when WAN is connected to the router the network speed drops to half...?

[stars]

I have 3 computers in a network and a ADSL modem connected to the WAN port of the router which is a SMC Barricade 7004VBR

When I try to copy an ISO file from a computer to another the copy time is about 11 min, but when the modem
is connected the copy time drops to about 60 min. The copying time reported is not excact but there is a big
difference. The computers are using win2000pro, XPpro and Linux. Im copying the file from win2000pro to XPpro.

There are no programs connecting to the internet while Im copying the file...

Does anyone know where there can be a problem.....


stars...

[gadgetguy]

How have you verified that "There are no programs connecting to the internet while Im copying the file..."?
Off hand, not knowing anything about your internal network or what software packages you're running on your computers, I'd say that you have a virus/trojan/etc. or a file sharing program running. When the modem is disconnected it just sends a periodic test to see if it's connected and once you connect the modem and it detects that the internet is available, (by reaching it's desired destination with the test), it starts going nuts.

I'm not really familiar with your router (it's not one of my favored brands), but many routers will indicate each devices traffic by making the lan port light blink. If yours does this, try only connecting one device at a time with the modem connected and see if you see "traffic". If you don't see any significant traffic with one at a time, try two at a time and do a file transfer between them and check the effect. Is it the same regardless of which two devices are connected?

There is also the possibility (far less likely), that the router is "leaking" internet traffic into your network. If you watch your modem, even when disconnected from your router, you'll probably see the internet light blink a lot. This is an indication of the internet traffic that is constantly bombarding your connection. All of that traffic is viewed by your router and either ignored, because it's not addressed to it, or it's passed through because it is. Most routers can be configured to pass more data than it should, but that's not normally how it comes by default and unless you've made some unusual changes, it's unlikely that it's configured that way. But it may indicate a failure on the router. You might try updating the firmware or trying another router (although I wouldn't go out and buy one until you exhaust other possibilities).

[stars]

Hi thanks for the answer...

I have leds that indicate which computer is "talking" to another computer or internet.

No activity there, no virus or trojans nor sharing program, the logg in the router indicates no activity.

The firewall is active and the logg tells me that there are some IP that tries to conncet to my IP address
via TCP or UDP. Even port scanning...

den 26 januari 2008 16:07:46 DHCP:renew
den 26 januari 2008 16:07:46 DHCP:ack(DOL=1200,T1=600,T2=1050)
den 26 januari 2008 16:09:53 Unrecognized attempt blocked from 45.138.210.72:30407 to xxx.xxx.xxxx.xxx UDP:1026
den 26 januari 2008 16:09:53 Unrecognized attempt blocked from 45.138.210.72:30407 to xxx.xxx.xxx.xxx UDP:1027
den 26 januari 2008 16:17:47 DHCP:renew
den 26 januari 2008 16:17:47 DHCP:ack(DOL=1200,T1=600,T2=1050)
den 26 januari 2008 16:19:59 Unrecognized attempt blocked from 64.181.224.162:30407 to xxx.xxx.xxx.xxx UDP:1027
den 26 januari 2008 16:19:59 Unrecognized attempt blocked from 64.181.224.162:30407 to xxx.xxx.xxx.xxx UDP:1026
den 26 januari 2008 16:24:16 Admin from xxx.xxx.xxx.xxx login successful


This is noting unusual it happens every time and the firewall stopps everything...

The firmware is the newest....

I have noticed that if I copy a file from the XP computer to the win2k computer there is no difference, but the other way its a difference in speed. the win2k computer have SP4 and I there is an update for that one so I will try to update. But the strange thing is that everything have been working fine until now...

I will do some more testing and come back


regards

stars...

[gadgetguy]

I have noticed that if I copy a file from the XP computer to the win2k computer there is no difference, but the other way its a difference in speed.

Does this behavior change when the modem is connected/disconnected?

[stars]

Hi...

XP --> win2k The speed is always the same (OK) when copying files.

win2k --> The speed is OK when the modem is disconnected, very slow when connected.

I have updated the win2k computer with SP4 update 1....no difference

I think there can be a problem in the win2k computer.

so if I dont find the problem the only thing to do is to disconnect the modem when Im doing a big transfer
between the computers...no big deal..

regards

stars...

[gadgetguy]

What AV software are you using?
Is is the same in both computers?
When was the last time they were updated?
What happens when you use the Linux computer with others one at a time?

[stars]

Sorry what do you mean with AV software I dont understand...

Well the linux computer is a sort of comuter its a Dreambox 7000S, sat reciver
and I share a hdd on my XP computer for movie recordings.

I also use ftp to transfer programs and other suff to the Drembox.

The Dreambox does not connect it selfe to the internet.

The response time from the XP computer is slower then usall (while recording) but
I think this is not the problem. It could be the software Im using...Old firmware and new softcams.

stars...

Edit....

AV = Antvirus software...

XP f-secure updated

win2k clamwin updated

The AV software is only activated when needed.

XP is clean no programs taking any cpu resources (more then normal)

win2k is clean no programs taking any cpu resources (more then normal)

Sometimes ago I had another slow speed problem and the problem was solved by replacing the
lan card in the win2k.....Today I have even changed the PCI slot.


stars...

