1

I am trying to diagnose a routing failure or a network hardware problem between some computers. I need to monitor network bandwith over time to see if I get any intermittent dropped network connections or anything like that.

My best idea so far is to use IPerf.exe and run it between the Windows Servers. Any better idea?

djangofan
  • 4,172
  • 10
  • 45
  • 59

2 Answers2

2

Sounds like you don't know if this is a network failure or a routing (or communication) issue. Wireshark might help you in finding out if this is a communication issue. To know if this is a hardware failure due to high amounts of bandwidth, or types of high traffic communication between the servers, then iPerf might be able to help you there. However, iPerf does not show you statistics on other traffic, it only reports on it's own tests up and down the stream. For that I suggest mtr (linux) or winmtr (windows) to measure possible latency issues, packet loss, high jitter as wells as other useful data between hosts.

Wireshark: alt text
(source: ostatic.com)

MTR or WinMTR: alt text
(source: googlepages.com)

Glorfindel
  • 1,213
  • 3
  • 15
  • 22
l0c0b0x
  • 11,697
  • 6
  • 46
  • 76
  • +1, wireshark rules (although i usually capture with `tcpdump` and analyze with wireshark, no need to run any GUI tool as root) – Javier Dec 12 '09 at 00:47
  • I would have also recommended tcpdump (as I use it a lot with a combination of wireshark, as the latter gives you a more in detail view of each packet), but looks like the question was for a windows environment solution. – l0c0b0x Dec 13 '09 at 17:05
  • the newer wireshare has a command line runner as well... no need to use tcpdump. – djangofan Dec 14 '09 at 16:51
0

If you want to go the network monitoring route, you should monitor at the router level via SNMP. Cacti is one open solution, but there are others.

That said, network monitoring may tell you when you're having a problem, and if one of the intermediate devices is overloaded, but if this is a local network situation and your equipment is modern, those are unlikely to be the problem.

The Wireshark/tshark route can help if you can reasonably guess a window during which the problem will occur, or if you can induce a failure. If you can't repro the problem that reliably, I'd focus on getting the repro so that you can use wireshark or the equivalent to diagnose the problem.

Jon Lasser
  • 960
  • 5
  • 7