Troubleshoot this bandwidth (?) problem, plz...

[cleverhandle]

Need some expert help here. I'm a teacher at an urban public high school - always short on funds and without a dedicated tech coordinator. If I can solve this problem without calling in expensive outside support, it would be very nice. If I sound too clueless for this problem, tell me so and I'll tell the principal to spend the money.

We have a T1 line into the building that, for various reasons, is split into two physical networks - administrative and instructional. The instructional network is a parallel installation of Fast Ethernet and wireless, though the wireless access is mostly unused. The administrative network is solely Fast Ethernet. The instructional network lies behind a (sic) "firewall" - really a proxy running a proprietary web filtering program based on squid. Now, most everyone in the building accesses the Internet through the instructional network and filter and complains about horribly slow access. Which is quite appropriate - I was downloading some files this evening, long after school closed, and was getting 1 KB/sec transfer rates. (You can imagine a teacher trying to get a room full of 14 year olds to work on an Internet project... frightening.) But, at times the transfer rate would improve to "normal" speeds - perhaps for a minute or two before dropping again. Access on the administrative network is fine.

So, who's the likely culprit, here? At first, I thought the filtering box was getting swamped - my "boss" (an assistant principal who knows squat) - had the filtering software installed on an ancient Celeron box which probably can't handle the load of checking URL requests against its blacklist. I could check - if only someone had a login password for the box, which we don't (don't ask...). But if that were the case, long downloads shouldn't be affected - once the filter allowed the request, bandwidth should be normal, correct? So I'm suspecting that the problem is in the configuration of the instructional network as a whole. The problem is not specific to certain rooms or to wireless/hardwire connections, so it would seem the problem lies high up in the configuration or installation.

Any ideas on where to start are greatly appreciated. If you need more info, I'll do my best.

 

[Santa]

There are many ways to troubleshoot this. Best way can only be determined by you for you have the most information.

I am an advocate of using the OSI model when troubleshooting..

I prefer to start from the bottom (Physical Layer) and move up.

Start off by tracing the PC interface (understanding speed limitation of the interface) back to the device it attaches to. Mark down all the differnt devices it goes through and what type of device it is and what speed it can handle.

If you find you are going through multiple hubs chained together and the ethernet cable is stringing across multiple florecent lights and behind copiers then congrats you have multiple problems rolled into one.

If you find out that cabling, and devices should be able to handle the speeds (best way to test this is to move a pc to the same room as the filtering box and hook it to the same hub or switch that it is connected to so that there is no cables or devices in between besides that device to troubleshoot) then onward to your Datalink, Network are best tested with sniffers and perhaps managed hubs, switchs, and routers.. If you don't have these availble (managed versions of hubs, switchs, or sniffer) then the best you can do between Datalink through Presentation Layer troubleshooting is to check and make sure all machines are using a good protocal and routing scheme (i.e. learn how the network is really working IP, IPX, Netbuei) Then make sure it is consistant with best practices (we can help with this)

Other than that you will be up into layer 7 to test and make sure it isn't the filter machine like you think it may be.. your best bet to test this theory is to check on the administration side, perhaps they are not going through the squid box .. if they are and things are fine then it is something with the configuration of the filters, or machines on the intructional side. If they are not using then test to see if speeds are better then you may have a misconfigured proxy or underpowered machine.

Hope this helps..