1. The Elements of Network Performan c e
M u c h w o r k has bee n de v o t e d to th e atte m p t to de f i n e ne t w o r k pe r f o r m a n c e
exac t l y . It is no t the in t e n t i o n of th is bo o k to bo r e yo u w i t h n u m e r o u s eq u a t i o n s
th a t desc r i b e the o r e t i c a l ne t w o r k p h i l o s o p h y ab o u t h o w pa c k e t s tra v e r s e
net w o r k s . N e t w o r k pe r f o r m a n c e is a co m p l e x iss u e, w i t h lo ts of in d e p e n d e n t
va r i a b l e s th a t affe c t h o w clie n t s access ser v e r s acr o s s a ne t w o r k . H o w e v e r , m o s t
of the ele m e n t s in v o l v e d in th e pe r f o r m a n c e of ne t w o r k s ca n be bo i l e d d o w n to
a fe w si m p l e net w o r k p r i n c i p l e s th a t ca n be m e a s u r e d , m o n i t o r e d , an d co n t r o l l e d
b y the net w o r k ad m i n i s t r a t o r w i t h si m p l e — o f t e n free — s o f t w a r e .
M o s t net w o r k pe r f o r m a n c e to o l s use a co m b i n a t i o n of fi v e se p a r a t e ele m e n t s
to m e a s u r e net w o r k pe r f o r m a n c e :
■■ A v a i l a b i l i t y
■■ Res p o n s e ti m e
■■ N e t w o r k ut i l i z a t i o n
■■ N e t w o r k th r o u g h p u t
■■ N e t w o r k ba n d w i d t h ca p a c i t y
T h i s secti o n desc r i b e s eac h of th ese ele m e n t s, an d ex p l a i n s h o w ne t w o r k
pe r f o r m a n c e too l s use eac h ele m e n t to m e a s u r e ne t w o r k pe r f o r m a n c e .
Availability
T h e firs t ste p in m e a s u r i n g ne t w o r k pe r f o r m a n c e is to de t e r m i n e if th e ne t w o r k
is eve n w o r k i n g . If tra f f i c ca n n o t tra v e r s e th e ne t w o r k , yo u ha v e bi g g e r
p r o b l e m s tha n just ne t w o r k pe r f o r m a n c e iss u e s. T h e si m p l e s t test fo r ne t w o r k
ava i l a b i l i t y is th e p i n g p r o g r a m . By atte m p t i n g to pi n g re m o t e ser v e r s fr o m
a clie n t de v i c e o n th e ne t w o r k , yo u ca n easil y de t e r m i n e th e sta te of yo u r
net w o r k .
Just abo u t all U n i x i m p l e m e n t a t i o n s in c l u d e th e pi n g p r o g r a m to q u e r y
re m o t e hos t s fo r av a i l a b i l i t y . T h e pi n g p r o g r a m sen d s an In t e r n e t Co n t r o l M e s s a g e
Pr o t o c o l (IC M P) ech o re q u e s t pa c k e t to th e dest i n a t i o n h o s t. W h e n th e
ech o re q u e s t pac k e t is rece i v e d , the re m o t e h o s t i m m e d i a t e l y re t u r n s an ech o
re p l y pac k e t to the sen d i n g de v i c e .
W h i l e m o s t net w o r k ad m i n i s t r a t o r s k n o w w h a t th e p i n g p r o g r a m is, fe w
k n o w tha t the r e are lo ts of fa n c y o p t i o n s th a t ca n be use d to pe r f o r m ad v a n c e d
test i n g usi n g the p i n g p r o g r a m . T h e fo r m a t of th e pi n g co m m a n d is:
ping [-dfnqrvR] [-c count] [-i wait] [-l preload] [-p pattern] [-s
packetsize]
4 Chapter 1
Y o u can use di f f e r e n t co m b i n a t i o n s of o p t i o n s an d pa r a m e t e r s to crea t e th e
pi n g test th a t best su i t s y o u r ne t w o r k en v i r o n m e n t . O f t e n , just usi n g th e
de f a u l t op t i o n s an d pa r a m e t e r s p r o v i d e s en o u g h in f o r m a t i o n ab o u t a ne t w o r k
li n k to satis f y av a i l a b i l i t y q u e s t i o n s .
