We have had strange behavior in our network. We have many remote users working outside the organization using VPN and Citrix along with other third party remote apps. Occasionally and very randomly they will start getting disconnects and not be able to get in the network, and if they are connected they will get bumped off. This may occur for a day or two, then just disappear and come back in a few weeks or a month, last a few days and go away again. All firewall logs router and switch logs seem normal. The only thing I do know is the TI 1 line is almost at 100% capacity. Any thought would be appreciated.
This behavior could be attributed to several different things, but based on your observation of link utilization, there is a good chance that it is being caused by high link utilization. You may want to profile what applications are being used to determine if the peaks are caused by a valid business application (like backup) or something less desirable, like peer-to-peer file sharing. There are a variety of
devices that can help with this, whose sole purpose is to monitor network traffic. Alternatively, you may want to look at WAN optimization devices. In addition to providing the monitoring data you require, these devices can also help prioritize the most important applications and limit bandwidth based upon policies you define. Other techniques can also be applied to maximize application performance across the WAN. So, in addition to detecting the problem, you can actually take measures to correct it.