardian which will process the network packets and show you who is connecting to what.
The free trial may be enough to get you to the bottom of the problem
Hope this helps,
Darragh
rubberman 1,355 Nearly a Posting Virtuoso Featured Poster
To continue my previous post - I re-read your original post an see that you have a 10mbps link to the internet. Divide that by 100 users, and at peak times, you are getting only 100kbps for each user. You also don't mention if that is symmetric (10 up and 10 down) or assymetric (10 down, something less like 1mbps down). This has a tremendous impact on thruput. I have a 25mbps download speed on my business internet connect, but only 6 up, and when my wife is posting videos to the internet (uploads), my download speeds get really bad! Symmetric connections are much more expensive than assymetric ones. That requires a T1, T3, or fractional-T3 connection and you will pay dearly for them.
So, for 100 users in your office, you need a much higher capacity connection. Time to look at the budget...
singhneeraj421 0 Newbie Poster
u r right 10 mbps is not sufficient for 100 users.but upto 8 days back we r getting suffient speed but now some thing happen that even gmail takes upto 5 mintues to laod.some thing is happen in the network due to which it happens.some time speed is normal but some time it suffer so badly that u will do nothing.i want to know is there any software which helps me.kindly help
Slavi 94 Master Poster Featured Poster
The ping results seem sufficient, not that much loss of packets even though there is some. Could you make a test in Click Here and show us what is the download/upload speed of your connection? You will be presented with a link to the test that you can share with us, unless you take a screenshot. Perhaps also the increase in speed is due to less people active on the network .. as rubben said 10 mbps for 100 people is not exactly a connection with great speed ..
singhneeraj421 0 Newbie Poster
Date Download Upload Latency Server Distance Share
2/13/2015 7:33 AM GMT 0.24 Mb/s 3.08 Mb/s 72 ms Noida, UP ~ 150 mi Share
2/20/2015 11:17 AM GMT 0.42 Mb/s 0.90 Mb/s 112 ms Panipat ~ 100 mi Share
2/20/2015 11:17 AM GMT 0.70 Mb/s 3.52 Mb/s 89 ms Panipat ~ 100 mi Share
2/20/2015 11:18 AM GMT 0.12 Mb/s 1.03 Mb/s 106 ms Panipat ~ 100 mi Share
2/20/2015 11:19 AM GMT 3.76 Mb/s 1.86 Mb/s 90 ms Panipat ~ 100 mi Share
2/20/2015 11:19 AM GMT 5.26 Mb/s 1.95 Mb/s 88 ms Panipat ~ 100 mi Share
2/20/2015 11:20 AM GMT 5.47 Mb/s 2.36 Mb/s 103 ms Panipat ~ 100 mi Share
2/20/2015 11:20 AM GMT 5.60 Mb/s 1.68 Mb/s 98 ms Panipat ~ 100 mi Share
2/20/2015 11:22 AM GMT 0.64 Mb/s 2.20 Mb/s 95 ms Panipat ~ 100 mi Share
2/20/2015 11:22 AM GMT 0.70 Mb/s 1.04 Mb/s 128 ms Panipat ~ 100 mi Share
