Daily internet slowness

[Deetee3]

Hi everyone,

For the last few weeks our office has been experiencing occasional internet slowdowns throughout the day. Usually once or twice during the day and will last about 15 to 30 minutes. Each time we see that the network usage spikes really high causing the entire network to slowdown or not load anything (wired and wireless). I wanted to see if anyone had some advice on where I should start my troubleshooting. Are there any logs available to find out what devices may have caused this? 

I figured Global bandwidth limits would help, but it didn't. (20mbps with speedburst enabled)

Some information on our office setup
2x MX84
5x MS120-48LP
4xMR33
3xMR36
Users in office are between 150-200 and most are connected to Ethernet.

Utilization graph from our ISP.

[Brash]

If you have a syslog set up, I believe you can extract more details in regards to what traffic is passing through the MX.

Does the issue correlate with any update cycles for devices? Eg. Windows or office laptops. You could take some captures on the MX WAN port and see if there is a large amount of traffic coming from a single device or going out to a single IP address 

[Ryan_Miles]

Does this occur when a peak number of users/devices are active? It's possible with 200 users you're hitting the session max capacity of the MX84 (31,250).

I've seen offices with similar numbers of users (and perhaps guest devices too) that hit the session/flow limit and at that point connections are dropped or not initiated.

I would call into Support when this occurring so they can verify the utilization on the MX84.

[Deetee3]

Yes. This does usually occur during peak hours. Peak number of users/devices is usually during a 5 hour time span and it does happen during that window. I can contact support when this is occurring again.

[AMP]

I agree with @Ryan_Miles. There is a clear spike in traffic but does that spike correlate with the time of slowdown? The graph shows 4am. Are there server backups happening or software downloads scheduled to happen at this time of slowdown? You can use the network-wide>clients page to track down any abnormally high usage users as well. Plugging directly into ISP with a laptop and running a speed test and then plugging into MX running a speed test could be helpful as well. Theres likely to be a drop in those speed tests going from the MX but can help isolate to whether the issue is on ISP side or your side. Preferably use iperf to speed test but a browser based one can give you good baselines as well.
https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Troubleshooting_Cl...

[PhilipDAth]

My go-to method is to take a packet capture (say 5 minutes in your case), and then run it up in WireShark.  Use some of the IO tables to see what the biggest sends/receivers are and what protocols are being used.

[BlakeRichardson]

Does the graph correlate to workers starting their shift? Have you looked in your dashboard so see if any one device is using large amounts of bandwidth during this time. I would setup a daily summary report for that Meraki network and see who your top devices are and if they are sending a lot more traffic than everyone else. 

If you could describe more about the environment that would help i.e. is it a call centre and the spikes happen during shift change for example?