[smokeping-users] Any downsides to running less probes more frequently?

[Jim Long]

On Sat, Jul 26, 2008 at 02:35:18AM +1000, David Tomic wrote:
> Chris Wilson wrote:
> >
> > More detail on the time axis, yes. Less detail on the packet loss and 
> > latency axes, if you cut the number of pings.
> >
> 
> Sorry ... but I'm still not really clear on this. 
> 
> What is the detail that I'm losing in the packet loss/latency data by 
> sending fewer pings?
> 
> Is it basically just that [for example] a single dropped packet will 
> count for 20% packet loss with only 5 probes being sent, vs only 5% with 
> 20 being sent ... or is there something else involved that I'm still not 
> quite understanding here?

IANA statistician, nor am I a smokeping guru, but some "thought
experiment" observations....

It seems to me that a side-effect of this is that if you have an
issue with a link which results in a small but persistent loss, say
5%, you might not trigger it with a small sample of 5 pings.

Suppose there is a problem with one of the links common to all your
targets that creates a 5% loss.  That means one out of 20 packets
will be dropped.  You could conceivably ping three targets cleanly
with five pings each, and then drop one ping out of five on the
fourth target, a total loss of one packet in 20.

Your graphs would mistakenly show that three targets are 100%
perfect, and one target has 20% packet loss, when in fact all of the
targets have a problem, and they are all losing 5% of their packets.
On the next 60-second samping interval, the link that had 20% loss
could be fine, and one of the previously perfect links would now
show the 20% loss.

So it's not just detail you'd be losing, you're losing accuracy as
well.  It reminds me a little bit of digital audio sampling rates:
the sampling rate determines the accuracy of the digital
representation of the waveform.

To bring it back to networking, it depends on your tolerances.  A
probe of 5 pings will not be able to measure packet loss less than
20%.  So if 10% or 15% loss is acceptable, then a 5-ping probe should
work.  Just be aware that "100%" on the graph really means "more
than 80%" and that an intermittent large 20% loss could in fact be a
steady, persistent 2% loss that just takes a while before it adds up
to 20%, the smallest loss that can be detected by a five-probe ping.

But again, this is just from scratching my chin and gazing at the
wall, so I welcome comments and corrections from anyone with actual
expertise in these sciences.

Jim