2/20/2015 11:24 AM GMT 0.98 Mb/s 0.71 Mb/s 123 ms Panipat ~ 100 mi Share
2/20/2015 11:32 AM GMT 0.50 Mb/s 0.92 Mb/s 121 ms Panipat ~ 100 mi Share
2/21/2015 5:02 AM GMT 3.35 Mb/s 1.38 Mb/s 89 ms Baddi ~ 100 mi Share
2/21/2015 5:02 AM GMT 5.06 Mb/s 1.61 Mb/s 92 ms Baddi ~ 100 mi Share
2/21/2015 5:03 AM GMT 5.34 Mb/s 2.24 Mb/s 90 ms Baddi ~ 100 mi Share
2/21/2015 5:03 AM GMT 1.27 Mb/s 1.15 Mb/s 93 ms Baddi ~ 100 mi Share
2/21/2015 5:04 AM GMT 2.72 Mb/s 1.84 Mb/s 106 ms Baddi ~ 100 mi Share
2/21/2015 5:06 AM GMT 1.26 Mb/s 4.90 Mb/s 112 ms Mohali ~ 100 mi Share
2/21/2015 5:07 AM GMT 2.12 Mb/s 4.03 Mb/s 86 ms Mohali ~ 100 mi Share
2/21/2015 5:08 AM GMT 4.17 Mb/s 5.53 Mb/s 98 ms Mohali ~ 100 mi Share
2/21/2015 5:08 AM GMT 4.63 Mb/s 5.55 Mb/s 78 ms Mohali ~ 100 mi Share
2/21/2015 5:08 AM GMT 4.30 Mb/s 5.51 Mb/s 77 ms Mohali ~ 100 mi Share
2/21/2015 5:10 AM GMT 5.07 Mb/s 5.64 Mb/s 94 ms Mohali ~ 100 mi Share
2/21/2015 5:10 AM GMT 4.87 Mb/s 5.54 Mb/s 76 ms Mohali ~ 100 mi Share
2/21/2015 5:13 AM GMT 2.72 Mb/s 1.14 Mb/s 82 ms Baddi ~ 100 mi Share
2/21/2015 5:14 AM GMT 5.21 Mb/s 1.80 Mb/s 81 ms Baddi ~ 100 mi Share
2/21/2015 5:14 AM GMT 6.18 Mb/s 1.55 Mb/s 81 ms Baddi ~ 100 mi Share
2/21/2015 5:17 AM GMT 6.00 Mb/s 1.17 Mb/s 81 ms Baddi ~ 100 mi Share
2/21/2015 5:17 AM GMT 5.82 Mb/s 1.31 Mb/s 135 ms Baddi ~ 100 mi Share
2/21/2015 5:19 AM GMT 6.13 Mb/s 1.02 Mb/s 92 ms Baddi ~ 100 mi Share
2/21/2015 5:19 AM GMT 5.94 Mb/s 1.36 Mb/s 92 ms Baddi ~ 100 mi Share
2/21/2015 5:20 AM GMT 5.77 Mb/s 1.20 Mb/s 100 ms Baddi ~ 100 mi Share
2/21/2015 5:20 AM GMT 6.29 Mb/s 1.07 Mb/s 110 ms Baddi ~ 100 mi Share
2/21/2015 5:23 AM GMT 2.65 Mb/s 1.01 Mb/s 107 ms Baddi ~ 100 mi Share
2/24/2015 6:41 AM GMT 0.37 Mb/s 3.45 Mb/s 120 ms Mohali ~ 100 mi Share
2/24/2015 6:42 AM GMT 0.50 Mb/s 3.49 Mb/s 131 ms Mohali ~ 100 mi Share
2/24/2015 6:43 AM GMT 0.47 Mb/s 1.11 Mb/s 149 ms Mohali ~ 100 mi Share
2/24/2015 7:42 AM GMT 1.80 Mb/s 3.23 Mb/s 149 ms Solan ~ 100 mi Share
2/24/2015 7:43 AM GMT 1.13 Mb/s 2.09 Mb/s 151 ms Solan ~ 100 mi Share
2/24/2015 7:49 AM GMT 0.01 Mb/s 2.63 Mb/s 178 ms Solan ~ 100 mi Share
2/24/2015 9:49 AM GMT 0.64 Mb/s 2.66 Mb/s 170 ms Solan ~ 100 mi Share
2/24/2015 9:50 AM GMT 0.68 Mb/s 1.66 Mb/s 157 ms Solan ~ 100 mi Share
2/24/2015 10:59 AM GMT 0.05 Mb/s 0.90 Mb/s 136 ms Solan ~ 100 mi Share
2/24/2015 11:01 AM GMT 0.24 Mb/s 0.83 Mb/s 150 ms Solan ~ 100 mi Share
2/24/2015 11:29 AM GMT 0.99 Mb/s 2.72 Mb/s 160 ms Solan ~ 100 mi Share
2/24/2015 11:30 AM GMT 1.19 Mb/s 2.67 Mb/s 138 ms Solan ~ 100 mi Share
2/24/2015 11:39 AM GMT 0.26 Mb/s 1.74 Mb/s 208 ms Solan ~ 100 mi Share
2/24/2015 11:40 AM GMT 0.31 Mb/s 0.90 Mb/s 114 ms Solan ~ 100 mi Share
2/25/2015 11:25 AM GMT 2.28 Mb/s 3.50 Mb/s 119 ms Baddi ~ 100 mi Share
