Network Analysis
 

This is dlichterman's friend Daniel posting this question (because I know more about the issue and i'm too lazy to make a winamp forum account):

Ok, i am having issues on my school network. The bandwidth has gone down the tubes on our T1 line.

here's the setup...
the t1 line goes into a modem, obviously, then it goes into a cisco 4000, then using a patch cable it is connected to a cisco 2950 fiberoptic switch, which is then daisychained to another fiberoptic switch and then sent out to all the school IDFs (Intermediate Data Frames), one for each wing. We have determined that it MUST be a spambot system or something sitting on our network that is chewing the bandwidth. I was able to determine that it was a system that was causing this, but don't know which it is.

One morning I entered class and downloaded winamp on one of my class computers (needed it for the class) and it downloaded at over 200 kilobytes a second. 20 minutes into the period is when the bandwidth totally died (no faster than like 10 kilobytes per second) therefore the system chewing bandwidth was off before, and is now on and killing the net.

I have attempted to get in between the cisco 4000 and cisco 2950 with a flat hub but with no success. It seems that the port on the 2950 is the equivilent of the ethernet port of a cable modem and the 4000 is equivilent of an ethernet port on a computer, they were connected via patch. the 2950 is recognized when connected to the flat hub's uplink port, but not on any of the ports ranging from 2-5 (1 is uplink). the 4000 isn't recognized on any. Maybe this is proprietary? This obviously didn't work out.

I chose a flat hub for its leakiness of data so i can plug a computer with Ethereal into it and determine which IP was garbaging the t1 connection.

I haven't tried crossover cables. I also understand that (to my knowledge) both are SPAN compatible, but I do not want to touch the config stuff for it for fear of b0rking the thing.

Any suggestions on how to find out which system is rogue?

go to each system one at a time. first cut off one wing at a time to localize the problem.

this happened @ my school as well, but at lunch time. Right around 5th period the system would just die, and it would take literally 45 minutes to log in to your account, save and open anything. It was insane. Good luck with your prblm tho.

well we think we will try to get permission to pull the fiber a wing at a time, but we would prefer not to kill internet to anyone

do it when the least people are using the net and let them know about it somewhat in advance too so they don't get pissed at you.

no see thats the problem....it seems to happen RIGHT after school starts when people log onto the systems

Which would suggest that the problem is in one of those wings. So when the wing that has the issue is not being used, there is no issue.

well no like whenever the period starts its gets bad, not like a certain wing loggin on. we may just pull the fiber wing by wing and see what happens

It may be massive node overhead with everyone logging in and opening websites initially at the beginning of the period that's slowing things down...

no it stays slow, well, slower than usuall lol

couldn't you do it after school or on a saturday or something?

no, because it seems the system must be logged in to start spamming