Recei v i n g an ech o re p l y pa c k e t fr o m the re m o t e h o s t m e a n s th a t th e r e is an
ava i l a b l e net w o r k pa t h bet w e e n the clie n t an d ser v e r de v i c e s. If n o ech o re p l y
pac k e t is recei v e d , the r e is a p r o b l e m w i t h eit h e r a ne t w o r k de v i c e or a li n k
alo n g the pa t h (assu m i n g th e re m o t e ser v e r is av a i l a b l e an d ans w e r i n g p i n g s).
By selec t i n g di f f e r e n t re m o t e h o s t s o n the ne t w o r k , yo u ca n de t e r m i n e if all
of the seg m e n t s o n yo u r ne t w o r k are av a i l a b l e fo r tra f f i c. If m u l t i p l e h os t s d o
no t res p o n d to a p i n g re q u e s t, a co m m o n ne t w o r k de v i c e is m o s t li k e l y d o w n .

2. D e t e r m i n i n g the fa u l t y ne t w o r k de v i c e ta k e s so m e de t e c t i v e w o r k o n yo u r
pa r t.
W h i l e sen d i n g a sin g l e p i n g p a c k e t to a re m o t e h o s t ca n de t e r m i n e th e a va i l a b i l i t y
of a net w o r k pa t h , pe r f o r m i n g a sin g l e p i n g b y itse l f is n o t a go o d in d i c a t o r
of net w o r k pe r f o r m a n c e . Y o u oft e n nee d to ga t h e r m o r e in f o r m a t i o n to
de te r m i n e the pe r f o r m a n c e of an y co n n e c t i o n s be t w e e n th e clie n t an d the
ser v e r. A b e t t e r w a y to de t e r m i n e basic ne t w o r k pe r f o r m a n c e is to sen d a stri n g
of m u l t i p l e pi n g re q u e s t pa c k e t s.
Using Availability Statistics
W h e n m u l t i p l e pi n g pa c k e t s are sen t to a re m o t e h o s t, th e pi n g p r o g r a m tra c k s
ho w m a n y res p o n s e s are rece i v e d . T h e res u l t is d is p l a y e d as th e pe r c e n t a g e of
the pac k e t s tha t w e r e n o t rece i v e d . A ne t w o r k pe r f o r m a n c e to o l ca n use th e
pi n g stat i s t i c s to ob t a i n basic in f o r m a t i o n re g a r d i n g the stat u s of th e ne t w o r k
bet w e e n the t w o en d p o i n t s .
By de f a u l t the U n i x p i n g p r o g r a m co n t i n u a l l y se n d s p i n g re q u e s t s to th e
des i g n a t e d re m o t e h os t u n t i l th e o p e r a t o r sto p s th e o p e r a t i o n b y p r e ss i n g a
Ct r l- C ke y co m b i n a t i o n . A l t e r n a t e l y , yo u ca n use th e -c o p t i o n in th e p i n g co m m a n d
to spec i f y a spec i f i c n u m b e r of pi n g re q u e s t s to sen d . Eac h p i n g re q u e s t
is trac k e d sepa r a t e l y usi n g th e IC M P seq u e n c e fie l d .
