Users say "the network is slow". How do you approach it?
Show the answer
Say this first
"Slow" needs a number and a scope first: which application, which users and sites, since when, and slow how (page loads, file copies, call quality, logins). Then I split it: one app slow for everyone points at the app or its server, one site or path points at a link, congestion or errors, and everything slow points at a shared service like DNS or the internet edge. I check utilization, errors and drops along the path, latency and loss with mtr, and then capture to separate network time from server time.
Go deeper
Turn the complaint into a measurement
- What is slow, for whom, and when? Compare to a baseline: "the CRM normally loads in 1 second, now 6".
- Every app or one? Every user or one site? Wired and wireless?
- Constant, at certain times of day, or random?
Where the time usually goes
| Symptom | Look at |
|---|---|
| Everything slow from one site | WAN or internet link utilization, drops, errors at that site |
| One app slow for everyone | the app server, its database, its load balancer |
| Only wireless users | channel utilization, retries, signal, AP load |
| Slow to start, then fine | DNS, authentication, proxy discovery, connection setup |
| Big transfers slow, small ones fine | window size and RTT, MTU, a policer, loss |
| Slow at 9 a.m. or during backups | congestion; check the graphs |
Tools
- Monitoring: interface utilization and drops, NetFlow or IPFIX for top talkers.
- Path:
mtrorpathpingfor latency and loss per hop. show interfacesalong the path: errors, output drops, rate against bandwidth.- A capture at the client: handshake time compared with time to the first response byte.
They will ask next
The WAN link is at 95 percent every morning. What do you do?
Find out what fills it with NetFlow, then decide: schedule or move bulk traffic, apply QoS so voice and interactive apps stay protected, or add bandwidth if the growth is real. QoS does not create capacity; it decides who waits.
Traps
- Buying bandwidth before measuring. If the real cause is a slow server, a bigger circuit changes nothing.