2

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us (microseconds).

Here is Wireshark data for both situations:

*REF*         172.26.45.212   10.160.86.12    ICMP    74 Echo (ping) request
0.003988000   10.160.86.12    172.26.45.121   ICMP    74 Echo (ping) reply

*REF*         172.26.45.212   10.160.86.12    HTTP   606 POST /form/etc...
0.000025000   10.160.86.12    172.26.45.121   TCP     60 80>6704 [ACK] Seq...

Does anyone know why the difference? Both methods should give the round-trip time for my network.

Thanks in advance.

Saulo Fonseca
  • 21
  • 1
  • Whatever it is you have measured, I don't think those 25us include a network roundtrip. Which end of the connection did you perform this packet capture? – kasperd Mar 23 '15 at 11:43
  • I am in the client side (172.26.45.212). I was also impressed for the low value. I tested already many times and get always similar results. – Saulo Fonseca Mar 23 '15 at 12:08
  • Could you include a link where we can download the actual packet capture of the later case. The more information available, the easier it is to understand what is actually being measured. – kasperd Mar 23 '15 at 12:32
  • I just did my own measurements between a couple of machines both connected to the same switch. Response times according to a `pcap` file produced by `tcpdump` were between 65 and 102 usec for echo request and between 73 and 128 usec for TCP SYN. However the ping command reported between 118 and 288 usec, this suggests that the user mode overhead of the ping command itself was responsible for about 50% of the measured roundtrip time in this setup. – kasperd Mar 23 '15 at 12:45
  • Thank you for your try. If you find similar values for ping and tcp syn in your tcpdump test, then I must be doing something wrong. I will revise my methods and come-up again. I am in a closed network at work and cannot put a file on a server to be available for you now. – Saulo Fonseca Mar 23 '15 at 13:05

0 Answers0