Identify Process Slowing Down LAN on Single Computer

debuggingnetworking

From this question about debugging our business LAN I've been able to pinpoint a single computer which slows down our network.

When the computer is turned on and connected to the network, roughly 5% of all site interactions (that is, clicks on links in a website) are slowed down to a great extent, sometimes rendering a page after 40 seconds instead of the regular one or two seconds.

When we disconnect the computer, network load goes smoothly.

We have a managed Cisco catalyst switch, a Cisco ASA-5505 firewall, as well as some monitoring tools (wireshark and nmap).

The computer serves as a photo server (using iPhoto) and transmits some information between the computers of our network.

How can I trace down and/or monitor my network or computers activity in a way that will allow me to know, on a single definite computer connected to the network, what process/protocol/activity is slowing the network?

Best Answer

When it comes to a single computer, generally you want to get a packet capture and then do some analysis on the packet capture that includes things like:

  • Protocol Breakdown
  • Packets Per second
  • Top senders receivers etc

I recommend using wireshark or maybe Microsoft Network Monitor. With Network Monitor you will get a process breakdown of the capture which can be helpful (If you happen to be on Windows):

enter image description here

You probably want to run it with admin privileges for this.

It is also possible the NIC is malfunctioning. So check the packet rates and various error counters on the switch side for that interface. You could also monitor the switchport by using your switch's "port monitor" functionality. If something like this is going on, I would expect the LAN to get slow (i.e. computer to computer) and not just the Internet.