How to use and interpret PingPlotter results

Page 12

I find the PingPlotter results to be the one of the most useful methods of trying to isolate customer problems. It can show a variety of information including the data path, number of hops, mimimum and maximum latency values, average latency, packet loss, and pseduo packetloss that is not relevant to network performance.

Three quick examples here, one which appears to show a problem, where there is none. One that illustrates where significant latency in the path is being added. And the last one that clearly shows a network packet loss issue.

First, take a look at this plot:

At first glance, it appears there is 9% packet loss. But as explained in the other section of this site, this is not representative of real application level packet loss. This is an indication that the router is rate-limiting the ICMP ttl (time to live) expired return messages. Routers rate-limit these packets because traceroute requires the router to "create" a packet (stimulus/response) and this function is handled in software. The most important function of a router is to pass data traffic through the device (this function is done in hardware chips [ASICs]). As you can tell by the fact there is 0% packet loss downstream from the "lossy" hop the router is performing it's primary function. Side note - although there appears to be no real packet loss here, the latency plots are all over the map, that would be indicative of another issue.

Now let's look at the next example:

Here there is no packet loss noted, but the graph shows how nicely ping plotter can illustrate where a the most latency is being introduced (both on hops 4 and 5). Note that some latency is normal, particular when traversing a large geography. DNS names often will help you understand what city a hop is in. In this case, the large latency increases appear to reside within one metro area, hence indicative of an issue.

And lastly, this example:

Here we have packet loss starting at hop 2, and since that packet loss carries on all the way to the last hop, one can conclude that this is real packet loss and most likely source of introduction is at that second hop.

Hopefully these examples show how powerful the PingPlotter tool can be. Although there are very nice full featured commercial versions available, a less featured free version is available here. Sorry, there does not appear to be a Mac or Linux version; only Windows. Of course if you are using Linux (or BSD, or other unix variants), you probably didn't learn anything from this web page. :-)

Would you like to see more? Go here to see the Advanced PingPlotter notes.

[edited on Dec 3, 2006]

(back)