Subject: Pathchar

From: "omurhan akdemir" <[email-masked]>
Date: Sat, 2 Dec 2000 13:02:16 +0200

hi

I wonder what the meaning of negative propagation delay values on pathchar's output is.
sample output:

2 sdscdmz-fddi.cerf.net (198.17.46.153)
 |    45 Mb/s,   -13 us (2.70 ms)
 3 qualcomm-sdsc-ds3.cerf.net (134.24.47.200)

By the way, is there any way of plotting rtt of each probe of each sample versus packet size?

Kind regards
omurhan

---

From: Mark Santcroos <[email-masked]>
Date: Mon, 4 Dec 2000 08:54:45 +0100

> I wonder what the meaning of negative propagation delay values on
Hi Omurhan,

Some types of networks are intrinsically difficult for pathchar to
measure.  Two notable examples are switched networks (with multiple
queues at Layer 2) or striped networks.  

Router implementations may very well forward a packet faster than they
can return an ICMP error message in response to a packet.  Because of
this fact, it's possible to see faster response times from longer
partial paths; the result is a seemingly non-sensical, negative
estimate of per-hop round-trip time.

Btw. I suggest you to look at:
http://www.employees.org/~bmah/Software/pchar/

Pchar is an open source re-implementation of Van Jacobson's Pathchar
utility. (It is also where I have shamelessly stole the answer about
negative rrt's from)

Regards,

Mark

-- 
Mark Santcroos			   RIPE Network Coordination Centre

PGP KeyID: 1024/0x3DCBEB8D 
PGP Fingerprint: BB1E D037 F29D 4B40 0B26  F152 795F FCAB 3DCB EB8D

---

From: [email-masked] (Bruce A. Mah)
Date: Tue, 05 Dec 2000 13:30:14 -0800

> > I wonder what the meaning of negative propagation delay values on

[snip]

> queues at Layer 2) or striped networks.  

These facts are true, but most likely not quite the explanation for 
what the original poster was asking about.

> estimate of per-hop round-trip time.

This is more likely to be the case.  Another possibility is that large
(or fluctuating) queue lengths at an interface can interfere with the
linear fit algorithms used by pathchar.

> utility. (It is also where I have shamelessly stole the answer about

:-)

Another implementation is clink; while it doesn't run on as many
platforms as pchar does, it does a couple of things that pchar doesn't
do such as kernel-level timestamps.  There's a link to it from pchar's
Web page.

Bruce.