Network slows down at 5 pm?

Question

I have a Win2003 Server network using domain, dhcp, active dir, with linksys 18 port 10/100 switch and a dozen winxp pro clients. There is a huge network slowdown around 5 pm causing freezes and slowdowns and occasionally crashes. It doesn't seem to be related to any software we're running as different people use different software. All machines are patched and updated, have top of the line components, and are relatively new. Any advice would be much appreciated. Thanks in advance.

I'm the only admin and backups and scans occur occur at 9 pm. There are only 4-5 people left at the office and not all of them working on their PCs at around that time. They all leave at different times so usually only one computer at a time is being shut down. This problem has stumped me for weeks and I can't find the answer anywhere!

Answer 1

You've got several potential issues, many of which the others here have addressed.
1. Multiple users logging off can cause a slowdown, as prevously mentioned. But only a dozen users? Not likely.
2. Do you have DFS enabled? If someone is closing out a massive database at 5 and DFS has to replicate, that could hit your bandwidth pretty hard. But in a small business? Also not likely.
3. Intermittent hardware failure. A switch/router going bad can cause intermittent problems that are hard to trace. But regularly at 5 pm? Again, not likely.
4. Bad NIC on the server. We've had problems with the built-in Intel Gig Nics on some of our server motherboards. Though the NIC is "automatic", we've seen terrible performance connected to a 10/100 network. Changing the NIC from auto to 10/100 sometimes helped, sometimes not. Replacing the NIC with another did solve the problem. However, the slowdown was constant, not just at a specific time. NICs are cheap and easy to try as a fix, but this is also unlikely.
5. Denial of Service attack. As he goes home for the evening, some hacker is pushing a button to crash your network on a daily basis. Either from inside or outside your organization.
I assume you've used performance monitor to monitor your network traffic through the server. Are you getting a big hit around 5 PM on your server's network interface? If the hit on performance is at your server, then SOMETHING unrelated to your business function is banging it pretty hard. It could be a deliberate attack, a rogue program installed unintentionally, or something misconfigured. If the problem's at your server, then trace where the network traffic is coming from. Then you'll have your culprit. Single system-- rogue program/attack. Internet--attack/rogue program on server (check processes in task manager). Multiple systems-- misconfigured server system.
6. If the hit is not at your server, do you have the ability to monitor your network traffic in promiscuous mode, particularly your internet connection? If not, the culprit will be hard to trace. It's probably someone with a peer-to-peer file sharing program (like Limewire). I'd throw another NIC in the server and route all network traffic through it. Then you can monitor your network traffic without promiscuous mode capability. Trace where the network traffic is coming from/going to, and find your culprit.

Answer 2

I had similar problems on a Win 2000 Server. Specifically 2 causes:
1: a rogue admin was running a Peer2Peer software, that had a time controlled bandwidth throttle. At 5 o'clock it would use the full bandwidth, as he thought after work it would not matter.

2: At 5 o'clock when all users log off to go home, Windows XP in conjunction with Windows 2003 Server copies everything in the "Documents and Settings\[User name]" of the logged in User to the windows 2003 Server (with the exception of the "Local Settings" folder)
So if all your users finish work at 5 and log off, all computers try to save their data on the server. And depending on the mass of files this slows it down.

Answer 3

You're probably going to need to put a sniffer on your LAN to locate the culprit.

What is slowing down? Client to server? Client to client? Internet access? Any indications from the activity lights on the switch?

Look in Task Manager and see if you see anyting spiking on the server when the slowdown occurs.

Disconnect all clients from the network. Reconnect them one at a time to see if you can localize it to a client, possibly infected with a virus, spyware or trojan.

Make sure that all network hardware and servers are on UPSs and that the batteries are good.

Port scan your network. Look for any rougue machines, wireless access points or routers, etc.

Answer 4

Maybe 5 pm is a significant time that many people log on, load, power on, access something or whatever all at the same time. Do you have a backup system set to run at 5pm? It may be killing you. Norton or something set to run at 5? Find out what 5 pm has to do with it, and you'll find your overload.

Answer 5

A lot more people go online at about this time after leaving work or school so the system gets a little clogged up,the best time i find is about 2am when most people are in bed.

Answer 6

The users stop doing work and start surfing, downloading or swapping music and video files. Maybe just burning dvd accross the network

Answer 7

like another posters pronounced, it quite is a bandwidth subject led to by: A) each physique is getting abode from artwork and logging onto the internet, and your ISP (cyber web provider provider) is in simple terms too taxed on your section to offer you the bandwidth you're paying for... or: B) somebody knows the password on your router.