[smokeping-users] TCP Ping and packet-loss

[G.W. Haywood]

Hi there,

On Tue, 2 Apr 2013, Gregory Sloop wrote:

> Not exactly about smokeping, more about tcpping.

Not quite on topic then. :)

> So, since TCPPing is building a TCP link [via SYN/RST] - I'd assume
> that low level packet loss that might be seen in an UDP/ICMP ping
> won't be present in a TCPPing, right?

Nope.

> Now if the loss is quite large [my guess is at least 15% or more]
> you'll see some of that packet loss in the TCPPing probe too. [Though
> I'd expect the level of loss to be lower since the TCP stack is
> handling loss and doing re-transmits in the background.]
>
> It's only when the packet loss rate is such that TCP can't handle the
> loss internally and starts being unable to handle re-transmission
> before timeout that you'd see actual loss on a TCPPing.
>
> Do I have this right, or should I go back to huffing glue?

Depends on how the TCPPing probe does its stuff.  There are several
out there and I haven't looked seriously at any of them, but my
understanding is that the TCPPing probe simply sends a SYN packet
and waits for the reply ACK packet.  If either packet gets lost it
will have the same effect as losing a ping packet.

Check out hping, or maybe look at nmap's Idle Scan

--

73,
Ged.