A sa m p l e pi n g sessi o n th a t uses m u l t i p l e pi n g pa c k e t s lo o k s li k e th is:
$ ping 192.168.1.100
PING 192.168.1.100 (192.168.1.100): 56 data bytes
64 bytes from 192.168.1.100: icmp_seq=0 ttl=255 time=0.712 ms
64 bytes from 192.168.1.100: icmp_seq=1 ttl=255 time=0.620 ms
64 bytes from 192.168.1.100: icmp_seq=2 ttl=255 time=0.698 ms
64 bytes from 192.168.1.100: icmp_seq=3 ttl=255 time=0.662 ms
64 bytes from 192.168.1.100: icmp_seq=4 ttl=255 time=0.649 ms
^C
--- 192.168.1.100 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.620/0.668/0.712/0.033 ms
$
Defining Network Performance 5
In th is exa m p l e , a res p o n s e w a s rece i v e d fo r all of th e pa c k e t s th a t w e r e sen t,
in d i c a t i n g no p r o b l e m s o n th e ne t w o r k . If an y of th e p i n g pa c k e t s d o n o t solic i t
a res p o n s e, it ca n be ass u m e d th a t eit h e r th e ech o re q u e s t pa c k e t di d n o t m a k e
it to the re m o t e ser v e r , or th e re m o t e ser v e r ’ s ech o res p o n s e pa c k e t d i d n o t
m a k e it bac k to th e p i n g i n g clie n t. In eit h e r case, so m e t h i n g o n th e ne t w o r k
ca us e d a pac k e t to be lost.
O n c e yo u esta b l i s h th a t th e r e are lost pa c k e t s in the p i n g seq u e n c e , yo u m u s t
de te r m i n e w h a t ca u s e d th e pa c k e t losses. T h e t w o bi g g e s t ca u se s of lost p a c k e t s
are:
■■ Co l l i s i o n s on a ne t w o r k seg m e n t
■■ Pac k e t s d r o p p e d b y a ne t w o r k de v i c e
W i t h i n an Et h e r n e t seg m e n t , o n l y o n e stat i o n is all o w e d to tra n s m i t at a
ti m e. W h e n m o r e th a n o n e stat i o n atte m p t s to tra n s m i t at th e sa m e ti m e , a coll i s i o n
occ u r s. H a v i n g coll i s i o n s is n o r m a l fo r an Et h e r n e t ne t w o r k , an d n o t
so m e t h i n g tha t sh o u l d ca u s e pa n i c fo r th e ne t w o r k ad m i n i s t r a t o r .
H o w e v e r , as an Et h e r n e t seg m e n t ge ts o ve r l o a d e d , excess i v e coll i s i o n s w i l l
beg i n to ta k e ov e r th e ne t w o r k . A s m o r e tra f f i c is ge n e r a t e d o n the ne t w o r k ,
m o r e coll i s i o n s occ u r. Fo r eac h coll i s i o n , th e affe c t e d se n d e r s m u s t re t r a n s m i t
the pac k e t s tha t ca u s e d th e col l i s i o n . A s m o r e pa c k e t s are ret r a n s m i t t e d , m o r e

3. net w o r k tra f f i c is ge n e r a t e d , an d m o r e coll i s i o n s ca n occ u r . T h i s eve n t is calle d
a collision storm, an d ca n se ve r e l y affe c t the pe r f o r m a n c e of a ne t w o r k seg m e n t .
D r o p p e d pac k e t s ca n also res u l t in p a c k e t losse s. A l l ne t w o r k de v i c e s co n t a i n
pac k e t bu f f e r s. A s pa c k e t s are rece i v e d fr o m th e ne t w o r k , th e y are pl a c e d
in a pac k e t b u f f e r , w a i t i n g fo r th e i r tu r n to be tra n s m i t t e d . T h i s is de m o n s t r a t e d
in Fig u r e 1.1.
Figure 1.1 Dr o p p i n g pa c k e t s in a n et w o r k d e v i c e .
pa c k e t
buff e r
m u l ti p o r t 10/1 0 0 s wit c h
1 00 M B
1 00 M B
1 00 M B
dr o p p e d 10 0 M B
10 MB
6 Chapter 1
Eac h po r t on a ro u t e r or s w i t c h de v i c e co n t a i n s an in d i v i d u a l b u f f e r are a
th a t acce p t s pac k e t s dest i n e d to go o u t th e in te r f a c e . If excess i v e ne t w o r k tra f f i c
occ u r s, pr e v e n t i n g th e ti m e l y e m p t y i n g of the b u f f e r , or if m o r e pa c k e t s
ar r i v e th a n the p o r t ca n tra n s m i t , th e b u f f e r w i l l fill u p.
