I have a network composed by:

  • 28 x PCs

    4 x Axis network cameras

    2 x WRT-54G WiFi routers

    1 x Apple Airport N

    2 X Apple TVs

    2 X D-Link 10/100 24 port switches

    3 x ADSL Routers at 6Mbps each from the Telecom operator connected to the switches

All goes well and actually has been going well for the last couple of years, but since summer started and randomly the network "jams" and until I don't restart the DSL routers no networking functionality can be achieved, and computers can't see each other, etc... not just internet goes, but all the network.

If you look at the network devices ports or the switches themselves you see the less flashing like crazy (until reboot the routers). It's not internet traffic even, just like echo ping ongoing throughout the network that disappears after the reboot of those devices.

We've replaced them a couple of times by new ones without luck and since is a random thing, we can't never check until it happens...

Any idea of what could be causing this? At least how to determine what the problem is?

Note: I've sniffed the net traffic with Wireshark and found out it repeatedly produces the following: http://skitch.com/cyborg/fq6k7/dock

  • As far as I can see, that dump does not show ports for the traffic, but it shows the two hosts that communicate a lot. Are these both regular machines in your internal network? To figure out what's happening you need to go to those machines and see which process causes the traffic. Without either the process or port information there's not much that can be said. – Zds Aug 12 '11 at 10:24
  • It's highlighted on the bottom of the screencap: TCP -> – charlesbridge Aug 12 '11 at 11:24

Be sure to check your cabling. The network traffic could be a switching loop if there's been some changes made on the cables recently.
If the wiring seems OK you can try Wireshark to watch the network chatter. It's cross-platform and will show you lots of information about what's being broadcast on your network.

  • I've tried Wireshark and found out that when the problem happens, this is what it shows repeatedly: skitch.com/cyborg/fq6k7/dock What does that mean? – Cy. Aug 12 '11 at 9:59
  • It looks like a computer is trying desperately to connect to an Oracle DataLens Server, although those aren't the normal source ports for a client. You need to track down that system and check it over. – charlesbridge Aug 12 '11 at 11:36
  • Actually I have no Oracle or any other similar software into my network. Additionally the IP was shutdown at that time. Only was on. Do you think it could be any faulty hardware? or is definitely the which has a software trying to query desperately? – Cy. Aug 12 '11 at 12:31

Start by monitoring the network traffic on affected machines. Connect for example a Linux laptop to the network and use tools like ngrep to see what's being sent and by who. As the problem is obviously related to some devices generating lots of traffic, blindly replacing them is not a solution - you need to first look at the traffic and see who is doing it and why.

Then move to the device generating the traffic and see what's going on there.

On systems like Linux and possibly OS X command line these commands help:

Monitor all traffic on network interface eth0:

ngrep . -d eth0

Once the machine causing the traffic is found, on it this reveals which processes are causing network traffic and where:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.