Above is the problem network diagram from my friend CC. They are running this network for 1 year plus without problem, the problem only appear recently. As you can see from the image attach above, they have 3 dynamic IP ADSL and 1 SDSL, and they are connected to a VPN using the SDSL to form a large LAN game network. The main switch "D-Link 24 port" is brand new because when they first discover this problem they tot is main switch problem and replace it from Linksys 16port to the current one.

The whole network cannot access the all 4 router by time to time.. when the problem come, all four router have no reply by PING..

To diagnose the problem I've tried to unplug the cable from switch 1 to switch 4 on the D-link switch, the problem goes when I unplug the switch 3 cable i tot the problem come from switch 3.. so i replace switch3 to another switch (tempswitch3) and monitor the network using PING again. After a while, the problem come back, but removing the cable to tempswitch3 this time DOESN"T WORK! ... so I tried to remove cables to others switch and when I remove cable to switch2, the problem have GONE!! and the problem repeat and repeat later on different switch.

So i thought it is virus problem because I experience something similar before (the Arp spoofing which i can detect using winarpattacker.exe). But this time is different, the winarpattacker doesn't detect any IP spoofing/flooding.. So do anyone here experience the similar situation before? Can someone point out the possibilities?

Help please.