If a net w o r k de v i c e ’s pa c k e t b u f f e r ge ts fil le d u p, it has n o ch o i c e b u t to d r o p
in c o m i n g pac k e t s. T h i s sce n a r i o ha p p e n s fre q u e n t l y o n ne t w o r k de v i c e s th a t
co n n e c t to net w o r k s ru n n i n g at d i f f e r e n t spee d s, suc h as a 10/100 s w i t c h or
ro u t e r . If lots of tra f f i c arr i v e s o n a hi g h- spe e d 100-M B co n n e c t i o n des t i n e d fo r
a lo w e r- spee d 10-M B co n n e c t i o n , pa c k e t s w i l l be bac k e d u p in the b u f f e r s, an d
ofte n ov e r f l o w , ca u s i n g d r o p p e d pa c k e t s an d re t r a n s m i s s i o n s fr o m the se n d i n g
de v i c e s.
To m i n i m i z e th is effe c t, m o s t ne t w o r k de v i c e s are co n f i g u r e d to all o c a t e
a m p l e m e m o r y spa c e fo r ha n d l i n g pa c k e t b u f f e r s. H o w e v e r , it is i m p o s s i b l e to
p re d i c t all net w o r k co n d i t i o n s , an d d r o p p e d pa c k e t s stil l m a y occ u r .
Using Large Ping Packets
A n o t h e r pr o b l e m w i t h m e a s u r i n g ava i l a b i l i t y is the size of th e pa c k e t s use d in
the pi n g req u e s t. M a n y ne t w o r k de v i c e s ha n d l e pa c k e t s w i t h m u l t i p l e pa c k e t
b u f f e r s, base d o n ave r a g e pa c k e t sizes. D i f f e r e n t b u f f e r p o o l s ha n d l e di f f e r e n t s i z e d
pac k e t s. To o m a n y of o n e pa r t i c u l a r size of pa c k e t ca n ca u s e d r o p p e d
pac k e t s fo r th a t size cate g o r y , w h i l e pa c k e t s of ot h e r size s are passe d w i t h o u t
a proble m.
Fo r exa m p l e , s w i t c h e s oft e n ha v e th r e e classe s of p a c k e t b u f f e r s — o n e fo r
s m a l l pac k e t s, o n e fo r m e d i u m - size d pa c k e t s, an d o n e fo r la r g e pa c k e t s. To
acc u r a t e l y test the se ne t w o r k de v i c e s, yo u m u s t be able to se n d d i f f e r e n t- size d
pac k e t s to test the di f f e r e n t pa c k e t b u f f e r s.
To acco m m o d a t e th is, m o s t ne t w o r k pe r f o r m a n c e to o l s all o w y o u to alte r
the size of the pa c k e t s use d in th e test i n g . W h e n testi n g ne t w o r k s th a t u t i l i z e
ro u t e r s or s w i t c h e s, y o u m u s t ens u r e th a t a w i d e va r i e t y of pa c k e t size s are
use d to tra v e r s e th e ne t w o r k .
TIP There have been many instance s of security problems with large ping
packet s. As a result, most Unix syste m s only allow the root account to send
large ping packet s. You should be careful when sending larger packet s to
remote servers, so as to not adversely affect the remote server.
By de f a u l t , the pa c k e t size use d in the pi n g u t i l i t y is 64 b y t e s (56 b y t e s of

4. da t a an d the 8-b y t e IC M P hea d e r). Yo u ca n use the -s o p t i o n to ch a n g e th e
pac k e t size, u p to the m a x i m u m th a t is all o w e d o n th e ne t w o r k seg m e n t (1,500
fo r Et h e r n e t net w o r k s).