[gadgetguy]

Sorry what do you mean with AV software I dont understand...

...AV = Antvirus software...

Bingo

XP f-secure updated

win2k clamwin updated

Never heard of either of them. Don't know whether they're good or bad.

The AV software is only activated when needed.

What does that mean? AV is needed whenever you're connected to the internet or installing software, and to a lesser extent, whenever you're connected to another computer (depending on the amount of control of and faith you have in the other computer).

XP is clean no programs taking any cpu resources (more then normal)

win2k is clean no programs taking any cpu resources (more then normal)

It doesn't really take much CPU resource to saturate a network with traffic, but it's looking less and less like it's a network saturation issue.

Sometimes ago I had another slow speed problem and the problem was solved by replacing the
lan card in the win2k.....Today I have even changed the PCI slot.

A lan card problem is very possible, but nothing you've told me so far narrows down which computer might be at fault. You seem to be concentrating on the W2K PC, but it could just as easily be the XP.

[stars]

Hi..

f-secure is a Finish antivirus program a very good one..

Clamwin is a freeware antivirus program look at sourceforge

I only activate the AV program when I downloaded files or on untrusted sites. The AV program takes to much
CPU power (I think) The computers in my network have only a limited access to each other.

I will look deeper into this problem tomorrw and I thanky you very much for your help.

regards

stars....

[stars]

Finally I think I have solved the problem....

The big problem was the AV program f-secure and its addon program f-secure backweb.

The program fetches AV updateds every hour or so and connect its selfe to
f-secures server. How its done I dont know but even if the computer was turned off
the router indicated that the program was trying to update strange...

Well it after some testing and looking around on the internet I was that the AV program
f-secure had lots of problems... the problem here was the every time the program
tried to connect th the AV server the DHCP in the router renewed....every 15 sec...

No wonder the LAN speed was low..

Finally I uninstalled the f-secure backweb program on both computer and restarted the network..

And now every thing works fine... well the LAN card in the win2k PC only
works at 100mbit half duplex but ist OK (Its an old card)


stars....

[Nelson37]

F-Secure has been around a long time but I was never very fond of it. The backweb feature I remember as being very problematic.

It is one of those programs that I don't immediately remove on sight, but if there is anything at all funky going on it is one of the first to go.

As far as trying to update with the PC turned off, not possible. No chance, no how, no way. Either it is installed on another PC on your network or the PC was not turned off but hibernating. Pretty sure F-Secure runs as a service, not a program.

[neomaine]

I agree with Nelson37 on the AV software. I bounced back and forth between AVG Free and Avast but have stuck with Avast the last couple of years. Been very happy. I'd also recommend Ad-Aware 2007 and the latest (1.5?) Spybot S&D to round out your protection. I've used them as well on all my home PCs, and those I work on, and haven't had any problems.

They are all free. Avast will update its program and virus database as needed (definitely not every 15 minutes...). Spybot has manual updates but great immunization database and TeaTimer available to protect from unwanted registry changes and Ad-Aware is fully manual but will clean up 95% of crap. I find the Ad-Aware/SpyBot S&D a good 1-2 punch. Both have paid automatic updates.

[DarrellS]

Backweb has been known to be spyware for years.

[stars]

Thanks all for the replies...

I have now removed all f-secure software from all PC....


The strange thing is that the DHCP renw every 10 min is this normal ???

stars...

[stars]

Well I have finally solved the problem....by replacing the router..

The SMC Barricade I had was acting very strange especially the DHCP and the
transfer speeds droped to very low levels. The router is about 4 years old so it have done its time.

It also have been reports about problems with highspeed ADSL connections above 8Mbit and
strange things happing with the DHCP.

The firewall dosent isnt really use Stateful Packet Inspection (SPI) this is only done togheter with Zone Alarm.

So I figured out that that all my computers cannot be wrong so it must be something with the router.

I went for a more " high end " router a Linksys (wierd, because I dont like all the radio signnals streaming around).

I connected all the cabels configured the router and the whole system was running at full speed..

The SMC router cost about 20eur and the Linksys router 200eur....

So you will get what you pay for (hopefully)

stars....

[Nelson37]

A good example of why DHCP should be avoided on small networks. No advantage whatsoever, and numerous, multiple possibilities to negatively affect performance.

Internal static IP's would have eliminated the problem and possibly saved you a few shekels.

[JohnnyMalaria]

Nelson37 - out of curiosity, is there a simple means to configure a laptop to be static at home on a WLAN but use DHCP at a different location where it joins a very large domain? Or even at your local coffee shop?

[Krispy Kritter]

Nelson37 - out of curiosity, is there a simple means to configure a laptop to be static at home on a WLAN but use DHCP at a different location where it joins a very large domain? Or even at your local coffee shop?

You would have to change it each time. But your static IP information should still be retained, just not used, when you choose the DHCP option.

[Nelson37]

Some wireless softwares let you use different profiles, but for most you gotta flip the switch on and off.

You need it for big nets but for smaller ones DHCP is just one more unnecessary failure point. Usually I'm mostly wired or fixed in place with only one or two mobile units, so I usually set it on for the laptops which leave the building often. But for wired or non-mobile units, static IP all the way.