Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I Pinged Google for a Week, with 10 Pings per Second, and I found out that my Ping has 3 or more "Bands": Here's a screenshot screenshot (The Interupt was a short stop in Pinging, and the Spikes my own usage, every thing else I have is "clear" from "noise"). All the other Pings where nice on one Line.

Is this because of the Google Network Server infrastructure? It also shows quite well on which times the Users are using the Internet (Or Google?). I logged all the Pings I send off, and I also was Pinging a few other Servers so I can plot them into the Plot if necesary for comparing them. I also pinged a Server with TTL=2 to get a Reference on the Network Usage. I also can put the Logs to DropBox or SkyDrive if needed (All together up to 6GB of Logdata).

Thanks for Helping.

System: Win 7, Internet over CableModem 35 MBit

share|improve this question

migrated from Mar 27 '13 at 14:57

This question came from our site for information security professionals.

Out of curiosity... What numbers represent the bottoms of those bands? 21, 31, and 41? Maybe Benfords Law?'s_law – BrianAdkins Mar 27 '13 at 11:25
@BrianAdkins Benford's law refers to the most-significant digit, not the least-significant. But thanks for the interesting reading; I hadn't heard of that before. – bonsaiviking Mar 27 '13 at 11:43
D'oh... You're right... My bad – BrianAdkins Mar 27 '13 at 12:23
I don't know if there is an answer for this, but it's probably best suited for – LamonteCristo Mar 27 '13 at 13:48
up vote 2 down vote accepted

I would expect the appearance of "bands" from any server, not only Google, because the number of hops from your modem to a distant server is bound to vary with time. But if this were network rerouting, you would not have clearly parallel bands; you'd use band #0 maybe 90% of the time during the morning, and "see" bands #0 and #1, and maybe a weak band #2, then maybe in the afternoon you'd see bands #1 and #2 and a beginning of band #3, and so on. You'd see "serially stepped" bands: __--==_=--=_ .

Here, the ping times apparently accumulate in several bands at roughly fixed intervals: -==--=====-.

By running a test, it is clear that we're looking at TTL changes:

64 bytes from ttl=56 time=12.5 ms
64 bytes from ttl=56 time=12.5 ms
64 bytes from ttl=55 time=24.2 ms
64 bytes from ttl=56 time=27.7 ms
64 bytes from ttl=55 time=24.5 ms
64 bytes from ttl=56 time=12.8 ms

Same thing with hping:

len=46 ip= ttl=55 port=80 flags=SA rtt=23.9 ms
len=46 ip= ttl=56 port=80 flags=SA rtt=11.7 ms
len=46 ip= ttl=55 port=80 flags=SA rtt=24.5 ms
len=46 ip= ttl=56 port=80 flags=SA rtt=11.8 ms

So apparently the path from me to Google varies in length with a duty cycle of around two packets, and fifty per cent of the times the path makes an extra hop that requires around 12ms. So I'm seeing two "bands" with a distance of about 12ms.

Also, if I send packets with TTL 8, they are all lost; if I use TTL 9, they are all answered, and about 50% of them have the extra hop. So I guess that is receiving network traffic, then regenerates it and forwards it to some host 2 or 3 hops behind itself, which in turn answers this traffic. The traffic is then routed back, but not regenerated, so we're seeing the TTL from the host beyond the proxy instead of the one of the proxy.

Note on TTL

When in the comment I read, "a TTL of 2", I translated mentally into "a hop count of 2", which is impossible because the shortest route from Switzerland to Australia is seven hops (via geosynchronous satellite relay; return trip time is around one full second). The value I gave, calling it (incorrectly) TTL, of 15 to 20, was the hop count.

An Australian host generating PING replies with native TTL of 64 would then have the ping utility show on arrival a ttl value of around 45. If it generated replies with TTL of 128, it would produce a report of ttl around 110.

share|improve this answer
Thanks for this Answer, it think you are right. I live in Switzerland, and i Pinged also to Australia (more Noise i know), but it also appears there. Now i just need to figure out, if its my Connection, or generally. – Kalabint Mar 27 '13 at 22:32
I made another Plot with 3 Pings in it, and i also made a Plot with the TTL on the Y-Axis and the TTL is always the same. – Kalabint Mar 27 '13 at 22:51
If you mean that 'TTL=2', that can't be correct. Try running a traceroute from the command line; a more likely value would be around 15-20. – lserni Mar 28 '13 at 0:01
@Iserni Sure? Is this right so? >ping -i 2 Ping wird ausgeführt für mit 32 Bytes Daten: Antwort von Bytes=32 Zeit=11ms TTL=254 Antwort von Bytes=32 Zeit=15ms TTL=254 Antwort von Bytes=32 Zeit=9ms TTL=254 Antwort von Bytes=32 Zeit=10ms TTL=254 Or: tracert 5 12 ms 12 ms 12 ms 6 19 ms 18 ms 31 ms 7 26 ms 25 ms 25 ms 8 29 ms 28 ms 27 ms – Kalabint Mar 28 '13 at 0:29
Yes, the traceroute shows at least eight hops to (I have twelve to TTL=254 would seem to mean that you're either pinging a host next door to you (is your ISP?), that answers with a 'pong' with TTL 255, and this decays to 254 on arriving to you. pongs with TTL 64, so ping should report to you a TTL around 56, signifying eight hops. I may have expressed myself badly, I'll update the answer. – lserni Mar 28 '13 at 11:39

I won't go in details into how INTERNET protocol works but internet unlike circuit switched is a packet oriented meaning the path between source and destination is never fixed. It takes multiple unique paths and depening upon congestion and other routing policy issues esp in regard to QoS can make a router alter / make changes in its routing information to change its path to destination. This is why you see varying rrt values.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .