Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One might expect the sum of the tracert latencies to equal 267ms:

pingrt

share|improve this question
    
I've never noticed this, nor given it any thought. I would guess that it takes more time for a hop to determine that the TTL has expired and send an ICMP response back than it does to just pass an ICMP packet on to the destination. Furthermore - the latencies shown in tracert should not be added up for a total. The last hop latency should be around the same timing as a ping. You might want to try tracert -d, to prevent it from resolving the hostname of every hop along the way, and see if that makes any difference to the times. –  Adam Thompson Mar 26 at 10:58

2 Answers 2

up vote 9 down vote accepted

Traceroute involves sending UDP packets to each node along the way, and waiting for its timeout response (then moving on to the next node), whereas a ping is just forwarded. What you're seeing is the time it takes for each node to respond to the request instead of just forwarding a small packet.

This is a pretty nice explanation of the whole process, and the differences.

http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/12778-ping-traceroute.html

Have a look at the performance section, which explains also why ping isn't a particularly accurate method for determining latency.

share|improve this answer
    
Another thing that needs to be considered is that ICMP requests are often punted to the router's control plane, and as such are aw dependent on the relative CPU load of the router. "Normal" routed packets are forwarded in hardware, where there is orders of magnitude more capacity available. –  EEAA Mar 26 at 12:31
    
Yeah, they're both dealt with at the control plane, but a ping is dealt with by just one, whereas traceroute does it on every single router on the way there. The performance section of that cisco document has a pretty good description of why it is not a good indicator of latency (primarily due to it being an "out of band" bit of work that gets done when the router has time). –  NickW Mar 26 at 12:39
    
As EEAA notes, tracert uses ICMP, not UDP. –  Gabe Mar 26 at 18:48
    
    
This is what I expected. Thankyou for the confirmation and authoritive link. –  verbumSapienti Mar 27 at 14:03

Routers tend to give timeouts and echo response handling lower priority than packet forwarding. This allows the switch to operate more efficiently as forwarding is much simpler to process than generating a new ICMP responce. As a result busier switches will take longer to generate the response.

Some switches may have ICMP generation disabled which makes diagnosing network issues with them diffficult. Other may occasionally get busy enough that they fail to respond.

If you use a tool which displays the IP address of the routers along the way, you will usually see the switches which are slower are core switches in major cities. My preference is mtr with running every 15 to 60 seconds.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.