Strange Slowness on hub

[business.kid]

I'm on iol.ie, speed check (Mon morning) is 1.75Mbps/211kbps on a 512/128 line. There is a prestige 623 modem and a Dynamode 8 Port10/100 hub model SW80010-D with 3 boxes going out, one linux and 2 XP machines. This seems to back up at times, mail fetches time out and the net is not accessable. At these times, some pc and the hub output blink rapidly - like it's fetching zillions of one byte packets.
I have linked it to firefox, but when I kill that, it doesn't stop. Kill everything, and it _eventually_ goes away

Any ideas how to find out what's going on or sort it?

Thanks for any ideas, Business.kid

[blacknight]

Have you tried running tethereal on the linux box to see what's actually going in / out?

[business.kid]

Thanks for the reply.
I haven't run tethereal, but will do when things are good & bad. I also found one box is only giving a 10MB link, so I'll fix that first.
Any suggestion for the options to tethereal?
how about 'tethereal -t text -w <somefile.txt>'?

[business.kid]

It turned out one box was only doing 10Mb/s. A switch of nic sorted that and we'll see how it goes. I think this box gaming (which sends tiny packets continuously) may have been my problem.

Thetereal was confusing to put it mildy. Here's a chunk. Any comment? My linux box is 192.168.1.33; modem is 192.168.1.1 (dhcp server side) and 194.125.98.238 from the ether(under pppoe). BTW, http://73.32.78.211 times out here in a browser :-o

5.193491 192.168.1.33 -> 72.32.78.211 ICMP Destination unreachable (Host administratively prohibited)
5.198044 72.32.78.211 -> 192.168.1.33 TCP [TCP segment of a reassembled PDU]
5.198082 192.168.1.33 -> 72.32.78.211 ICMP Destination unreachable (Host administratively prohibited)
16.098542 72.32.78.211 -> 192.168.1.33 TCP [TCP Retransmission] [TCP segment of a reassembled PDU]
16.098599 192.168.1.33 -> 72.32.78.211 ICMP Destination unreachable (Host administratively prohibited)
30.000931 192.168.1.1 -> 192.168.1.255 RIPv2 Response
30.211723 192.168.1.33 -> 194.125.2.240 DNS Standard query AAAA Yahoo! GeoCities: Get a free web site with easy-to-use site building tools
30.241076 194.125.2.240 -> 192.168.1.33 DNS Standard query response CNAME geocities.com
30.241645 192.168.1.33 -> 194.125.2.240 DNS Standard query A Yahoo! GeoCities: Get a free web site with easy-to-use site building tools
30.257597 194.125.2.240 -> 192.168.1.33 DNS Standard query response CNAME geocities.com A 66.218.77.68
30.265146 192.168.1.33 -> 66.218.77.68 TCP 33091 > http [SYN] Seq=0 Len=0 MSS=1460 TSV=4115241 TSER=0 WS=2
30.449746 66.218.77.68 -> 192.168.1.33 TCP http > 33091 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1400 WS=1 TSV=583421721 TSER=4115241
30.449829 192.168.1.33 -> 66.218.77.68 TCP 33091 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=4115425 TSER=583421721
30.450208 192.168.1.33 -> 66.218.77.68 HTTP GET / HTTP/1.1
30.654795 66.218.77.68 -> 192.168.1.33 HTTP HTTP/1.1 301 Moved Permanently (text/html)
30.654857 192.168.1.33 -> 66.218.77.68 TCP 33091 > http [ACK] Seq=472 Ack=394 Win=6912 Len=0 TSV=4115630 TSER=583421742
30.655151 192.168.1.33 -> 66.218.77.68 TCP 33091 > http [FIN, ACK] Seq=472 Ack=394 Win=6912 Len=0 TSV=4115631 TSER=583421742
30.655599 66.218.77.68 -> 192.168.1.33 TCP http > 33091 [FIN, ACK] Seq=394 Ack=472 Win=66624 Len=0 TSV=583421742 TSER=4115426
30.655636 192.168.1.33 -> 66.218.77.68 TCP 33091 > http [ACK] Seq=473 Ack=395 Win=6912 Len=0 TSV=4115631 TSER=583421742
30.659087 192.168.1.33 -> 194.125.2.240 DNS Standard query AAAA geocities.yahoo.com
30.696878 194.125.2.240 -> 192.168.1.33 DNS Standard query response CNAME home1.geo.vip.scd.yahoo.com
30.697256 192.168.1.33 -> 194.125.2.240 DNS Standard query A geocities.yahoo.com
30.712667 194.125.2.240 -> 192.168.1.33 DNS Standard query response CNAME home1.geo.vip.scd.yahoo.com A 66.218.77.78
30.712986 192.168.1.33 -> 66.218.77.78 TCP 33092 > http [SYN] Seq=0 Len=0 MSS=1460 TSV=4115689 TSER=0 WS=2
30.889303 66.218.77.78 -> 192.168.1.33 TCP http > 33092 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1400 WS=1 TSV=409604381 TSER=4115689
30.889377 192.168.1.33 -> 66.218.77.78 TCP 33092 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=4115865 TSER=409604381

[blacknight]

tethereal is handy
You just need to look at a specific IP, so you could do something like:

tethereal|grep IPIWANTTOLOOKAT

Obviously you'd replace the IPIWANTTOLOOKAT with the IP address you were interested in...
A lot of the stuff you pasted is DNS lookups, but you can also see why that IP times out in a browser

[business.kid]

Thanks for that. With all boxes on 100MB, I am having much fewer issues, but evolution still times out on mail fetches. I suspect the isp there. I had a Realtek 8029 nic in one box, sold as 10/100Mb/S, but it only wanted to do 10 :-/. Boy I hate XP!
I have no clue which administrator is forbidding 72.32.78.211 (assigned to rackspace.com, sub assigned to Shamrock Inn). Esat/iol/BT?

Thanks for the pointers.

[business.kid]

Well I have managed to run down a selection of issues now. Here they are in no particular order.

1. 1 box was only doing 10MB/s into the (cheapo) hub. It seemed to slow things.
2. An apparent reluctance on the part of iol.ie to resolve pop.iol.ie. I imagine the correct setting was gpo.iol.ie. Tethereal showed I was getting "Try gpo.iol.ie" once, and yet the question was asked a number of times, the second one timing out.
3. I had an NTL dns server in /etc/resolv.conf, and was getting the middle finger from that, which is typical of ntl.
4. The box seems to be alternating between dns1 and dns2 with queries. As I was getting rude remarks from one, it might explain poor dns!

With so much crap there, I am left wondering how it ever served up anything!