Bear in mind that if the router is also a switch you won't see all the traffic on a single port as the switch will learn what machines are on what segments and route the traffic accordingly. In fact you'll see very little other than broadcast traffic. I find the best thing to do is to get an old hub (not a switch) and place it between the router and the rest of the network, WLAN routers, etc. By connecting a machine to that hub and running wireshark you will see everything that goes out or in.
The fact that some connections work normally does make me wonder if it's a logical problem within the router (i.e. NAT table full, not accepting new connections) rather than the link being maxxed out.
You can also try running wireshark on your local machine and see what the symptoms are when you are getting poor connections. Are you getting "unreachable" responses, are packets getting dropped or is throughput just slow, etc?
I find wireshark is a good educational tool. You can read books about how networks work but there's nothing like seeing it in real time.
Kevin
Author
Topic: DoS Attack? (Read 1945 times)