One might expect the sum of the
tracert latencies to equal 267ms:
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Traceroute involves sending UDP packets to each node along the way, and waiting for its timeout response (then moving on to the next node), whereas a ping is just forwarded. What you're seeing is the time it takes for each node to respond to the request instead of just forwarding a small packet.
This is a pretty nice explanation of the whole process, and the differences.
Have a look at the performance section, which explains also why ping isn't a particularly accurate method for determining latency.
Routers tend to give timeouts and echo response handling lower priority than packet forwarding. This allows the switch to operate more efficiently as forwarding is much simpler to process than generating a new ICMP responce. As a result busier switches will take longer to generate the response.
Some switches may have ICMP generation disabled which makes diagnosing network issues with them diffficult. Other may occasionally get busy enough that they fail to respond.
If you use a tool which displays the IP address of the routers along the way, you will usually see the switches which are slower are core switches in major cities. My preference is
mtr with running every 15 to 60 seconds.
The times at each hop of a trace route is the Round Trip Time (RTT). In your
ping test four echo requests each took 267ms to receive an echo reply from 126.96.36.199. In the
tracert test three echo requests took 292ms to receive a reply.
The sample size is small. More tests should be run to improve the accuracy of the measured difference.
traceroute -I) has different sized payloads than
ping. Use a packet sniffer to check the size of the payload your trace program uses. Set the size of the
ping payload to that value with
ping -l <size> or
ping -s <size> depending on your ping program.
An echo reply requires use of the CPU so a busy machine could have a large RTT standard deviation compared to one that is idle.
Domain names can resolve to multiple IP addresses. Use the IP address in the command to ensure tests are traveling the same path.
WinMTR is another program for tracing a path that also calculates RTT standard deviation, loss, and other stats.
Wireshark is a popular packet analyzer for viewing the contents of packets sent and received.