I have a small business network (192.168.10.x/24) with a pfSense firewall (about 20 hosts: mix of Windows, Macs and Linux machines and printers...). The ISP modem from the WWW connects to the firewall which connects to a 16-port switch, and all the workstations/servers/printers connect to other switches downstream. All the switches (except for the hidden, because I'm not sure) are Netgear ProSafe (5-, 8- and 16-port) gigabit switches (unmanaged).

What I'm trying to accomplish are two things:

First, if someone is streaming video or up/down-loading a large file through the Internet, this bogs down the entire network, so I'd like to set it up so this doesn't affect others on the network.

Second, if someone transfers a large file to/from a file server on the LAN (not through the Internet), this also bogs down the network, so I'd also like to set it up so this doesn't affect others on the network.

A common use case is like this: I have one user uploading files to a file share service on the web (via HTTP/HTTPS) and another user accessing an Apache web server on the subnet (on 192.168.10.x) and the user on the subnet accessing the web server sees really slow responses for the web app (to the extent that sometimes it times out). When the file is done, accessing the web server is normal again.

One additional side-question that has been bothering me... If I have a layer-2 unmanaged switch and it stands in the way of two workstations or servers that communicate with one another, am I correct in my understanding that the switch will log the MAC addresses and route traffic without contacting the firewall?

I should note as well that the speeds I usually see with a speed test are:

60 Mbps down (+/- 5 Mbps)
12 Mbps up (+/- 3 Mbps)

Here is a diagram of the network in question:

enter image description here

In this case, the hidden switch doesn't come into play. I'm running tests now and the loop is from a host on the left side of the diagram to the right side.

Thanks for the feedback on this question. I was hoping to get some more concrete feedback, but I suppose since this is a tricky question, more troubleshooting is in need.

Regarding gear... I've been considering a managed switch. I see that Cisco has some 10-port gigabit managed switches for under $200, which seems reasonable to me.

My question is would it help to replace the 16-port unmanaged switch with a 10-port managed switch? I know that this would allow for better troubleshooting in the future, but would it also help me bottleneck issues?

  • It sounds like you have some other problem - a large file transfer shouldn't bog down your entire network. Can you post a diagram of your setup? Jan 14, 2015 at 17:19
  • EDIT: This "Hidden switch" that you're unsure of - what devices are downstream from that switch? Jan 14, 2015 at 19:12
  • Also, that "5-port switch": What make/model is that? Jan 14, 2015 at 19:16
  • The 5-port is a Netgear gigabit as well, but the hidden and 5-port aren't in play here. See edits in question. Jan 14, 2015 at 19:35
  • 1
    Without a managed switch to see things like errors on ports or other funky problems that might be happening, your troubleshooting process will simply boil down to process of elimination, attempting to find which paths thru your network suffer the issue and which paths do not. Jan 14, 2015 at 19:49

1 Answer 1


Not all together happy with how this post turned out, but I've learned things that I didn't know before, so that's good.

For example, normally if two nodes (A and B) are connected to a switch which is on the downstream side of another device like your firewall, the switch will route packets from A -> B and vise versa without contacting anything upstream (from @Tedwin).

I decided to post my own answer with the good parts from the comments with @Panther Modern.

  • Use higher quality hardware. Since I'm using Netgear ProSafe unmanaged switches, I'm considering upgrading to something like Cisco. @Mike Pennington suggested the SG300 series, which I have researched before and found on Amazon for less than $200. @Panther Modern suggests Arista, Cisco, Juniper and Brocade switches.

  • Troubleshoot each piece independently and isolate the problem. I've done some of this, to the extent that I have isolated the general path, but in an environment where 100% uptime makes people happy and allows them to get work done, this can be tricky. But point taken...

  • Consider topology and where you have access to and how many users you have. These factors can influence your choices for gear and how you go about answering your questions.

  • Find good networking tools and use those to help troubleshoot your issue. pfSense helped a lot concerning traffic that passed through the firewall. I also learned about Robocopy for limiting traffic on the client. This tool works pretty well.

  • It might be worth the time to ask a new question about redesigning your network Jan 22, 2015 at 0:47
  • On your first comment - totally agree. I said 100% because that is what they "wish" they could. I monitor several web servers as well and the best are only 99.99% up. I guess my point was it's hard to take down pieces of the network for troubleshooting with my users needing uptime. But the pain with the existing issues is pretty bad too. Second comment: I like this suggestion. Briefly, are you talking more wish list hardware, or physical versus logical design? Or both? Could you assist me in answering this question? As I stated in the comments, I'm somewhat limited in what I can do. Jan 22, 2015 at 0:55
  • @Mike Pennington - Shall I write the question or shall we try and schedule a quick chat? Jan 23, 2015 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.