ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: RE: [Ethereal-dev] Ethereal timings vs ping timings

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 15 Jun 2006 07:50:46 +0200 (CEST)
Hi,

It very well could be related to module loading time, 73 ms is a
ridiculous long time for ARP. But then again I don't care much for Windows
as a measurement platform, it's just not build for that.

Thanx,
Jaap

On Thu, 15 Jun 2006, Visser, Martin wrote:

> Jaap,
>
> The first time I saw this I thought that, but no, this problem occurs
> when the ARP table is still populated (and DNS resolved). I am fairly
> confident it is some app loading time issue. (I think it might load the
> function to receive ICMP only when it receives the first response. The
> problem doesn't appear when I use a 3rd part ping tool like fping which
> would still use the same network stack including ARP table)
>
> I haven't been able to generate much interest by anyone in solving this
> particular issue - my workaround suits my purposes.
>
>
>
> -----Original Message-----
> From: ethereal-dev-bounces@xxxxxxxxxxxx
> [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of Jaap Keuter
> Sent: Wednesday, 14 June 2006 4:08 PM
> To: Ethereal development
> Subject: RE: [Ethereal-dev] Ethereal timings vs ping timings
>
> Hi,
>
> Don't forget that the ARP protocol is probably running before the first
> ICMP packet is sent out.
>
> Thanx,
> Jaap
>
> On Wed, 14 Jun 2006, Visser, Martin wrote:
>
> > I have seen this problem with the Windows ping in the past. The first
> > ping always gives a very high response time compared to subsequent
> ones.
> >
> > ping MMM.NNN.50.1
> > PING MMM.NNN.50.1 (16.145.50.1): 56 data bytes
> > 64 bytes from MMM.NNN.50.1: icmp_seq=0 ttl=255 time=73 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=1 ttl=255 time=0 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=2 ttl=255 time=1 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=3 ttl=255 time=1 ms
> > 64 bytes from MMM.NNN.50.1: icmp_seq=4 ttl=255 time=0 ms
> >
> > ----MMM.NNN.50.1 PING Statistics----
> > 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip
>
> > (ms)  min/avg/max/med = 0/15/73/1
> >
> > I believe that is an internal Windows issue (something to do with the
> > delay of loading the ICMP.dll) and not related to actual
> > time-of-flight of the ICMP echo.
> >
> > When I have used windows ping in doing doing network analysis from
> > scripts I either disregard the first response (or use another ping
> > program!)
> >
> >
> > Martin Visser
> >
> > Technology Consultant
> > Consulting & Integration
> > Technology Solutions Group - HP Services
> >
> > 410 Concord Road
> > Rhodes NSW  2138
> > Australia
> >
> > Mobile: +61-411-254-513
> > Fax: +61-2-9022-1800
> > E-mail: martin.visserAThp.com
> >
> > This email (including any attachments) is intended only for the use of
>
> > the individual or entity named above and may contain information that
> > is confidential, proprietary or privileged. If you are not the
> > intended recipient, please notify HP immediately by return email and
> > then delete the email, destroy any printed copy and do not disclose or
>
> > use the information in it.
> >
> >
> > -----Original Message-----
> > From: ethereal-dev-bounces@xxxxxxxxxxxx
> > [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of Anis BEN
> > ABDALLAH
> > Sent: Monday, 12 June 2006 8:20 PM
> > To: ethereal-dev@xxxxxxxxxxxx
> > Subject: [Ethereal-dev] Ethereal timings vs ping timings
> >
> > Hello,
> >
> > I'm testing an embedded ethernet device and when trying with the ping
> > command, I have a different timings between reply timings indicated by
>
> > the ping command in the dos window and timings indicated in the
> > ethereal (time delta from previous packet)
> >
> > For example for the first reply I got "time = 9ms" in dos window while
>
> > in ethereal I have "time delta from previous packet = 0.00055 s"
> >
> > Why this difference?
> >
> > Thanks for your help.
> >
> > Anis
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev