Mailing List Archive

I have seen this problem with the Windows ping in the past. The first
ping always gives a very high response time compared to subsequent ones.

ping MMM.NNN.50.1
PING MMM.NNN.50.1 (16.145.50.1): 56 data bytes
64 bytes from MMM.NNN.50.1: icmp_seq=0 ttl=255 time=73 ms
64 bytes from MMM.NNN.50.1: icmp_seq=1 ttl=255 time=0 ms
64 bytes from MMM.NNN.50.1: icmp_seq=2 ttl=255 time=1 ms
64 bytes from MMM.NNN.50.1: icmp_seq=3 ttl=255 time=1 ms
64 bytes from MMM.NNN.50.1: icmp_seq=4 ttl=255 time=0 ms

----MMM.NNN.50.1 PING Statistics----
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip (ms) min/avg/max/med = 0/15/73/1

I believe that is an internal Windows issue (something to do with the
delay of loading the ICMP.dll) and not related to actual time-of-flight
of the ICMP echo.

When I have used windows ping in doing doing network analysis from
scripts I either disregard the first response (or use another ping
program!)


Martin Visser

Technology Consultant
Consulting & Integration
Technology Solutions Group - HP Services

410 Concord Road
Rhodes NSW 2138
Australia

Mobile: +61-411-254-513
Fax: +61-2-9022-1800
E-mail: martin.visserAThp.com

This email (including any attachments) is intended only for the use of
the individual or entity named above and may contain information that is
confidential, proprietary or privileged. If you are not the intended
recipient, please notify HP immediately by return email and then delete
the email, destroy any printed copy and do not disclose or use the
information in it.


-----Original Message-----
From: ethereal-dev-bounces@ethereal.com
[mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Anis BEN
ABDALLAH
Sent: Monday, 12 June 2006 8:20 PM
To: ethereal-dev@ethereal.com
Subject: [Ethereal-dev] Ethereal timings vs ping timings

Hello,

I'm testing an embedded ethernet device and when trying with the ping
command, I have a different timings between reply timings indicated by
the ping command in the dos window and timings indicated in the ethereal
(time delta from previous packet)

For example for the first reply I got "time = 9ms" in dos window while
in ethereal I have "time delta from previous packet = 0.00055 s"

Why this difference?

Thanks for your help.

Anis

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev

Hi,

Don't forget that the ARP protocol is probably running before the
first ICMP packet is sent out.

Thanx,
Jaap

On Wed, 14 Jun 2006, Visser, Martin wrote:

> I have seen this problem with the Windows ping in the past. The first
> ping always gives a very high response time compared to subsequent ones.
>
> ping MMM.NNN.50.1
> PING MMM.NNN.50.1 (16.145.50.1): 56 data bytes
> 64 bytes from MMM.NNN.50.1: icmp_seq=0 ttl=255 time=73 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=1 ttl=255 time=0 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=2 ttl=255 time=1 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=3 ttl=255 time=1 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=4 ttl=255 time=0 ms
>
> ----MMM.NNN.50.1 PING Statistics----
> 5 packets transmitted, 5 packets received, 0.0% packet loss
> round-trip (ms) min/avg/max/med = 0/15/73/1
>
> I believe that is an internal Windows issue (something to do with the
> delay of loading the ICMP.dll) and not related to actual time-of-flight
> of the ICMP echo.
>
> When I have used windows ping in doing doing network analysis from
> scripts I either disregard the first response (or use another ping
> program!)
>
>
> Martin Visser
>
> Technology Consultant
> Consulting & Integration
> Technology Solutions Group - HP Services
>
> 410 Concord Road
> Rhodes NSW 2138
> Australia
>
> Mobile: +61-411-254-513
> Fax: +61-2-9022-1800
> E-mail: martin.visserAThp.com
>
> This email (including any attachments) is intended only for the use of
> the individual or entity named above and may contain information that is
> confidential, proprietary or privileged. If you are not the intended
> recipient, please notify HP immediately by return email and then delete
> the email, destroy any printed copy and do not disclose or use the
> information in it.
>
>
> -----Original Message-----
> From: ethereal-dev-bounces@ethereal.com
> [mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Anis BEN
> ABDALLAH
> Sent: Monday, 12 June 2006 8:20 PM
> To: ethereal-dev@ethereal.com
> Subject: [Ethereal-dev] Ethereal timings vs ping timings
>
> Hello,
>
> I'm testing an embedded ethernet device and when trying with the ping
> command, I have a different timings between reply timings indicated by
> the ping command in the dos window and timings indicated in the ethereal
> (time delta from previous packet)
>
> For example for the first reply I got "time = 9ms" in dos window while
> in ethereal I have "time delta from previous packet = 0.00055 s"
>
> Why this difference?
>
> Thanks for your help.
>
> Anis
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev

