5

I am trying to measure latency to a server that I don't control. This is in a colocated environment, so the latency is on the order of 500 us (.5 ms).

I understand that Cisco gear frequently deprioritizes ICMP traffic, making ping times unreliable. Is there a way for me to tell if this is the case on the gear I am traversing?

Can I use TCP acknowledgements to determine the minimum latency to the remote server? To do this, I would somehow need to force the remote server to send a TCP ack immediately on receiving my data.

Ted Graham
  • 3,511
  • 4
  • 24
  • 25
  • 2
    In any case, if a Cisco router is *de*prioritizing your ping packets, then your TCP latency is definitely <= 0.5ms. Are you actually depending on less than 0.5ms of latency in your application? That seems problematic, especially on ethernet where you can't be guaranteed your packet will be delivered at all... – apenwarr Feb 08 '11 at 04:43
  • This [post](https://www.corvil.com/kb/how-can-tcp-acks-be-used-to-measure-latency-to-a-server) talks to using acks for measuring latency. – rbinnun Mar 18 '19 at 13:30

2 Answers2

8

Try hping. You can send acks and measure the latency:

hping -A -p 80 host

or with a SYN:

hping -S -p 80 host

Also note, deprioritization on a layer-2 link is unlikely (but possible). In addition, seeing ARP being slower than ICMP doesn't necessarily mean ICMP isn't deprioritized---it might mean bandwidth is insufficient to hit the limiting threshold.

ARP will almost always be slower because it broadcasts and may suffer port-queuing at the switch. You could unicast ARP, but that might look suspicious if anyone is looking for it.

j0k
  • 22,600
  • 28
  • 79
  • 90
Eric Wheeler
  • 81
  • 1
  • 2
2

You could try using arping, which does a ping using ARPs.

caf
  • 233,326
  • 40
  • 323
  • 462
  • 1
    I'm seeing the times reported from arping are ~100 us higher than those reported by ping. Would you expect that? Does it indicate that ICMP pings are not being deprioritized? – Ted Graham May 06 '10 at 20:54
  • Possibly that's just indicative of the extra processing an ARP reply causes in the local kernel. Anyway it certainly appears that ICMP pings are not being deprioritized. – caf May 06 '10 at 22:31