OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Update 3: the plot thickens.
From: Wietse Venema (wietseporcupine.org)
Date: Wed Mar 22 2000 - 11:56:07 CST

Gerald Richter:
> > ping -qc 10 195.52.11.1
>
> PING 195.52.11.1 (195.52.11.1): 56 data bytes
> --- 195.52.11.1 ping statistics ---
> 10 packets transmitted, 10 packets received, 0% packet loss
> round-trip min/avg/max = 1.512/1.673/2.416 ms

That router is too close for sending the bogus ACK packets.
We need a round-trip time of about 4.6 ms.

> > ping -qc 10 195.52.15.45
>
> PING 195.52.15.45 (195.52.15.45): 56 data bytes
> --- 195.52.15.45 ping statistics ---
> 10 packets transmitted, 10 packets received, 0% packet loss
> round-trip min/avg/max = 5.142/5.297/5.986 ms

That router is at the right distance.

> > ping -qc 10 194.162.200.65
>
> PING 194.162.200.65 (194.162.200.65): 56 data bytes
> --- 194.162.200.65 ping statistics ---
> 10 packets transmitted, 10 packets received, 0% packet loss
> round-trip min/avg/max = 5.595/7.151/12.366 ms

That router may also be at the right distance, but there is a lot
of variation in round-trip time so it is hard to tell. More probes
are needed, something like ping -qc 100.

> > ping -qc 10 194.112.20.241
> >
>
> PING 194.112.20.241 (194.112.20.241): 56 data bytes
> --- 194.112.20.241 ping statistics ---
> 10 packets transmitted, 10 packets received, 0% packet loss
> round-trip min/avg/max = 7.597/35.392/155.918 ms

There is too much variation to make any sensible statement.
This router needs more probes, something like ping -qc 100.

Perhaps you can use the mtr program instead of ping. Source is at

    http://www.bitwizard.nl/mtr/

This gives a better idea of network performance than either ping
or traceroute alone can do.

Run as: "mtr -t spike.porcupine.org" for a live display.

        Wietse