"We pay for a 300 Mbps line and now a download runs at 300 KB/s. The carrier has been out twice and says the circuit is fine." On the morning of August 21, the office manager at a design firm in Wanbo, Panyu, was close to tears on the phone. A design studio lives on large files, where a single rendering runs to several gigabytes, so that speed means the whole company has stopped working.
That dispute, where the carrier says the line is fine and the customer says the network is slow, usually lands inside the LAN. We arrived with a cable tester, a laptop and a spare switch.
Step one: prove the internet link is fine
We connected a laptop directly to the LAN port on the egress firewall and ran a speed test. Downlink 295Mbps, 1ms to the carrier gateway, 0% packet loss. Everything from the internet to the firewall was normal, so the problem was inside. This step matters: Draw the line of responsibility with data first; that avoids wasting hours. looking in the wrong place.
Step two: read the switch LEDs, because a loop talks
Their network ran from the firewall to one Huawei S5720 core switch, then out to four TP-Link TL-SG1024D 24-port gigabit unmanaged switches, one per office area.
One look at the second office area was enough. Every port LED on that TL-SG1024D was blinking in frenzied sync. Under normal load each port blinks at its own random rhythm, following its own traffic. All ports pulsing at the same frequency is the classic signature of a broadcast storm. The chassis was hot to the touch.
Step three: capture traffic and settle it
We plugged the laptop into a free port on that switch and captured for 10 seconds with Wireshark. More than 80,000 packets, of which 96% were broadcast frames: ARP requests and frames addressed to FF:FF:FF:FF:FF:FF, with the source MAC hopping back and forth between a handful of office PCs. That is a loop. A broadcast frame arrives, gets copied out of every port, comes back in by another path, and amplifies without limit, eating the gigabit link and the switch CPU within seconds.
We followed the cable, and the explanation was mundane. During a desk move the previous week, an intern had a spare patch cable left over and plugged both ends into ports 12 and 18 of the same switch. An unmanaged switch has no Spanning Tree Protocol, so one loop turns it into a broadcast amplifier.
Step four: fix the design, not just the cable
We pulled the cable and the storm died within 10 seconds, with the whole network back to 295Mbps. But unplugging alone changes nothing structural, and sooner or later someone plugs it back in. We did three things:
| Remediation | What we did | Cost |
|---|---|---|
| Protection on the core switch | Enabled RSTP globally on the Huawei S5720, then set stp edged-port enable with stp bpdu-protection on the downstream ports, so a received BPDU shuts the port down and raises an alarm | Equipment already owned, configuration free |
| Replace the access switch | Three of the four unmanaged units stayed, for budget reasons. The critical second floor moved to an H3C S5120V3-28P with STP and loop detection | RMB 1,800 |
| Label ports and train staff | Every network port got a label, with uplinks marked in red: no workstation connections, and administration got a 15-minute briefing: nobody connects a cable without approval | Free |
When we retested that afternoon, all four areas measured above 280 Mbps. at the same time and switch CPU load fell from 100% to 12%. A follow-up two weeks later found everything normal.
Why unmanaged switches fear loops
A managed switch runs STP, the Spanning Tree Protocol, which discovers loops and puts one of the links into a blocking state, logically cutting the ring. An unmanaged switch has no STP and no loop detection, so a loop takes it down entirely. Our rule follows from that: any office with more than 20 network ports should have at least one managed switch at the access layer. Entry models from H3C, Huawei and Ruijie cost RMB 1,500-2,500, and that is not the line item to cut.
Troubleshooting a slow office, in order of hit rate
- Look at the switch LEDs. All ports blinking in sync means a loop or broadcast storm. One port blinking hard with no heavy traffic behind it is worth investigating.
- Speed-test at the boundary. Run a test from the LAN port of the egress device. If it is normal, the fault is inside; if not, call the carrier.
- Separate Wi-Fi from wired. If only wireless is slow and wired is fine, you are looking at channel contention or too many clients per access point, and the switch is not involved.
- Measure the broadcast share in a capture. In Wireshark, Statistics then Capture File Properties. If broadcast frames exceed 30%, suspect a loop or an infection., since an ARP virus will also generate a broadcast storm.
- Check the cable and the negotiated rate. A gigabit port that negotiates down to 100M half duplex will fall off a cliff, usually from an oxidized connector or a miswired pair. A cable tester tells you in seconds.
For design studios, e-commerce teams and live-streaming rooms, where the network is the production line, a full LAN health check is worth doing: topology mapping, loop risk points, a Wi-Fi coverage heat map and switch firmware versions. We run these on site across Guangzhou, produce a report, and charge RMB 500 for the diagnosis, which is deductible if you sign the remediation work. Call 020-39029800.