Questions[network-speed](server)

I work as an I.T. consultant, and I often have to install various VPN clients on my computer in order to connect to customer's networks; beginning in March 2020, I started always working from home for well known reasons.

Until a couple months ago I had a 100 Mb/s ADSL Internet connection, thus I never noticed what I'm describing next; then I upgraded my connection to a FTTH 1Gb/s connection, which normally achieves 800-900 MB/s download speed and 100 Mb/s upload speed.

However, when I install some VPN clients, namely FortiClient and ForcePoint, something strange happens: my download speed gets capped at about 400 MB/s, even if no VPN connection is established and even if I kill all VPN-related processes and stop all related services; even if the VPN client software is not in use, and even is no process is running for it, my network connection still gets awfully slowed down; the only way to solve this is to completely uninstall the VPN client software.

At first I encountered this issue only with ForcePoint, but then I witnessed it again with FortiClient; no trouble occurred with other VPN clients, such as Cisco AnyConnect or CheckPoint.

Why is this happening? How can this happen, if the software is installed but not actually in use?

OS is Windows 10 21H1 x64, with latest updates.

Addendum.

This is not an isolated case on my PC, I have observed it on several different computers and it has been reported by other people using the software I mentioned; this seems to be an issue related to installing those specific VPN client packages, it's noticeable only when you actually have a fast Internet connection (the slowdown seems to cap it at about 400 Mb/s, you won't even notice it at all if your connection is slower to begin with) and it happens as soon as the software is installed, regardless of its actual usage; the only resolution is to uninstall the offending software.

Update

It looks like the issue is caused by network filter drivers which during the setup are installed and bound to all network adapters in the system, including the physical NICs and other virtual adapters which don't have any relationship at all with the VPN client you are installing.

Specifically:

• ForcePoint installs a ForcePoint VPN Client Driver and binds it to all network adapters in the system.
• FortiClient installs a FortiClient NDIS 6.3 Packet Filter Driver and binds it to all network adapters in the system.

If those drivers are unbound from the NICs, the problem disappears and the full connection speed comes back.

Other VPN clients (Cisco, CheckPoint) don't do such a thing, and they don't create this kind of slowdown.

Now the question becomes: can those drivers be safely unbound from real NICs without affecting the VPN client operation, or are they required instead?
Is this documented somewhere?

I'm looking for help with what I'm sure is an age old question. I've found myself in a situation of yearning to understand network throughput more clearly, but I can't seem to find information that makes it "click"

We have a few servers distributed geographically, running various versions of Windows. Assuming we always use one host (a desktop) as the source, when copying data from that host to other servers across the country, we see a high variance in speed. In some cases, we can copy data at 12MB/s consistently, in others, we're seeing 0.8 MB/s. It should be noted, after testing 8 destinations, we always seem to be at either 0.6-0.8MB/s or 11-12 MB/s. In the building we're primarily concerned with, we have an OC-3 connection to our ISP.

I know there are a lot of variables at play, but I guess I was hoping the experts here could help answer a few basic questions to help bolster my understanding.

1.) For older machines, running Windows XP, server 2003, etc, with a 100Mbps Ethernet card and 72 ms typical latency, does 0.8 MB/s sound at all reasonable? Or do you think that slow enough to indicate a problem?

2.) The classic "mathematical fastest speed" of "throughput = TCP window / latency," is, in our case, calculated to 0.8 MB/s (64Kb / 72 ms). My understanding is that is an upper bounds; that you would never expect to reach (due to overhead) let alone surpass that speed. In some cases though, we're seeing speeds of 12.3 MB/s. There are Steelhead accelerators scattered around the network, could those account for such a higher transfer rate?

3.) It's been suggested that the use SMB vs. SMB2 could explain the differences in speed. Indeed, as expected, packet captures show both being used depending on the OS versions in play, as we would expect. I understand what determines SMB2 being used or not, but I'm curious to know what kind of performance gain you can expect with SMB2.

My problem simply seems to be a lack of experience, and more importantly, perspective, in terms of what are and are not reasonable network speeds. Could anyone help impart come context/perspective?

It sounds obvious that a faster connection lowers latency... But I wonder: I am working remotely on a host the other side of the world - light can only travel so fast (1 foot in a nano second) and we both have broadband connections in excess of 1,000kbps upload and 10,000kbps download:

Will a higher bandwidth connection lower the time it takes to ping?? Since it is very little data how would a faster connection help? Currently ping takes 450ms is there any way I can improve it??

I wonder if it is tied to my NIC at all or if the OS or driver intercepts and immediately returns data sent to the loopback address?

Does the signal actually travel to my NIC then the NIC returns it?

Our company is buying some HP Procurve managed gigabit switches to replace some of our core switches. However, we aren't able to upgrade all of our switches from 100Mb to Gigabit switches. I think I know the answer but I'm not exactly sure. If we plug those 100Mb switches (or even a 100Mb device) into those Gigabit switches, will the performance of the entire switch drop to 100Mb or will just that one port work at 100Mb?