Linux answers the age-old question, "Why is my network slow?"

By David M Williams
Wednesday, 23 July 2008 19:47

Opinion and Analysis

For every person who has said, "Let's network these two computers" there are many more asking "Why is the network running so slow?" Yet, the ethereal nature of Ethernet has long made computer networks hard to decipher and many a business or home user has longed to peek into the data stream to see just what is going on. You could pay tens of thousands of dollars for the answer - but we'll do it using freely available tools for Linux.

I can certainly speak from my own experience: a branch office calls and complains their network is slow. Now, if they’d said they could not access the Internet or the mail server or if something just was not working there are definite and clear steps which can be performed to determine where the fault is. When things are working – but just running sloowww it is so much harder.

The network link must be up. The routers and switches and network cables and wireless access points and DHCP and DNS servers and desktop and laptop computers must all be connected and working. Yet, something, somewhere is impinging on the usual performance expected. Where do you start looking? Is it a fault with the network provider? Is someone downloading a movie? Or maybe it’s the cumulative effect of a dozen staff streaming Internet radio.

What’s worse is when the branch manager says "the network was slow yesterday" – followed right away with "Why?" as if they have confused me with an omniscient being. This isn’t something restricted to multi-branch companies by any means; I’m certain many a home user has wondered just what’s going on with their home network.

What would be terrific is to have a “task manager” on the router; just connect to it and see the type of traffic going on, from which internal computer and to what internal or external destination – whether in real time or with historical data.

In one sense this can be achieved with most any firewall, provided it sits in between your network and your router. This means the firewall device – be it a computer or something else – must have two network adapters. One will be connected to the router and will be on the same subnet as it; the other will connect to the rest of your network and these will all have to be on the same subnet together, but one which is different to that which the router sits in.

Let me give an example to clarify: your local network might use addresses of the form 192.168.1.x. The computers plug into a switch. One network adapter on the firewall is also plugged in to the switch, and its address is 192.168.1.1. However, the firewall also has a second network adapter, with address 10.10.1.1. The address of the router is 10.10.1.2. The computers on the network have their gateway address set to 192.168.1.1; they are forced to go through the firewall for all Internet or WAN traffic; only it can send traffic out So, most any firewall will work, provided it has appropriate logging and reporting.

However this is not always going to be possible. Nor does it make for a portable solution. Let me tell you why, and how we can solve the problem.

CONTINUED