Defining Network Performance 7
A f t e r alte r i n g the pa c k e t size of th e pi n g pa c k e t s, y o u ca n see h o w th i s
affec t s the pi n g sta t is t i c s b y obse r v i n g th e o u t p u t fr o m th e p i n g co m m a n d :
# ping -s 1000 192.168.1.100
PING 192.168.1.100 (192.168.1.100):1000 data bytes
1008 bytes from 192.168.1.100: icmp_seq=0 ttl=127 time=2.994 ms
1008 bytes from 192.168.1.100: icmp_seq=1 ttl=127 time=2.952 ms
1008 bytes from 192.168.1.100: icmp_seq=2 ttl=127 time=2.975 ms
1008 bytes from 192.168.1.100: icmp_seq=3 ttl=127 time=2.940 ms
1008 bytes from 192.168.1.100: icmp_seq=4 ttl=127 time=3.133 ms
1008 bytes from 192.168.1.100: icmp_seq=5 ttl=127 time=2.960 ms
1008 bytes from 192.168.1.100: icmp_seq=6 ttl=127 time=2.988 ms
^C
--- 192.168.1.100 ping statistics ---
7 packets transmitted, 7 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.940/2.992/3.133/0.060 ms
#
In th is exa m p l e , all of th e la r g e pi n g pa c k e t s w e r e stil l succe ss f u l , in d i c a t i n g
th a t all of the seg m e n t s bet w e e n the h os t an d th e clie n t w e r e p r o c e s s i n g the
la r g e r pac k e t s w i t h o u t an y p r o b l e m s . If y o u ex p e r i e n c e pa c k e t loss w i t h lar g e r
pac k e t s, b u t no t w i t h s m a l l e r pa c k e t s, th is oft e n in d i c a t e s a p r o b l e m w i t h a
ro u t e r or s w i t c h b u f f e r so m e w h e r e in th e ne t w o r k . M o s t ro u t e r an d s w i t c h
de v i c e s all o w th e a d m i n i s t r a t o r to cha n g e th e pa c k e t b u f f e r all o c a t i o n s to all o t
m o r e b u f f e r s fo r a pa r t i c u l a r pa c k e t- size ra n g e .
Respon s e Time
A s see n in the p i n g exa m p l e , w h i l e ne t w o r k av a i l a b i l i t y is o n e ele m e n t of ne t w o r k
pe r f o r m a n c e , it ca n n o t acc u r a t e l y re fl e c t the o ve r a l l pe r f o r m a n c e of the
net w o r k . T h e ne t w o r k cust o m e r s ’ pe r c e p t i o n of th e ne t w o r k is n o t li m i t e d to
w h e t h e r or no t the y ca n get to an in d i v i d u a l ser v e r . It also inc l u d e s h o w lo n g
it ta k e s to p r o c e s s da t a w i t h th e ser v e r .
To ob t a i n a m o r e acc u r a t e pic t u r e of th e ne t w o r k pe r f o r m a n c e , yo u m u s t
obse r v e ho w lo n g it ta k e s pa c k e t s to tra v e r s e th e ne t w o r k . T h e ti m e th a t it
ta k e s a pac k e t to tra v e l bet w e e n t w o p o i n t s o n the ne t w o r k is calle d the
response time.
T h e res p o n s e ti m e affe c t s h o w q u i c k l y ne t w o r k ap p l i c a t i o n s ap p e a r to be
w o r k i n g . Slo w res p o n s e ti m e s are oft e n m a g n i f i e d b y ne t w o r k ap p l i c a t i o n s
th a t nee d to sen d an d rece i v e lo ts of in f o r m a t i o n acr o s s th e ne t w o r k , or ap p l i c a t i o n s
th a t pr o d u c e i m m e d i a t e res u l t s fr o m a cus t o m e r en t r y . A p p l i c a t i o n s
suc h as TE L N E T , w h i c h re q u i r e th e cust o m e r to w a i t fo r a ke y s t r o k e to be
ech o e d fr o m the re m o t e h o s t, are ext r e m e l y v u l n e r a b l e to slo w ne t w o r k
res p o n s e ti m e s.
