Slow web connectivity for a single user

[TrevorBradley]

I've been working at this problem all day, and I'm stumped and thought that asking here (and perhaps writing everything out) might help.

I do contract work for a medium sized business. I've built a website that's access by employees on and offsite, and hosted here in Canada on Shaw Cable Business Internet. The server is sitting behind a Cisco Meraki firewall. One of our managers is offsite in Iowa. A few days ago she pointed out that the website was woefully slow.

I gained remote access to her machine and verified that loading the website was dreadfully slow, taking 2-3 minutes on pages that loaded in 2-3 seconds here.

I tried a test. I created a random 3MB file and distributed it to a number of places and built a number of scenarios, downloading the file over HTTP with wget and testing the speed..

Surrey (Onsite) -> Surrey (Onsite): >1MB/s
Surrey (Onsite) -> Surrey (My home Server): 700KB/s
Surrey (Onsite) -> Iowa: ~5-15KB/s, sometimes stalling to a complete stop.
Surrey (Onsite) -> Iowa (Someone in the same neighbourhood on the same ISP): FAST(er), I don't have exact numbers.
Surrey (My home server) -> Iowa: 500KB/s
California (Linode) -> Iowa: > 1MB/s
Surrey (Onsite) -> California: > 1MB/s

This seemed crazy, the slowdowns were occurring specifically with this particular server and this particular client. I did some more tests: Placing a new web server outside our firewall but still onsite: FAST, but given a DHCP IP address and the routing was different. Moving that same server inside the firewall and using port forwarding (SLOW). Downloading from another onsite static address via the firewall: SLOW. Using sftp instead of http: SLOW.

The slowdowns are odd. Sometimes the transfer stops entirely, other times it can speed up to as fast as 25KB/s.

The scenarios running through my head:

1) Something on the firewall is blocking connectivity to this specific IP address
2) Something on our ISP is slowing down traffic to static addresses.
3) Something on the client machine is slowing down traffic to our server IP (except it's happening on two different IP's inside our network).

1) Appears most likely, but as best we can tell there's no setting on the server that would be causing this.

2) Sounds almost impossible to diagnose.

3) Sounds unlikely, as it's happening with two static IP addresses.

One other thing - we ran wireshark on the firewall on the server side - it reported duplicate ACKs, as well as ACKs for packets that were never sent.

As an interim measure for this one manager, I've set up a SOCKS proxy so that all their firefox traffic can route through our Linode cloud server, but this isn't a long term solution.

Any ideas on how I should continue to diagnose this?

 

[-RockMan-]

I've been working at this problem all day, and I'm stumped and thought that asking here (and perhaps writing everything out) might help.

I do contract work for a medium sized business. I've built a website that's access by employees on and offsite, and hosted here in Canada on Shaw Cable Business Internet. The server is sitting behind a Cisco Meraki firewall. One of our managers is offsite in Iowa. A few days ago she pointed out that the website was woefully slow.

I gained remote access to her machine and verified that loading the website was dreadfully slow, taking 2-3 minutes on pages that loaded in 2-3 seconds here.

I tried a test. I created a random 3MB file and distributed it to a number of places and built a number of scenarios, downloading the file over HTTP with wget and testing the speed..

Surrey (Onsite) -> Surrey (Onsite): >1MB/s
Surrey (Onsite) -> Surrey (My home Server): 700KB/s
Surrey (Onsite) -> Iowa: ~5-15KB/s, sometimes stalling to a complete stop.
Surrey (Onsite) -> Iowa (Someone in the same neighbourhood on the same ISP): FAST(er), I don't have exact numbers.
Surrey (My home server) -> Iowa: 500KB/s
California (Linode) -> Iowa: > 1MB/s
Surrey (Onsite) -> California: > 1MB/s

This seemed crazy, the slowdowns were occurring specifically with this particular server and this particular client. I did some more tests: Placing a new web server outside our firewall but still onsite: FAST, but given a DHCP IP address and the routing was different. Moving that same server inside the firewall and using port forwarding (SLOW). Downloading from another onsite static address via the firewall: SLOW. Using sftp instead of http: SLOW.

The slowdowns are odd. Sometimes the transfer stops entirely, other times it can speed up to as fast as 25KB/s.

The scenarios running through my head:

1) Something on the firewall is blocking connectivity to this specific IP address
2) Something on our ISP is slowing down traffic to static addresses.
3) Something on the client machine is slowing down traffic to our server IP (except it's happening on two different IP's inside our network).

1) Appears most likely, but as best we can tell there's no setting on the server that would be causing this.

2) Sounds almost impossible to diagnose.

3) Sounds unlikely, as it's happening with two static IP addresses.

One other thing - we ran wireshark on the firewall on the server side - it reported duplicate ACKs, as well as ACKs for packets that were never sent.

As an interim measure for this one manager, I've set up a SOCKS proxy so that all their firefox traffic can route through our Linode cloud server, but this isn't a long term solution.

Any ideas on how I should continue to diagnose this?

Have you thought about performing a pathping command to host client with the low internet speed ?
Test Network Connection with Ping and PathPing
Also I maybe wrong on, but check out what type of internet connection has with os and router.
Run a PathPing analysis to a remote host to verify that the routers on the way to the destination are operating correctly.
pathping < IP address of remote host >

Also if you don't mind me asking, what port are you using behind your cisco firewall ?