6509#ping size 500 rep 100
Type escape sequence to abort.
Sending 100, 500-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/8 ms

looking at the first packet and the last packet

tcpdump -X -vv -n -r r.pcap | grep 01:10: |  (head -n1 && tail -n1)
reading from file r.pcap, link-type EN10MB (Ethernet)
01:10:16.847774 IP (tos 0x0, ttl 255, id 6517, offset 0, flags [none], proto ICMP (1), length 500)
01:10:17.011485 IP (tos 0x0, ttl 64, id 15139, offset 0, flags [none], proto ICMP (1), length 500)

first frame arrived at 01:10:16.847774 last frame at 01:10:17.011485

>>> from datetime import datetime
>>> d1 = datetime.strptime("2222-01-01 01:10:16.8477", "%Y-%m-%d %H:%M:%S.%f")
>>> d2 = datetime.strptime("2222-01-01 01:10:17.0114", "%Y-%m-%d %H:%M:%S.%f")
>>> print(d2 - d1)


seems that Cisco is rounding to 2 in average,

Wireshark gets closer to the python output

enter image description here

but what do they mean about 8 ms ? the time it took from the first packet to the last packet job process time to finish?

is there any way in wireshark for obtaining this value?

  • Avg (average) is not the time from first frame to last frame. It's the sum of all RTT's divided by the number of requests. You need the RTT's of all 100 requests to calculate it, and the 6509 doesn't report them. Also, your packet captures don't account for any system processing delays. (i.e. the switch has other things to do)
    – Ricky
    Jul 25 '16 at 0:51

A ping consists of an ICMP echo request from the host where you run the ping command, and it is done when that same host receives an ICMP echo reply from the target host. The time it takes for this to happen is reported as the round-trip time in ms.

The round-trip min/avg/max mean that among all the ping tests, the fastest only took 1 ms, the longest took 8 ms, and the average of all the test times was 2 ms. You may have had multiple tests which took 8 ms, but none took more than 8 ms. Of course, these numbers are rounded to the nearest ms.

  • In wireshark, how can you see that max delay?
    – Dense.mode
    Jul 25 '16 at 0:38
  • You will need to get the start and end times for each request and its corresponding reply reply, and pick out the one which took the most time.
    – Ron Maupin
    Jul 25 '16 at 0:42
  • hmm not clear, I did and I can not find were, also how is possible to see 8ms delay on a file that captured 00.163700?
    – Dense.mode
    Jul 25 '16 at 0:43
  • You must run Wireshark on the originating host, in this case, your Cisco 6509. You need to capture the outgoing ICMP echo requests, and the incoming ICMP echo replies. Then you can correlate the time for each outgoing echo request with the time of its corresponding echo reply.
    – Ron Maupin
    Jul 25 '16 at 0:46
  • that capture comes from a TAP interface in between, what will be the difference?
    – Dense.mode
    Jul 25 '16 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.