Can a file sharing program on a SINGLE computer bring an entire network down?

[Mears]

Today at work, our network went down. We could still communicate w/ users across our LAN, but nobody could get outside. This is a fairly large network with hundreds of users. I tend to use a program called bit torrent at work as do a few other of my coworkers(not trying to justify it) and have been doing so for a while.

To make a long story short, the head IT guy basically suggested that my computer caused our network to crash because of bit torrent. Doesn't really make a whole lot of sense to me. I mean maybe everyone on my switch, but the entire network seems a little far fetched.

 

[ScottMac]

Since the network communicates out through (probably, I'm guessing) one WAN connection to the Internet, it is conceivable that you could generate enough traffic in either or both directions to cause a problem ... I'm not familiar with Bit Torrent.

Chances are you didn't; I don't know, I don't have the logs, your IT guy does.

Here's the really sucky part: If your IT guy has a shred of believeability, when the Big Dudes come to him to ask why the network / Internet went down, he can cover his a$$ by pointing at you and the others using that software ... especially if it's of a type expressly prohibited or discouraged by corporate policy. He gets off clean (or at least cleaner), you get (at the least) a suspicious scowl.

Whatever function that software fulfills for you, IMHO, you should give it up (chances are it'll be forbidden soon anyway if it's not already).

Stick to the corporate shrink-wrap stuff.

JM.02

Scott

 

[SoulAssassin]

I'm familiar with torrents and I find it -extremely- unlikely although it's not something I would recommend for a corporate environment because of some assumptions I'm making on what you were pulling down. I would stand your ground and ask him to provide logs. More than likely either he knows what the problem is and is covering his butt for something he did or has no clue what happened and is looking to demonize someone.

All of this being said, it is possible but very unlikely. The only situation I can think of off the top of my head would be that if you had a network shared drive you were saving to and it filled up the C drive. As far as the network traffic itself causing the problem, again very unlikely.

 

[Soybomb]

I would stand your ground and ask him to provide logs.

I'd be really careful with doing that though if using such a program is against IT policy.

 

[Barnaby W. Füi]

I would say it's extremely unlikely that you "crashed" the network, however it is possible that you were hogging all of the bandwidth.

To ScottMac and others not familiar with bittorrent:

see here:
http://bitconjurer.org/BitTorrent/FAQ.html
and here:
http://bitconjurer.org/BitTorrent/index.html

Basically it is filesharing, with the distinction that it 1. forces everyone to share, 2. shares and downloads small chunks of a file at once, so even if you only have 200K of a file, you can still contribute to other peoples' downloads.

 

[mboy]

As others stated, it is unlikely you hogged all the bandwidth, However, he obviously knows you should be using something you shouldn't be on HIS network, so he may be scaring you into not using perr-to-peer anymore. I have used that tactic once or twice with my users

 

[SoulAssassin]

He never said that bit torrent and such apps were specifically banned. bit torrent actually has alot of legitimate uses and the admin may or may not know specifically what he was downloading without packet captures.

It really comes down to without knowing the specifics of the problem it is impossible to say for sure.

 

[hatboy]

As others have said, it's probably unlikely that one instance of bit torrnet killed your network.

However, it IS definitely possible for one program on one computer to bring down a network, particularly if it is poorly (or maliciously) written. I used to work as an admin for a university computer science department. One afternoon, the entire network in our building (about 100 computers and mostly 100mb) became almost completely unresponsive. We couldn't access most computers on our LAN and we couldn't get to the internet either. Using a packet sniffer, we traced the source of the problem to a single Sun Ultra 5 (which is not a particularly fast machine, btw, about 300mhz). This box was sending out a CRAPLOAD of packets, which were getting broadcast to every box on the network behind our router. It turned out that a student had written a Java networking program rather poorly for a class project and didn't realize he was causing problems.

 

[GoodRevrnd]

I'll attest to the evils of bittorrent... on my little apartment 768/128k dsl line some filesharers--especially this program I believe--turn my latency to sh!t. I'm talking pings consistently 400-1200ms, although if I wish to download something the speed is just slightly below normal. Nothing ever crashes. I'm not too familiar with bittorrent, but I think it happens becuase the program opens so many connections and constantly makes search requests. I'm currently in the process of swapping out my Netgear for an old Webramp and locking these services down at certain times of the day, hopefully this will help.

As to this crashing a corporate network... I can't say I really believe it.

 

[spidey07]

Yes,

Filesharing programs like this can and often do completely and totally overwhelm an internet circuit. Especially if it is only 100 users then you probably only have a T1 or less.

Especially if it makes multiple TCP connections. All those connections will fill up the router's buffers that is supplying your internet and at that point most of the traffic is dropped, but your filesharing program keeps on hogging the bandwidth.

Tread lightly.

Take this for example - your DNS is outside...uses udp...won't get through if the link is saturated with TCP because of a symptom called TCP synching. Or it could time out if the response is sitting in a buffer for a few seconds. Or it could get dropped.

 

[SoulAssassin]

Originally posted by: spidey07
Yes,


Take this for example - your DNS is outside...uses udp...won't get through if the link is saturated with TCP because of a symptom called TCP synching. Or it could time out if the response is sitting in a buffer for a few seconds. Or it could get dropped.

Depending on which BT client he's running and how it's configured, BT will use all the available up the river bandwidth. It is possible that the app consumed all or a very large portion of the bandwidth thus causing problem w returning ack's choking out "legitimate" internet traffic. As I mentioned before, it's really hard to say w out having a specific definition of what "bringing down the entire network" really means.

 

[randal]

If by "bringing down the network" he means "everything outside our LAN was inaccessible", then yes, a single machine can *easily* bring down the network.

I was adminning a network for a huge LAN gaming tournament (everlan.net) with about 500 people there. We'd piped in near 5mbps wireless to make it happen (sadly, copper was not in the budget). There was *TONS* of traffic shaping and firewalling happening, and everything was working perfectly. One group of 4 guys had unrestricted access to the net and the highest priorities on packets because they were broadcasting audio/video. One of these fine gentlemen opened up KaZaa and within minutes, the entire conference was without internet access. It only took about 10 seconds to realize wtf was going on, and a quick unplug + baseball bat to the head fixed the issue.

Moral of the story - non-authorized internet-software can hose almost any WAN pipe. Any semi-competent network admin *will* know what was going on: he gets paid to be good at what he does, don't fsck with him.

$.02
randal