8 Chapter 1
W h i l e net w o r k res p o n s e ti m e is ofte n ob v i o u s to cust o m e r s , tr y i n g to m e a s u r e
the res p o n s e ti m e bet w e e n t w o se p a r a t e h o s t s ca n be a d i f f i c u l t th i n g to
d o. D e t e r m i n i n g the ti m e it ta k e s fo r a pa c k e t to lea v e o n e ne t w o r k de v i c e an d
ar r i v e at a re m o t e ne t w o r k de v i c e is n o t eas y. T h e r e m u s t be so m e m e c h a n i s m
to ti m e the lea v i n g an d ar r i v i n g eve n t s, in d e p e n d e n t of the t w o syst e m s o n th e
net w o r k .
W h e n usi n g net w o r k pe r f o r m a n c e to o l s th a t ut i l i z e ro u n d - tri p res p o n s e

5. ti m e s, it is al w a y s w i s e to inc o r p o r a t e th e re m o t e syst e m ’ s C P U u t i l i z a t i o n in
the da t a ta k e n, to ens u r e th a t y o u are co m p a r i n g res p o n s e ti m e s ru n at si m i l a r
syste m loa d s, eli m i n a t i n g the syst e m- lo a d i n g fact o r .
Response-Time Factors
In lar g e net w o r k s , th e r e are m a n y fact o r s th a t ca n affe c t res p o n s e ti m e s
bet w e e n a clie n t an d a ser v e r . A s th e ne t w o r k ad m i n i s t r a t o r , yo u ca n co n t r o l
so m e of these fact o r s, b u t ot h e r s are co m p l e t e l y o u t of yo u r co n t r o l . T h e s e fact o r s
can inc l u d e :
■■ O v e r l o a d e d ne t w o r k seg m e n t s
■■ N e t w o r k err o r s
■■ Fa u l t y net w o r k w i r i n g
■■ Br o a d c a s t sto r m s
■■ Fa u l t y net w o r k de v i c e s
■■ O v e r l o a d e d ne t w o r k h o s ts
A n y one or co m b i n a t i o n of the se fact o r s ca n co n t r i b u t e to slo w ne t w o r k
res p o n s e ti m e. M e a s u r i n g th e in d i v i d u a l fact o r s ca n be d i f f i c u l t , b u t th e ne t w o r k
pe r f o r m a n c e too l s p r e s e n t e d in th is bo o k ca n m e a s u r e th e o ve r a l l effe c t
eac h fact o r has o n ne t w o r k res p o n s e ti m e s b y se n d i n g k n o w n ne t w o r k tra f f i c
sa m p l e s an d det e r m i n i n g h o w th e d a t a tra v e r s e s the ne t w o r k
Determining Response Time from Ping Packets
A s see n in the sa m p l e o u t p u t s fo r th e p i n g p r o g r a m , th e ro u n d - tri p res p o n s e
ti m e val u e s fo r eac h p i n g p a c k e t sen t are sh o w n in the pi n g pa c k e t sta t is t i c s:
64 bytes from 192.168.1.100: icmp_seq=0 ttl=255 time=0.712 ms
T h e res p o n s e ti m e is sh o w n in m i l l i s e c o n d s . Fo r in t e r n a l L A N co n n e c t i o n s ,
the res p o n s e ti m e s sh o u l d be w e l l w i t h i n 1 or 2 m i l l i s e c o n d s . Fo r W A N co n n e c t i o n s ,
the res p o n s e ti m e s ca n ofte n be o ve r 200 or 300 m i l l i s e c o n d s , de p e n d i n g
on W A N co n n e c t i v i t y spee d s.
