Hi there, On Tue, 2 Apr 2013, Gregory Sloop wrote:
> Not exactly about smokeping, more about tcpping. Not quite on topic then. :) > So, since TCPPing is building a TCP link [via SYN/RST] - I'd assume > that low level packet loss that might be seen in an UDP/ICMP ping > won't be present in a TCPPing, right? Nope. > Now if the loss is quite large [my guess is at least 15% or more] > you'll see some of that packet loss in the TCPPing probe too. [Though > I'd expect the level of loss to be lower since the TCP stack is > handling loss and doing re-transmits in the background.] > > It's only when the packet loss rate is such that TCP can't handle the > loss internally and starts being unable to handle re-transmission > before timeout that you'd see actual loss on a TCPPing. > > Do I have this right, or should I go back to huffing glue? Depends on how the TCPPing probe does its stuff. There are several out there and I haven't looked seriously at any of them, but my understanding is that the TCPPing probe simply sends a SYN packet and waits for the reply ACK packet. If either packet gets lost it will have the same effect as losing a ping packet. Check out hping, or maybe look at nmap's Idle Scan -- 73, Ged. _______________________________________________ smokeping-users mailing list smokeping-users@lists.oetiker.ch https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
