Weak current College】 【network delay in diagnosis and analysis.

Defective sight

1. anaphoric internal main business is slow, not fluent; information processing

2, servers, and exchange machine CPU and memory usage is low;

3, unable to locate the find network reference slow reasons;

Network environment

1. a cisco3560 AC machine;

2, LAN has 8 servers, of which 4 are UNIX systems, the other 4 is Windows2003 system;

On-site diagnosis

First do a Ping test. UNIX system host cross-ping of analogy, Ping values are less than 1MS. While UNIX system host to host Ping PingWindows system often appear 9-15MS delay. Windows system host Ping value is between mutual is not fixed in 1MS to 15MS jumping between.

Scene analysis

The network structure easy to clarity, the server and the exchange of machine functions well. Network often appear larger than 1MS delay affects the normal operation of the entire network, the main business of running an impact, to deal with the questions first to find out reasons of delay attack.

We all know, a network of buying and selling process: launched by a client to resolve network are forwarded to the service-side, server-side processing and then to the client. Thus, during the entire trading process time delay can be three times the resolution, the client reference time (t1) network transmission time (t2) service-side reference time (t3).

Field test was aware of a UNIX system host ping value fixed less than 1ms, and Windows systems, or between hosts and the UNIX system host Ping time to a larger delay. This is marked with the UNIX system host communication is good, but with Windows system host communications, or Windows system hosts communicate the process will be delayed. Thus, we infer that reference the host Windows system slow. In order to verify the above, we use a branch for network traffic analysis system perform Diagnostics, 2009.

Use the branch to network traffic analysis system performs network diagnosis

(Use section for network traffic analysis system 2009 Executive stresses the packet analysis)

First, it opened branch to network traffic analysis system on IP, 2009, the configuration for this host 190.15.xxx.200 as sponsor, ping to one IP address for the host Windows system 190.15.xxx.218 pinging. The Windows system host Exchange machine port being a mirror, the mirror to send and receive traffic. Then, go to the host using 190.15.xxx.200 Ping190.15.xxx.218, branch to network traffic analysis system for the 2009 implementation 13 minutes of the grab bag.

Grab the package processes we observe, 190.15.xxx.200 hosts in a host of branch Ping190.15.xxx.218 occur 9MS delay, and frequency is frequent. While 190.15.xxx.200 host PingUNIX system host you are less than 1MS delay. In addition, the mirror mouth received icmpresponse not very fixed, and is interspersed with 9MS 1MS to indicate the network is not stopped.

Mirror position Windows system host SW port, thus delaying the echoresponse appear can be seen as a service-side reference delay, but this care often delay 9MS. The resulting authentication: the network time-delay from win host reference slow formation.

Then, log on to the host, perceived 190.15.xxx.218 host running a larger order, memory and CPU usage is high. We perform on the host, in closing the decompression (1) of the antivirus software after you became aware of the process of network delay is gone, but completely uninstall the anti-virus software, network ping value all fixed in less than 1MS.
Diagnostic results

Resolved to network traffic analysis system for diagnosis of the grab bag 2009, plagued by a month of network latency question finally did. Originally the LAN previously beset by worms constantly, in order to implement network security attacks, to every Windows system host installed an antivirus software, and the anti-virus software opened the acquiescence of intrusion detection functions. The function of each packet arrival server perform the check and then handed over to the appropriate order, whereas the inspection process is very time-consuming, so the delay occurred 9MS.

Professional network fault diagnosis service introduction

Network fault diagnosis service is determined by the branch to a software professional network of technical staff, with professional network analysis instruments deployed in a user-specified segments that network packet-level analysis, high speed positioning analysis stir up network trouble proclamation and provides information about processing queries, thus helping the user high-speed processing questions.

Network fault diagnosis service is designed to provide customers with even more nature of services that help network as people deal with real networks, optimizing the maintenance of the network, to build healthy security fixed network services.