Contents


Introduction
Why Called Ping
How Ping Works
   Round Trip Time (RTT)
   Packet Loss %
   Time to Live (TTL)
End-to-end Delay
   Processing Delay
   Queuing Delay
   Transmission Delay
   Propagation Delay
   Other Factors
Traceroute

Introduction

Anyone who works in IT should know the command Ping. Nearly all operating systems build-in with the Ping command for troubleshooting. But what Ping did and how it works? This article will talk about Ping as well as some theory of End-to-end delay.

Why Called Ping

The function of Ping is to send a message to a device and request it to response. By analyzing the response message, we could know the status of the devices (alive or dead?) and also the network speed and network delay. Why called Ping? I did some searching and found that it is related to another scientific subject, Sonar!

SONAR (Sound Navigation And Ranging) is a technique that uses sound propagation (usually underwater, as in submarine navigation) to navigate, communicate with or detect objects on or under the surface of the water, such as other vessels. Active sonar creates a pulse of sound, called a Ping, and then listens for reflections (echo) of the pulse. It is similar to the Ping operation on computer network.

end-to-end delay

Source

How Ping Works

Ping is a program that sends ICMP packets. ICMP is a packet consists of simple structure that encapsulated in IP packets. Different messages can be sent by using ICMP.

Some common messages in ICMP packets are,

Message TypeMeaning
Echo Request Request target to response
Echo Reply Reponse to an Echo Request
Destination Unreachable Router returns this message if an Echo Request is dropped because of unreachable (may be route issues so that router could not find a route)
Time Exceeded If the TTL of an Echo Request decreases to 0, it will be dropped by router and the router will response this message. We will talk about TTL later.

ICMP provides features other than troubleshoot, you may Google ICMP for details.

Any devices will response (Echo Reply) when receiving an Echo Request unless it is set not to do so (e.g. Firewall setting) or ICMP Traffic is blocked such as by Access-List. When Echo Replies are received, Ping can calculate the results.

[root@Linux ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.6 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=46 time=15.6 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=46 time=14.8 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=46 time=15.8 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=46 time=14.8 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4713ms
rtt min/avg/max/mdev = 14.870/15.392/15.839/0.449 ms

Round Trip Time (RTT)

Ping sends out several Echo Requests and records the time different of every Echo Request and Echo Reply. It is called Round Trip Time (RTT), or End-to-end Delay. Since the RTT is different for every Ping, we can see max, min and avg in the results.

Packet Loss %

Not every ping gets a success response due to Destination Unreachable or Time Exceeded. It may also cause by Timeout, that is, cannot get a response for a period of time. Packet Loss % is the probability of no response. It is a very good reference of the stability of network.

Time to Live (TTL)

Ping will set a TTL (Time to Live) value when sending a packet. The default TTL is different based on different operating systems. When the packet is routed, TTL value decreases 1. When the packet arrives the destination, it is known that how many hops did the packet has passed through. If the TTL value is decreased to 0 before arrives, it will be dropped. The router that dropped the packet will reply a Time Exceeded to the originator so that the sender could know the reason of packet dropped is TTL becomes 0.

End-to-end Delay

When a device sends an ICMP to others, the target may be at the other side of the world. Packet need some time to arrive the destination, it is called End-to-end Delay. In computer network, End-to-end Delay consists of the following 4 components.

end-to-end delay

Processing Delay

When a Packet arrives to a router, the router need to do some calculation to find out the outgoing interface of a Packet which is called Routing Decision. The processing time is called Processing Delay. The value of Processing Delay is based on the OS, processing power or even hardware architecture of the router.

Queuing Delay

After Routing Decision process, the outgoing interface is decided. The Packet will be moved to the interface and wait at the Output Queue before it is sent. The time for queue is called Queuing Delay. The value of Queuing Delay based on the network status (busy of not?). In other words, how many packets is queued in front? Also, the interface can do Early Drops before the queue buffer is full. It is QoS stuffs and we will talk about this is the QoS session in the future.

Transmission Delay

If the Packet is survive, it should be moved slowly to the head of the Output Queue. Interface will put the packet to the transmit media one by one. Interface do it periodically by Interface Speed (e.g. 100Mbps or 1Gbps) depends on the media. You may read Optical Fiber CableCopper Twisted Network Cable for details. So, if a 1500 Bits Packet is sent by a 100Mbps Bandwidth Interface, the Transmission Delay will be,

1500 bits / 100 Mbps = 15 ns

Propagation Delay

Finally, the packet is transformed to electrical signal or optical signal and pass through the media at high speed. If a copper cable is used, the speed will be 2 x 108 meters per second. If a fiber cables is used, the speed will be 3 x 108 meters per second. For example, if a packet is transmitted on a fiber cable for 10 Kilo-meters, the Propagation Delay will be,

10 km / 3 x 108 ms-1 = 33.36 ns

Other Factors

There are other factors that will influence the End-to-end Delay, such as,

Status of Target Device

When a packet is arrived, it is needed to be processed by the operating system and hardware resource (CPU and RAM). If the system is busy, the response time increases.

QoS (Quality of Service)

QoS setting influences the priority of a packet. ICMP is always set to have a lower priority. If there are large amount of high priority traffic is being sent on the network, the response time of Ping will be increased or even dropped on the path.

Collision

If there are Half Duplex network segment in the network, Layer 2 Collision will increase the Ping response time.

Traceroute

By using the mechanism of TTL, a very useful tool called Traceroute (or called Trace or Tracert in some system) is born. When sending an ICMP, Traceroute set the TTL to 1. When this packet arrives the first hop, the hop will reply Time Exceeded. After receiving the reply, Traceroute send out ICMP but set the TTL to 2 this time. Then, it should receive reply from the second hop. Repeat the process, Traceroute records all the result until it receives a Echo Reply for the destination. So, we could know the path of the packet from source to destination.

This is a Traceroute Result.

[root@Server ~]# traceroute www.google.com.hk
traceroute to www.google.com.hk (216.58.200.3), 30 hops max, 60 byte Packets
 1  192.168.1.1 (192.168.1.1)  0.530 ms  0.488 ms  0.533 ms
 2  ㊙️㊙️㊙️㊙️㊙️.ctinets.com (㊙️㊙️㊙️㊙️㊙️)  6.992 ms  7.150 ms  7.308 ms
 3  10.239.9.89 (10.239.9.89)  2.632 ms  2.946 ms  3.100 ms
 4  014199254173.ctinets.com (14.199.254.173)  6.074 ms  6.140 ms  6.211 ms
 5  014136129214.ctinets.com (14.136.129.214)  5.189 ms  5.254 ms  5.334 ms
 6  72.14.196.85 (72.14.196.85)  5.480 ms  5.150 ms  5.130 ms
 7  108.170.241.97 (108.170.241.97)  5.698 ms  4.532 ms  4.139 ms
 8  209.85.240.9 (209.85.240.9)  3.518 ms 209.85.240.11 (209.85.240.11)  2.492 ms *
 9  hkg12s11-in-f3.1e100.net (216.58.200.3)  4.004 ms  4.061 ms  4.053 ms