Interpreting a thinkbroadband monitor graph

[ou7shined]

How does one interpret these graphs? For example what does the yellow mean (in layman's terms please)?
Mine looks very different to those posted here.

[Bill]

From the tbb site:

How does our Broadband Quality Monitoring work?

We have partnered with Firebrick who manufacture the FB6000 device, which produces a device which is designed for high scale testing of latency and packet loss, which is connected to the same high speed uncongested network as our speed test.

The Firebrick device sends out an ICMP echo request (a 'ping') packet and measures how long it takes for your router (or computer if you have a DSL modem) to respond. We then plot the graph based on 100 seconds' worth of pings for each point to show the minimum, maximum and the average (mean) latency. If any packets are dropped (i.e. we don't receive a response), this will be drawn in red from the top of the graph down.


(Click on one of the graphs to go there)

The legend is along the bottom-

Green = lowest ping
Yellow = highest ping
Blue =  average ping
Red= % packet loss over 100 second sampling time.

[Rik]

This may be a dumb question, but doesn't this measure latency and packet loss between two points, and may not be typical of overall performance, eg if there's an issue with the specific routing? Also, would not the domestic router give low priority to pings when 'working' hard?

[Bill]

This may be a dumb question, but doesn't this measure latency and packet loss between two points, and may not be typical of overall performance, eg if there's an issue with the specific routing?

That's true, but then exactly the same reservation applies to speed tests. But it runs continuously without having to worry about whether your own computer is on or not, so it's quite useful for spotting trends or repeated events (like the packet loss increase just after midnight). It's another tool in the box, that's all.

Also, would not the domestic router give low priority to pings when 'working' hard?

That's the point- the same applies to any router on the path, most usefully at the exchange, so if you experience a slowdown, a look at the graph might indicate whether there's congestion anywhere.

If you look at my trace a couple of posts up, those two big yellow spikes are when I was running speed tests. If I see a brief red spike when I start up in the morning I go to the BT speedtest and see whether the DLM has given my profile a hit overnight

It's a source of information... it's up to the human beings to decide whether or not that information is useful or relevant in any given situation, and what use can be made of it.

[Rik]

Thanks for the clarification, Bill. 

[ou7shined]

From the tbb site:

How does our Broadband Quality Monitoring work?

We have partnered with Firebrick who manufacture the FB6000 device, which produces a device which is designed for high scale testing of latency and packet loss, which is connected to the same high speed uncongested network as our speed test.

The Firebrick device sends out an ICMP echo request (a 'ping') packet and measures how long it takes for your router (or computer if you have a DSL modem) to respond. We then plot the graph based on 100 seconds' worth of pings for each point to show the minimum, maximum and the average (mean) latency. If any packets are dropped (i.e. we don't receive a response), this will be drawn in red from the top of the graph down.


(Click on one of the graphs to go there)

The legend is along the bottom-

Green = lowest ping
Yellow = highest ping
Blue =  average ping
Red= % packet loss over 100 second sampling time.

Thank you very much but none of that is news to me (I may not have an aptitude for networking but I can read ). I want to know how to interpret the charts, especially what the yellow means. For example when Bill said that his two big yellow spikes are when he was running speed tests does that simply mean that yellow shows when you are using the net or is it indicating general dips your connections fitness?

[Rik]

Usually it's indicative of activity on your machine, Rich, which causes a delay to the ping response.

[Tacitus]

Isn't this exactly the same as what AAISP do and make a feature of in their sales pitch?  They use and, I believe, helped to develop the Firebrick range.  Firebricks aren't exactly cheap either. 

[Bill]

but I can read

I've no doubt that you can, but asking what the yellow meant when it's described in the legend gave the impression that you hadn't

No matter.

As far as interpreting the trace goes, it's not really a question that has an answer. It simply gives you some information about the link between your computer and the tbb server. If you suspect you may have a problem, looking at the ping times and lost packets may give you a clue where the problem lies- if there's a lot of yellow (or red) then it's likely there's a busy (congested) router somewhere (either yours- check for downloading somewhere else on your LAN, or likely at the exchange). Many people see an increase in lost packets just after midnight when everybody's off-peak time (ie congestion) kicks in, so a good time to avoid downloads if you want decent speed.

As I said earlier to Rik, it just provides some extra information, what you do with it will depend on the circumstances.

You said that yours looked different to the others, could you post a typical one? We'll do what we can to get something useful out of it

[esh]

Sorry I just found this. I use another means for monitoring lag and packet loss but I have constant data from the 23rd onwards. Would you care for me to post any of it, or just the bits showing packet loss, or not at all? They are plots that are vaguely similar but not the same as above.

[pctech]

Isn't this exactly the same as what AAISP do and make a feature of in their sales pitch?  They use and, I believe, helped to develop the Firebrick range.  Firebricks aren't exactly cheap either. 

You are correct, AAISP co-own Firebirck Limited with another ISP called Watchfront.

[ou7shined]

Thanks for the replies guys. I think this explains my confusion...

[DorsetBoy]

    that looks like an early Damien Hirst .

I would go back and create a new monitor, there is something very amiss there.

[esh]

There could be an extremely large standard deviation in the latency, but it would have to be consistent to create such a plot, but it is possible... but yeah, it looks odd.

[Steve]

Latency deviation outside the range of the graph with a continuos download 24/7??

[Bill]

Thanks for the replies guys. I think this explains my confusion...

That looks horrible... but that doesn't mean it's not right

What does a command-line ping give?

I use a Mac so I'm not sure of the DOS command options, but

ping -i 60 -c 60 idnet.com

should send a ping once a minute for an hour, a look at the results might indicate whether the problem is real or something amiss with the monitor.


(If the above command is wrong for an MS machine, maybe someone could give the correct version?)

[Bill]

On second thoughts...

Although you're getting off-scale maximum pings, the average (blue) isn't visible, implying that it's not significantly different to the minimum (green). It would only need one long ping in each 100 second sampling interval to give a trace like that.

Have you got something that connects to the internet around once a minute, that could be hogging the router for at least a second each time and thus giving a regular high ping?

[Rik]

You can specify the number of pings in DOS, Bill, with the -n switch, but not, afaik, the interval.

[Bill]

That's a bit of a pain... an hour's worth of pings might not be so convenient in that case. Thanks Rik

[Rik]

It would be long.

[esh]

If you download a Python installation for windows you can run the following code which will make a file with a ping in it every one minute, don't forget to change the ping address to something sensible

Code Select Expand


import os,time,datetime
z = open('ping.txt','a')
while True:
   link = os.popen('ping -n 1 127.0.0.1')
   data = link.read()
   data = data.split("\n")
   if len(data) > 2:
      now = datetime.datetime.utcnow()
      start = data[2].find('time')+5
      end = data[2].find(' ',start)-2
      ping = data[2][start:end]
      z.write(str(now) + " " + str(ping) + "\n")
   time.sleep(60)


[.Griff.]

I think this has gone slightly off topic from psp's original intention.

Any chance of a tidy up?

[Rik]

You mean from ou7 down?

[.Griff.]

If that's ok Rik.

I'm guessing psp wanted the information for something he's putting together for support and all the other posts detract from that.

[Rik]

That's why I made the first split, Griff.