Recently, a friend asked me to help him determine what was up with a T1 to a remote office. The link felt sluggish, videoconferencing was suffering, and users were complaining about server and client slowness. Using ntop, MRTG, and Etherpeek NX, we determined that the link was 100% saturated, 24/7, with extraneous traffic. Workstations had mounts to filers on the other side of the T1, all development (i.e. user- Recently, a friend asked me to help him determine what was up with a T1 to a remote office. The link felt sluggish, videoconferencing was suffering, and users were complaining about server and client slowness.Using ntop, MRTG, and Etherpeek NX, we determined that the link was 100% saturated, 24/7, with extraneous traffic. Workstations had mounts to filers on the other side of the T1, all development (i.e. user-controlled) *NIX servers had hard NFS mounts across the link, with fsck options ‘1 2’, not ‘0 0’, users were storing files on the remote filers, leaving the local filers dormant, etc. etc. It was rather enlightening, but also infuriating. This problem is like the hydra; when you stop one offender, another pops up, and they’re all complaining about the network performance.There was only one thing to do; track down the users and change their ways. It’s always easier to change the infrastructure than to change the users, but sometimes you need to crack the whip.