Next: Measurement infrastructures
Up: Measuring packet loss
Previous: Measuring packet loss
Common ICMP-based tools, such as ping and traceroute, send
probe packets to a host, and measure loss by observing whether
or not response packets arrive within some time period. There are two
principle problems with this approach:
- Loss asymmetry. The packet loss rate on the forward path
to a particular host is frequently quite different from the packet
loss rate on the reverse path from that host. Without any additional
information from the receiver, it is impossible for an ICMP-based
tool to determine if its probe packet was lost or if the response was
lost. Consequently, the loss rate reported by such tools is really:
Where lossfwd is the loss rate the forward direction and
lossrev is the loss rate in the reverse direction. Loss
asymmetry is important, because for many protocols the relative
importance of packets flowing in each direction is different. In TCP,
for example, losses of acknowledgment packets are tolerated far
better than losses of data packets. Similarly, for many streaming media
protocols, packet losses in the opposite direction from the data stream
have little or no impact on overall performance. The ability
to measure loss asymmetry allows a network engineering to more
precisely locate important network bottlenecks.
- ICMP filtering. ICMP-based tools rely on the
near-universal deployment of the ICMP Echo or ICMP Time
Exceeded services to coerce response packets from a host [Bra89].
Unfortunately, malicious use of ICMP services has led to mechanisms
that restrict the efficacy of these tools. Several host operating
systems (e.g. Solaris) now limit the rate of ICMP responses, thereby
artificially inflating the packet loss rate reported by ping.
For the same reasons many networks (e.g. microsoft.com) filter ICMP
packets altogether. Some firewalls and load balancers respond to ICMP
requests on behalf of the hosts they represent, a practice we call
ICMP spoofing, thereby precluding real end-to-end measurements.
Finally, at least one network has started to rate limit all ICMP
traffic traversing it. It is increasingly clear that ICMP's future
usefulness as a measurement protocol will be reduced [Rap98].
Next: Measurement infrastructures
Up: Measuring packet loss
Previous: Measuring packet loss
Stefan Savage
8/31/1999