6

In an office building with 20-some employees, our internet service sometimes drops to about .3 Mbits/sec from 5 Mbits/sec. I use speedtest.net to test the speed. When the speed drops, how can I tell the source of the issue? Namely, are my speedtest results affected by employee streaming/downloading/etc, as opposed to an ISP problem? Would I need a virtually quiet network to accurately test speed?

tic
  • 63
  • 1
  • 3

2 Answers2

6

To answer your first question, yes high bandwidth use will affect speedtest.net results. And yes, you would be best to wait until a time of low traffic to get a better/more accurate reading of your maximum possible speed.

Another metric of maximum possible speed would be (assuming you are connecting via ADSL) the line sync speed as reported by your modem. Although it may not be as accurate, this would allow you to find out the maximum without having to wait until low bandwidth periods.

In terms of determining the source of the internet traffic, you will need to use some mechanism to examine the traffic going between your LAN and the internet. There are a number of ways you could do this, depending on what you have available:

  • You could issue "show ip flow top-talkers" from your router, if it is a Cisco IOS router and you have Netflow configured properly. This is probably the easiest way to determine who is using the most traffic, and where it's going.

  • You could examine the NAT translations table on your router (assuming you use NAT), to show you which internal IPs have the most translations. This would give you a rough idea as to where your bandwidth is going. But it's hardly the best indicator.

  • You could setup a mirror port on your LAN switch, to mirror traffic to/from the router, and then use a packet capture utility such as Wirekshark to analyse the traffic.

  • You could setup a PC as a bridge to sit between your router and your LAN, with internet traffic passing through it, allowing you to again run a packet capture utility and analyse it to find the culprit(s). NOTE: In this case, you risk slowing down your internet speed while you do the capture. This would be best left until after-hours if done.

Cisco 'Top Talkers' Example Config

! Configure top-talkers
ip flow-top-talkers
 top 100
 sort-by bytes

! Configure NetFlow on the appropriate interface on the router
interface Vlan1
 ip flow ingress
 ip flow egress
Geekman
  • 1,478
  • 2
  • 15
  • 27
2

If your router or switch has SNMP functions, it's useful to simply monitor traffic on the interfaces with a simple SNMP reporting tool running on your computer - then you will see the traffic that is going on. If you have a 5Mb connection and it's flowing at 5Mb, you might well have a hard time getting more than 0.3 in edgewise to speedtest - but you'd know that 5Mb was flowing somewhere, so it's not an ISP problem. If nothing is moving and you can only get 0.3Mb to speedtest, then you might have an ISP problem.

If your switch(es) do SNMP, then you'd also know where (on your network) it's flowing to. SNMP capable switches allow tracking the culprit (or legitimate user, if the company is doing things that eat bandwidth...) down to the port level without needing to do detailed analysis - if ports map directly to computers, you can then choose whether you want to talk to the person, or do detailed analysis from that point before talking to them. There are many complex and/or expensive SNMP reporting tools, but for a small office simple and free ones may be adequate, at least to get started.

Ecnerwal
  • 2,746
  • 15
  • 20