Imagine that one afternoon you start getting phone calls from users complaining of extremely slow network response time. You aren't doing anything out of the ordinary that might cause things to run slowly, so you decide to get out the protocol analyser and investigate the problem. When you do, you discover a flood of packets coming from one specific PC. The question now is, why?
On one hand, there are lots of different hardware problems that can cause a slowdown. I've seen malfunctioning network cards just spew out an endless stream of junk packets. I've also seen PCs connected to faulty network cables that generate excessive retry packets. On the other hand, the user of the PC in question might be doing something disruptive or may have even picked up some sort of Trojan that's designed to flood the network with traffic. So how do you tell the difference?
One way is to pick up the phone and ask the user what he or she is doing right now. There's a slim chance that the user will say something like, "I'm emailing a 50MB video file to 500 friends." More than likely, though, the user won't tell you anything useful. Even so, I still recommend making the phone call because, if the user is doing something disruptive, he or she might stop after you hang up the phone -- for fear of being caught. This saves you from having to investigate the problem.
For this article, let's assume that the user tells you that nothing unusual is going on, and that the strange behaviour doesn't go away after you hang up the phone. How do you figure out what's really happening?