Jaap,

The first time I saw this I thought that, but no, this problem occurs
when the ARP table is still populated (and DNS resolved). I am fairly
confident it is some app loading time issue. (I think it might load the
function to receive ICMP only when it receives the first response. The
problem doesn't appear when I use a 3rd part ping tool like fping which
would still use the same network stack including ARP table)

I haven't been able to generate much interest by anyone in solving this
particular issue - my workaround suits my purposes.



-----Original Message-----
From: ethereal-dev-bounces@ethereal.com
[mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Jaap Keuter
Sent: Wednesday, 14 June 2006 4:08 PM
To: Ethereal development
Subject: RE: [Ethereal-dev] Ethereal timings vs ping timings

Hi,

Don't forget that the ARP protocol is probably running before the first
ICMP packet is sent out.

Thanx,
Jaap

On Wed, 14 Jun 2006, Visser, Martin wrote:

> I have seen this problem with the Windows ping in the past. The first
> ping always gives a very high response time compared to subsequent
ones.
>
> ping MMM.NNN.50.1
> PING MMM.NNN.50.1 (16.145.50.1): 56 data bytes
> 64 bytes from MMM.NNN.50.1: icmp_seq=0 ttl=255 time=73 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=1 ttl=255 time=0 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=2 ttl=255 time=1 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=3 ttl=255 time=1 ms
> 64 bytes from MMM.NNN.50.1: icmp_seq=4 ttl=255 time=0 ms
>
> ----MMM.NNN.50.1 PING Statistics----
> 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip

> (ms) min/avg/max/med = 0/15/73/1
>
> I believe that is an internal Windows issue (something to do with the
> delay of loading the ICMP.dll) and not related to actual
> time-of-flight of the ICMP echo.
>
> When I have used windows ping in doing doing network analysis from
> scripts I either disregard the first response (or use another ping
> program!)
>
>
> Martin Visser
>
> Technology Consultant
> Consulting & Integration
> Technology Solutions Group - HP Services
>
> 410 Concord Road
> Rhodes NSW 2138
> Australia
>
> Mobile: +61-411-254-513
> Fax: +61-2-9022-1800
> E-mail: martin.visserAThp.com
>
> This email (including any attachments) is intended only for the use of

> the individual or entity named above and may contain information that
> is confidential, proprietary or privileged. If you are not the
> intended recipient, please notify HP immediately by return email and
> then delete the email, destroy any printed copy and do not disclose or

> use the information in it.
>
>
> -----Original Message-----
> From: ethereal-dev-bounces@ethereal.com
> [mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Anis BEN
> ABDALLAH
> Sent: Monday, 12 June 2006 8:20 PM
> To: ethereal-dev@ethereal.com
> Subject: [Ethereal-dev] Ethereal timings vs ping timings
>
> Hello,
>
> I'm testing an embedded ethernet device and when trying with the ping
> command, I have a different timings between reply timings indicated by

> the ping command in the dos window and timings indicated in the
> ethereal (time delta from previous packet)
>
> For example for the first reply I got "time = 9ms" in dos window while

> in ethereal I have "time delta from previous packet = 0.00055 s"
>
> Why this difference?
>
> Thanks for your help.
>
> Anis
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev

Hi,

It very well could be related to module loading time, 73 ms is a
ridiculous long time for ARP. But then again I don't care much for Windows
as a measurement platform, it's just not build for that.

