Network Monitoring Options?

Nom du Keyboard asks: "We have a LAN network of 7 servers and about 400 PCs. Every so often I'll notice immense slowdowns, from minutes to occasional delays of a couple hours, while getting data from various servers, and it happens from more than just my PC. So far we haven't had any way of determining if a server has suddenly gotten tied up, or if there is some failure in the communications backbone. Without a lot of money to spend on this (I think it's more important than others right now), what cheap or free monitoring options are there available that can map and isolate problems in a network of this size?"

Comments

etherape

[Yonder Way]

Also, set up a mirror port on your switch and run "etherape" on a machine connected to that port. You'll get a real-time graphical representation of where the traffic is going on your network, and some indications of what kind of traffic you're looking at.

chatty windows machines

[macshit]

A bit off-topic, but I'm curious if anyone can answer this for me:

At work our network setup recently changed from static-IP based to DHCP based. I run a debian machine, and not all that much seems different for me, just that the machine gets its info from a server at bootup.

However, running various network sniffing tools shows that all the windows machines on the network have become insanely chatty -- every windows machine seems to be constantly sending out packets, regardless of whether they're actually doing anything or not. Given that there are hundreds of windows machines on the (ethernet) network, this means A Lot of Packets.

I find this quite annoying because it horribly clogs up the results if I run some tool to look at network activity (usually to see if something's wrong with one of my machines). I don't know if it actually degrades the network performance appreciably (the packet size seems to be fairly small), but I assume that having zillions of pointless packets getting sent can't be a good thing for performance on an ethernet...

Anyone know WTF those machines are doing? Is this some "feature" gone berzerk?

[I don't recall windows machines doing this in the past; although the change seems to co-incide with our move to DHCP, I suppose maybe it could also be due to people upgrading to newer versions of windows.]