You do not find a slow link by staring at the whole network. You find it by cutting the path in half, testing, and cutting the guilty half again.
The user PC is slow to the server, but the network has a desk cable, a wall socket, a floor switch, an uplink and a server cable - five suspects in a row. Replacing parts at random is expensive and embarrassing. Hop by hop testing is the disciplined way: use iperf3 to measure the full path, then measure shorter and shorter sections of it until exactly one section disagrees with the others. That section holds your fault.
First, run the honest end-to-end test: server mode on the server with iperf3 -s, client on the user's PC with iperf3 -c 192.168.1.10. Write the receiver number down. This is your complaint, measured.
Now split the path. Put a known-good laptop on the same switch as the user's PC and test user PC to laptop. Then test that laptop to the server. One of those two halves contains the slowness. You have halved the suspects in two minutes - keep halving the guilty half until the section is one cable, one switch or one port.
Learn the signatures. A result stuck near 94 Mbps on gigabit hardware means that section negotiated at 100 Mbps - a cable with a damaged pair, a lazy port, or an old device in the chain. A result that changes every run and sheds retransmits means loss - interference, a dying cable, or a congested shared link.
A result that is fast one way and slow in reverse points at one direction of one section - test that section with -R from both ends as you narrow down. The shape of the number is the diagnosis; do not just record fast or slow.
When a section is cornered, swap its cheapest part first: the patch cable. Then the switch port. After each single change, run the identical test again - same machines, same command, same duration. If the number jumps to 940, you found it; stop touching things.
Swapping three parts at once and seeing a good result feels faster, but you have learned nothing except that one of the three was guilty - and the guilty part is now in your spares box waiting to haunt another desk. One change, one test, one conclusion.
In real offices the slow link is usually one of these: a long cable run damaged where a chair rolls over it; a small unmanaged switch under a desk quietly limiting a whole table; a wall port wired years ago at half its pairs; a server plugged into the one old 100 Mbps port on an ageing switch; or a Wi-Fi hop nobody admitted was in the path.
Notice that none of these are fixed by buying a faster internet plan or a new server. Hop by hop testing exists precisely because the boring middle of the network is where speed goes to die.
The complete iperf3 setup and live testing, step by step, in the video.
Watch Full VideoThree is comfortable: the server, the problem PC, and one known-good laptop you can carry and plug in at different points. Two can work if you are willing to keep swapping which machine runs the server - just keep the test pairs written down so the readings stay comparable.
Then the sections were not tested under the same conditions - most often load. A shared uplink that is idle at test time and saturated at 10 AM will pass every midnight test. Retest the full path at the hour users complain, and test across the shared sections specifically at that time.
The uplink cable or its ports: a damaged run, a kinked patch lead, or a port that fell back to 100 Mbps. Swap the patch leads at both ends first, then try different ports, then suspect the fixed cable run itself - in that order, because that is the order of cost.