Ping explained: latency, packet loss and jitter

What a ping does

Ping sends a small ICMP Echo Request to a host and waits for an Echo Reply. RFC 792 defines the pair for IPv4 (types 8 and 0) and RFC 4443 defines it for IPv6 (types 128 and 129). The reply carries back the same identifier, sequence number and data, so the sender can match each reply to its request and time it.

A typical command line run sends one request per second and prints a line per reply, then a summary. On Linux it looks like this:

64 bytes from 203.0.113.7: icmp_seq=1 ttl=54 time=12.4 ms
64 bytes from 203.0.113.7: icmp_seq=2 ttl=54 time=12.9 ms
--- 203.0.113.7 ping statistics ---
4 packets transmitted, 3 received, 25% packet loss
rtt min/avg/max/mdev = 12.4/12.7/13.1/0.3 ms

Latency: round-trip time

The time= value is the round-trip time (RTT): from sending a request to receiving its reply, the measure RFC 2681 defines. It adds up four kinds of delay on the way there and back:

• Propagation: light in optical fibre travels at roughly two thirds of its speed in a vacuum, about 200 km per millisecond. Every 100 km of fibre adds about 1 ms to the round trip, and real cable routes are longer than a straight line.
• Serialization: the time to put the packet onto each link, small on fast links.
• Queuing: time spent waiting in router buffers when links are busy. This is what makes latency rise under load.
• Processing: the target and routers handling the packet. Hosts and routers often treat ping as low priority, so it can read a little slower than real traffic.

Because distance sets a floor, compare a probe’s result with how far away it is. A few milliseconds within a city, tens of milliseconds across a continent and 150 to 300 ms between continents are all normal. ITU-T G.114 treats up to 150 ms one way as acceptable for most interactive voice, which is why the Ping tool marks round trips over 150 ms as slow.

Packet loss

A request with no reply before the timeout counts as lost. Loss is the share of requests that went unanswered, the idea RFC 7680 formalizes. One lost packet out of a handful is common on the internet and usually harmless; TCP resends what it loses. Loss that stays above a few percent on the same path slows downloads, drops calls and makes video stutter.

Loss can happen on the way there or on the way back, and ping cannot tell which. Routers also rate-limit ICMP, so a little loss to a busy router does not always mean real traffic is affected.

Jitter

Jitter is how much the delay changes from one packet to the next, which RFC 3393 calls IP packet delay variation. Steady replies of 40, 41 and 40 ms have little jitter; replies of 20, 90 and 35 ms have a lot, even with a similar average. Jitter matters most for live audio and video, which buffer to smooth it out. On Linux, the mdev figure in the summary is the standard deviation of the replies, a related measure of spread.

When a host doesn’t answer

No reply does not prove a host is down. Many firewalls and cloud providers drop ICMP Echo Requests on purpose, and some hosts are set not to answer. The same server can answer web traffic on TCP port 443 perfectly well. If ping fails, try a TCP connection to a port the host serves, check the host name resolves, and compare probes in different places: a host that answers from some networks but not others points to routing or regional filtering.

Blocking all ICMP has costs. IPv6 depends on ICMPv6 messages such as Packet Too Big, and RFC 4890 recommends against filtering ICMPv6 wholesale. Echo can safely be rate-limited rather than blocked.

Ping from many places

A ping from your own computer measures your connection as much as the target. Running it from probes in several regions separates the two: if every probe sees a slow reply, the problem is near the target; if only one region does, it is on that path. Hosts behind a CDN or anycast may answer from a nearby copy, so every probe can see a low time and a different address. The Ping tool runs from probes worldwide and charts each location’s fastest, average and slowest reply, its loss and its jitter.