Well, although there's no entirely fool-proof way, We've found a better way of monitoring "real" outages/issues is to monitor the time required to setup a tcp connection to some "trusted" machines. For example, in our VA datacenter we monitor the time required to setup a connection with tier1 providers (UU,BBN,DIGEX for example) nameservers (on port 53).. We've found it slightly more reliable than ICMP reqs, especially since when routers get busy, it shows as degradation vs. outage. Matt -- Matt Levine, CTO <mlevine@efront.com> eFront Media, Inc. - http://www.efront.com Phone: +1 714 428 8500 ext. 504 Fax : +1 949 203 2156 ICQ : 17080004 -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Paul Vixie Sent: Monday, December 18, 2000 12:04 AM To: nanog@merit.edu Subject: Re: Pinging routers for network status sean@donelan.com (Sean Donelan) writes:

Most network providers ping their routers for network status. Several providers even track RTT to detect changes. But very few customers connect to routers. Comparing the performance you see with HP Openview or similar products with the performance customers see remains an interesting question. Sometimes C&W's or AT&T's traffic web site does show a problem. But there are also problems that don't show up in intra-network pings. In particular IGP/BGP routing issues can result in severe access network problems, but no problem with the internal provider network mesh used for pings.

Similarly, long or deviant ping times against a router can just indicate that it was processing a routing update when it got your ICMP_ECHO request. Therefore the RTT isn't nec'ily indicative of link latency. (SNMP is worse.) If you want to know how fast your network is, send a normal payload. Even source routing will variously have to be "processor switched" or otherwise escape the "fast path" on many modern routers. Ping and Traceroute are for when you already know you're screwed, but you're trying to prove it to other people or you're trying to draw finer distinctions. When the network isn't failing, Ping and Traceroute tell you pretty much nothing. Of course, using normal payloads to measure network health requires agents on the far side, and thus, is a more difficult design and deployment problem. (If you don't think of this as a hard problem, you're not doing it right.)