<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EL link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I would be expecting security people to worry if it’s a compromised host scanning the network (that has happened to me) but not the network admins.. I totally agree with Eric.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Eric Brander [mailto:mailinglists@rednarb.com] <br><b>Sent:</b> Wednesday, October 09, 2013 7:29 PM<br><b>To:</b> Hopkins, Charles G.<br><b>Cc:</b> smokeping-users@lists.oetiker.ch<br><b>Subject:</b> Re: [smokeping-users] Smokeping - Why 20 pings?<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Oct 9, 2013 at 10:18 AM, Hopkins, Charles G. <<a href="mailto:charlesghopkins@gmail.com" target="_blank">charlesghopkins@gmail.com</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal>I'm sure this has probably been asked before, but why was the number 20 chosen as the number of pings to use for SmokePing?<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>Sincerely,<o:p></o:p></p><div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'><br><b><i><span style='font-size:13.5pt;font-family:"Comic Sans MS";color:#660000'>Chaz</span></i></b><o:p></o:p></p></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The more data you have, the more the smoke is more relevant. Since the smoke is essentially measuring jitter, or at least the variance between multiple ping response times, the more that are tested and recorded the more useful the data can be. Plus you can set the size of the pings to something smaller if it helps but really, if your network can't handle that many pings then there is something else to be concerned about. If pings are making the top of any utilization graph then I would guess that network path isn't very highly utilized at all and there really shouldn't be anything to worry about. Sure, oodles and oodles of pings can look daunting, especially to a nubile network admin who just got a hold of wireshark or netflow for the first time...<o:p></o:p></p></div></div></div></body></html>