Case Study · IT Network Audit - Engave S.A.
How a LAN and MPLS network audit at a logistics company revealed more than the client wanted to know - and why it's a good thing they found out
Project at a glance
Client
A logistics company - fleet management systems, e-commerce, route planning, multiple branches connected via an MPLS network
Report
Decline in LAN network, MPLS connection, and Internet access throughput
Scope
6-stage audit: measurements and on-site inspection, MPLS link testing, Internet speed, edge device traffic analysis, branch-to-headquarters connectivity testing, transmission interruption analysis
Unexpected result
Detection of an unauthorized connection to the internal network - unreported, invisible to monitoring
Result
Threat removal, repair of 18 damaged sockets, infrastructure clean-up, recommendations for branch 4 and the Office 365 migration
Problem
A logistics company with multiple branches connected via an MPLS network reported one specific symptom: declining throughput. Something was slowing the network down - files transferred more slowly, working with headquarters became cumbersome, users reported occasional freezes. A classic IT ticket: 'internet is slow, please check'.
The problem with a report like that is that 'slow network' is a symptom, not a diagnosis. Behind the same symptom could be a damaged cable, a saturated MPLS link, an issue on the operator's side, a suboptimal switch configuration, or - the scenario no one assumes - something on the network that shouldn't be there.
Engave didn't arrive with a ready-made answer. It arrived with six stages of measurements designed to build a full picture - not just where it hurt, but across the entire infrastructure. Because a network, like an organization, rarely has just one problem at a time.
Challenge
All branches route traffic through headquarters. That means one source of heavy traffic - a backup running during business hours, for instance - can momentarily saturate the headquarters link and slow down every other location at once. Users see the problem locally, but the cause is elsewhere.
18 damaged network sockets (inserts torn out of their housings), 6 unlabeled sockets, cables that were too long and in non-standardized colors, no labeling in the patch panel cabinet. These aren't performance problems - they're problems waiting to become performance problems or security gaps.
Some switch ports were operating at 100 Mb/s, one - at 10 Mb/s in half-duplex mode. In an environment where everything should run on Gigabit, these points were bottlenecks invisible without a MAC address analysis.
Detected during the on-site inspection. Not registered by network monitoring - because monitoring checks traffic, it doesn't inventory physical connections. Someone had connected a device to the company's internal network without the IT department's knowledge or consent. How long it had been there - unknown.
Solution
Monitoring software to identify ports running at suboptimal speed. Physical inspection of cables, patch panels, and sockets throughout the branch. Result: a map of physical and configuration issues, detection of an unauthorized connection, identification of devices with substandard interfaces.
Link speed measurements to headquarters under real working conditions - not in a lab. Analysis of the MPLS network structure and the saturation potential of the headquarters link. Conclusion: backup traffic, not a link problem, was the cause of the momentary slowdowns.
Measurements taken at random times during normal operation. Average download speed: 150-190 Mb/s. Occasional drops - with no impact on users' work and non-recurring. The internet link rated as efficient and stable.
Traffic monitoring on the headquarters firewall and the branch switch - sampled every 5 minutes. Link saturation above 50% did not occur during the study period. The edge infrastructure has headroom to spare.
A 105 MB file transfer as a real-world throughput test. Result: 3-4 seconds on an unloaded link - 100% of the operator's stated bandwidth. Momentary slowdowns during business hours were linked to backup activity, not a link problem.
Regular availability testing of branch switches every minute throughout the entire study period. Result for the audited branch: stable response times, packet loss below the threshold users would notice. Exception: branch 4, with significant anomalies requiring escalation to the operator.
The company wanted to know why the network was slow. Along the way, it learned that someone unidentified had access to its internal network. Network monitoring hadn't caught it - because monitoring tracks traffic, not physical connections. Only a person with a flashlight in the patch panel cabinet can see that.
Results
1
unauthorized connection to the internal network - detected and removed
18
damaged network sockets inventoried and scheduled for repair
Branch 4
identified as the source of network anomalies - the issue escalated to the operator
The company reported one problem - a slow network. The audit solved it and, along the way, uncovered three more: unauthorized network access, degraded physical infrastructure, and anomalies on the MPLS link to the fourth branch that no internal monitoring had ever seen.
The slow network had a simple explanation: backups running during business hours were saturating the MPLS link at headquarters. Rescheduling the backup to run overnight solved the performance problem. But if the audit had stopped there - the unauthorized connection and the damaged infrastructure would have remained invisible in the environment.
Additional recommendation: with Office 365 migration planned, the MPLS network structure needs modification. Routing traffic to Microsoft's servers through the MPLS hub - instead of directly to the Internet from each branch - unnecessarily loads the link and increases response times. Engave identified a specific path for the configuration change.
Reference
"The subject of the Agreement was completed in accordance with the agreement, on time and with due diligence."
Client from the logistics industry - excerpt from the official testimonial
Why it matters
Most companies commission a network audit at one of three moments: when something stops working, when a major migration is approaching, or when someone requires an external audit - a regulator, an insurer, a new business partner. Rarely is it done proactively.
The problem is that a network built up over years and never fully inventoried accumulates problems invisible in day-to-day operation: damaged sockets, unidentified devices, below-standard configurations. Each one on its own is a minor detail. Together, they add up to an environment that's both slower and less secure than it should be.
The unauthorized connection at this company was detected during a performance audit. Not because anyone was looking for it - but because someone checked every patch panel cabinet and every cable. That's the difference between monitoring and an audit. Monitoring tells you what's happening. An audit tells you what's there - and what shouldn't be.
What this means for your company
A network audit isn't just a performance diagnosis. It's an inventory of what's actually in your environment - with an eye on security, stability, and readiness for the next step, whether that's Office 365 or expanding to new branches.
engave.pl/kontakt
Engave S.A. · engave.pl · All rights reserved
Cybersecurity, IT care, digitalisation - whatever the topic, we're happy to talk. Describe your need and the right specialist will get back to you within 24 business hours.
CONTACT:
biuro@engave.pl
+22 863 13 90
Technical support: +48 604 470 151
16 Czarodzieja St., 03-116 Warsaw, Poland