3

I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional traffic just to determine latency, etc) and would like to estimate the latency using any TCP ACK RTT measurements.

I started by using Wireshark but I’m finding that the RTT to an IP is significantly lower than the latency reported when I Ping that same destination. (e.g. 55ms TCP ACK RTT vs 168ms Ping)

Am I incorrect in thinking that these values should be similar? Could someone explain what the difference between the two are and hence why the values are drastically different?

Improve this question

2 Answers 2

Reset to default
4

What are the differences between TCP iRTT and ICMP Ping?

The real difference is the protocols used. Ping is an application that uses ICMP, an integral part of IP. One problem with ICMP is that ICMP message generation is a low-priority task. Devices are designed to perform tasks other than ICMP message generation, which gets relegated to a low priority so that the device can optimally perform its primary task, getting around to generating the ICMP messages when it has some spare time.

TCP is a transport protocol, and it is optimized in a host OS to give good service to the applications using its service. TCP should always perform better than ICMP.

Many people make the mistake of relying on the latency report by ping to determine network latency and performance. Ping is a tool that was designed to determine if a host is up and running on the network, not to determine the network latency or performance of applications using other protocols.

Am I incorrect in thinking that these values should be similar?

Yes, they are completely separate protocols.

Could someone explain what the difference between the two are and hence why the values are drastically different?

See above.

Improve this answer
1
  • 2
    It should be noted that ICMP echo not only has a lower handling priority on the end nodes but it may also suffer additional delays from lower forwarding priority on the entire path between the nodes (policy queueing, QoS) and even differing routing (using another path due to policy routing).
    – Zac67 ♦
    Sep 1, 2018 at 7:34
1

There are differences between protocols implemented in different layers. Operating systems may also take deliberate priorities in responding to incoming packets. You may find higher RTT's pinging some router, yet good throughput and low latency to a farther host via the same router.

One must also bear in mind that RTT values may be of overlapping (cumulative acknowledgements) of incoming and previously sent packets due to pipe-lining techniques used in an already-established TCP connection, while that of PING may be answered separately, thus demand for separate cpu attention, buffer allocation, data structures, etc for each packet to answer.

In addition, possible latency of wireshark (libs, DNS lookup, ...) and the way you interpret its output must be taken into account.

PS, ping doesn't need both sides to be opened. Just the answering party should let ping (icmp echo request) packets in.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.