2/25/2015 11:30 AM GMT 0.68 Mb/s 3.22 Mb/s 133 ms Baddi ~ 100 mi Share
2/25/2015 12:22 PM GMT 0.14 Mb/s 3.48 Mb/s 136 ms Baddi ~ 100 mi Share
2/25/2015 12:25 PM GMT 0.54 Mb/s 2.93 Mb/s 131 ms Solan ~ 100 mi Share
2/25/2015 12:36 PM GMT 4.32 Mb/s 5.50 Mb/s 81 ms Solan ~ 100 mi Share
2/25/2015 12:40 PM GMT 4.33 Mb/s 5.52 Mb/s 125 ms Solan ~ 100 mi Share
2/26/2015 5:34 AM GMT 0.13 Mb/s 2.60 Mb/s 93 ms Noida, UP ~ 150 mi Share
2/26/2015 5:36 AM GMT 0.12 Mb/s 3.08 Mb/s 86 ms Noida, UP ~ 150 mi Share
2/26/2015 6:12 AM GMT 1.93 Mb/s 5.27 Mb/s 67 ms Noida, UP ~ 150 mi Share
2/26/2015 6:12 AM GMT 2.60 Mb/s 5.09 Mb/s 78 ms Noida, UP ~ 150 mi Share
2/26/2015 6:13 AM GMT 2.10 Mb/s 5.03 Mb/s 76 ms Noida, UP ~ 150 mi Share
2/26/2015 6:15 AM GMT 1.88 Mb/s 5.06 Mb/s 82 ms Noida, UP ~ 150 mi Share
3/2/2015 6:14 AM GMT 1.99 Mb/s 4.09 Mb/s 143 ms Panipat ~ 100 mi Share
3/2/2015 6:15 AM GMT 1.27 Mb/s 3.73 Mb/s 139 ms Panipat ~ 100 mi Share
3/2/2015 6:15 AM GMT 1.49 Mb/s 4.21 Mb/s 141 ms Panipat ~ 100 mi Share
3/2/2015 6:24 AM GMT 1.08 Mb/s 3.65 Mb/s 143 ms Panipat ~ 100 mi Share
3/2/2015 6:24 AM GMT 0.99 Mb/s 2.90 Mb/s 129 ms Panipat ~ 100 mi Share
3/2/2015 6:47 AM GMT 0.41 Mb/s 3.75 Mb/s 132 ms Panipat ~ 100 mi Share
3/2/2015 6:51 AM GMT 1.42 Mb/s 4.09 Mb/s 134 ms Solan ~ 100 mi Share
3/2/2015 6:52 AM GMT 0.76 Mb/s 2.41 Mb/s 127 ms Solan ~ 100 mi Share
3/2/2015 7:19 AM GMT 1.18 Mb/s 3.89 Mb/s 129 ms Baddi ~ 100 mi Share
3/2/2015 12:38 PM GMT 1.17 Mb/s 5.17 Mb/s 76 ms Baddi ~ 100 mi Share
3/2/2015 12:39 PM GMT 1.65 Mb/s 4.99 Mb/s 73 ms Baddi ~ 100 mi Share
3/2/2015 12:42 PM GMT 2.73 Mb/s 5.32 Mb/s 78 ms Baddi ~ 100 mi Share
3/2/2015 1:18 PM GMT 4.44 Mb/s 5.63 Mb/s 77 ms Baddi ~ 100 mi Share
3/3/2015 4:52 AM GMT 1.42 Mb/s 3.78 Mb/s 67 ms Baddi ~ 100 mi Share
3/3/2015 9:59 AM GMT 1.12 Mb/s 1.45 Mb/s 157 ms Panipat ~ 100 mi Share
3/3/2015 10:03 AM GMT 0.93 Mb/s 3.23 Mb/s 152 ms Baddi ~ 100 mi Share
matrixdevuk 71 6t9.me Founder
Well, let's think of this in a literal manner.
Let's say you have an active directory controller setup on your network (this is very common in offices)... that would use quite a bit of bandwidth INTERNALLY for your router to manage. This could affect your outbound connections because your router is trying its best to route AD connections and let's say, Google connections.
Also, if you're sharing 10Mbp/s between 100 devices, that's 0.1Mbp/s per device (if it's routed evenly)... so that just adds up.
For an office with 100 devices, you're going to need at least 50Mbp/s to get it running at an average speed; though 1Gbp/s is quite common.
Hark 0 Newbie Poster
Two good tools we use to help with traffic visibility:
-PRTG
-SparrowIQ
Be a part of the DaniWeb community
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.