Thanx,
Jaap

On Thu, 15 Jun 2006, Visser, Martin wrote:

> Jaap,
>
> The first time I saw this I thought that, but no, this problem occurs
> when the ARP table is still populated (and DNS resolved). I am fairly
> confident it is some app loading time issue. (I think it might load the
> function to receive ICMP only when it receives the first response. The
> problem doesn't appear when I use a 3rd part ping tool like fping which
> would still use the same network stack including ARP table)
>
> I haven't been able to generate much interest by anyone in solving this
> particular issue - my workaround suits my purposes.
>
>
>
> -----Original Message-----
> From: ethereal-dev-bounces@ethereal.com
> [mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Jaap Keuter
> Sent: Wednesday, 14 June 2006 4:08 PM
> To: Ethereal development
> Subject: RE: [Ethereal-dev] Ethereal timings vs ping timings
>
> Hi,
>
> Don't forget that the ARP protocol is probably running before the first
> ICMP packet is sent out.
>
> Thanx,
> Jaap
>
> On Wed, 14 Jun 2006, Visser, Martin wrote:
>
> > I have seen this problem with the Windows ping in the past. The first
> > ping always gives a very high response time compared to subsequent
> ones.
> >
> > ping MMM.NNN.50.1
> > PING MMM.NNN.50.1 (16.145.50.1): 56 data bytes
> > 64 bytes from MMM.NNN.50.1: icmp_seq=0 ttl=255 time=73 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=1 ttl=255 time=0 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=2 ttl=255 time=1 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=3 ttl=255 time=1 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=4 ttl=255 time=0 ms
> >
> > ----MMM.NNN.50.1 PING Statistics----
> > 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip
>
> > (ms) min/avg/max/med = 0/15/73/1
> >
> > I believe that is an internal Windows issue (something to do with the
> > delay of loading the ICMP.dll) and not related to actual
> > time-of-flight of the ICMP echo.
> >
> > When I have used windows ping in doing doing network analysis from
> > scripts I either disregard the first response (or use another ping
> > program!)
> >
> >
> > Martin Visser
> >
> > Technology Consultant
> > Consulting & Integration
> > Technology Solutions Group - HP Services
> >
> > 410 Concord Road
> > Rhodes NSW 2138
> > Australia
> >
> > Mobile: +61-411-254-513
> > Fax: +61-2-9022-1800
> > E-mail: martin.visserAThp.com
> >
> > This email (including any attachments) is intended only for the use of
>
> > the individual or entity named above and may contain information that
> > is confidential, proprietary or privileged. If you are not the
> > intended recipient, please notify HP immediately by return email and
> > then delete the email, destroy any printed copy and do not disclose or
>
> > use the information in it.
> >
> >
> > -----Original Message-----
> > From: ethereal-dev-bounces@ethereal.com
> > [mailto:ethereal-dev-bounces@ethereal.com] On Behalf Of Anis BEN
> > ABDALLAH
> > Sent: Monday, 12 June 2006 8:20 PM
> > To: ethereal-dev@ethereal.com
> > Subject: [Ethereal-dev] Ethereal timings vs ping timings
> >
> > Hello,
> >
> > I'm testing an embedded ethernet device and when trying with the ping
> > command, I have a different timings between reply timings indicated by
>
> > the ping command in the dos window and timings indicated in the
> > ethereal (time delta from previous packet)
> >
> > For example for the first reply I got "time = 9ms" in dos window while
>
> > in ethereal I have "time delta from previous packet = 0.00055 s"
> >
> > Why this difference?
> >
> > Thanks for your help.
> >
> > Anis
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@ethereal.com
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@ethereal.com
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-dev