Basic slow network troubleshooting

[julianunderwood]

Hi,

We've got a Cisco network consisting of a 3750G-12S acting as a core switch and about 10 3750-24P switches in a mesh topology for our network.  We also have a Cisco wireless controller. Hanging off most of the switches are VoIP phones, Cisco wireless access points and computers.

Everything HAD been working fine until the past month or so.  It is a Mac network and we're getting complaints that the network (home directories, file server), Internet and applications are slow on all of the computers.  Sounds pretty broad and I'm having difficulty determining how I should begin troubleshooting this.

I'm going to perform some packet captures to see if this sheds any light.  I've already checked the log on the core switch to see if there are any looping issues and the log looks clean.  Would it be advisable for me to look on the log/console of each of the switches on the network?  Wouldn't the core most likely indicate a problem if there was something wrong with one of the other switches?

The VoIP phones are working fine on the network, so I presume QoS is doing it's job.

We have the Cisco Network Assistant installed and I was wondering if I could use this to troubleshoot our slow down issues?  If so, could someone shed some light on what I could check in this tool?  It's difficult for me to tell if there is a problem with that software because I don't have a baseline.

Any other suggestions on what I could look at/for would be appreciated.  Any other tools that you could recommended other than Wireshark would be great.  I think a packet capture will be the answer-giver, but just wanted to check with the experts.

Thanks!

[jimmysands73_2]

This might be the obvious, but has anything changed in the past month (IOS updgrade, hardware added, cables moved, etc) by your IT dept or some rouge person?   Maybe someone discovered limewire or some other file sharing application recently.  Just an idea, the sniffer is a good idea, as I am sure of the heavy weights on this forum can provide more input than I.

[julianunderwood]

Nothing has changed.  But the rouge person is a possibility.  What would be a good way to pin point the source of heavy traffic (if that is even the issue).

Thanks.

[dixho]

are all data devices on the same VLAN? Normally, a slow network on 3750 switches are caused by congested uplink, multicast, unicast flooding, or broadcast.

There are a couple of ways to identify the problem: understand the traffic pattern and look for output drops

I suggest that you use command show platform port-asic stats drop to determine any output drops on the ports experiencing slow throughput. You may want to use the command a couple of time to find out any increment on drops. Please note that the output drop on show interface is not accurate until 12.2(46)SE or even 12.2(50)SE. Do not trust the output drop on show interface.

A few useful commands are show mls stats interface . It will show you the distributin on ingress and egress traffic with different DSCP and CoS value. Another useful command is show interface | in rate AND show interface count. Need to look at the increment in outgoing interfaces in show interface count.

If the problem is indeed caused by  multicast, unicast flooding, or broadcast.. A good way to troubleshoot the problem is connect a PC on the VLAN. Run wireshark on the PC (no monitor session is required). Find out what traffic is flooded to the VLAN.

If the problem is caused by multicast, it is likely caused by no IGMP querier on the VLAN.

There is a possibility that the 3750 software switches the traffic because inappropriate SDM profile is used.

That's all I can think of.