Defining Network Performance 9
WARNING Reme mber that the ping respons e time values are round- trip
respons e times. The current load on the remote syste m affects these value s.
W h e n m u l t i p l e pi n g pa c k e t s are sen t, an ave r a g e of th e i r res p o n s e ti m e s is
calc u l a t e d an d d is p l a y e d :
round-trip min/avg/max/stddev = 2.940/2.992/3.133/0.060 ms
T h e res p o n s e ti m e fo r a co n n e c t i o n ca n de p e n d o n m a n y d i f f e r e n t fact o r s
w i t h i n the net w o r k co n n e c t i o n . A s the p a c k e t s tra v e r s e th e ne t w o r k , eac h ne t w o r k
de v i c e can pla y a ro l e in the to t a l res p o n s e ti m e . T h e ne t w o r k pe r f o r m a n c e
to o l m u s t be able to ta k e in t o acco u n t th e res p o n s e- ti m e fact o r s fo r eac h
net w o r k co n n e c t i o n .
T h e best use fo r p i n g res p o n s e ti m e s is to esta b l i s h a base l i n e va l u e , or the
val u e s seen w h e n th e ne t w o r k is pe r f o r m i n g at n o r m a l spee d s. W h e n cust o m e r s
co m p l a i n abo u t slo w ne t w o r k pe r f o r m a n c e , th e p i n g res p o n s e ti m e
val u e s ta k e n can th e n be co m p a r e d ag a i n s t res p o n s e ti m e s ta k e n d u r i n g n o r m a l
net w o r k pe r f o r m a n c e . A n y d r a s t i c de v i a t i o n s in th ese ti m e s ca n re p r e s e n t
a p r o b l e m w i t h a ne t w o r k de v i c e.
Using traceroute for Redundant Paths
In a net w o r k tha t has re d u n d a n t pa t h s, it is ofte n des i r a b l e to de te r m i n e w h i c h
pa t h pac k e t s are ta k i n g at an y gi v e n ti m e . If yo u de te r m i n e th a t pa c k e t s are n o t
bei n g ro u t e d in th e m o s t effi c i e n t m a n n e r , yo u ca n ofte n m a k e si m p l e co n f i g u r a t i o n
cha n g e s to ro u t e r s to inc r e a s e res p o n s e ti m e s.

6. T h e U n i x trace r o u t e p r o g r a m all o w s the ne t w o r k a d m i n i s t r a t o r to de t e r m i n e
exac t l y w h i c h ro u t e pa c k e t s are ta k i n g to get be t w e e n t w o p o i n t s o n th e
net w o r k . T h e tra c e r o u t e u t i l i t y uses the IP Ti m e to Li v e (TT L) va l u e to p u r p o s e l y
fo r c e a pac k e t to ex p i r e alo n g the pa t h to the dest i n a t i o n .
T h e T T L val u e spec i f i e s h o w m a n y h o p s an in d i v i d u a l pa c k e t ca n m a k e
bef o r e ex p i r i n g . W h e n a ro u t e r sees a pa c k e t w i t h an ex p i r e d T T L va l u e , it
sho u l d re p o r t the p r o b l e m bac k to th e se n d i n g ne t w o r k de v i c e. By sta r t i n g th e
T T L val u e at 1 an d in c r e m e n t i n g it at eac h p i n g atte m p t , th e tra ce r o u t e u t i l i t y
fo r c e s re m o t e ro u t e r s alo n g the ne t w o r k pa t h to ex p i r e the p i n g pa c k e t an d
ret u r n an IC M P des t i n a t i o n u n r e a c h a b l e pac k e t to the clie n t. Sin c e th e ro u t e r
itsel f m u s t ret u r n th e pa c k e t, eac h ro u t e r tra v e r s e d alo n g the ne t w o r k pa t h is
id e n t i f i e d .
T h e fo r m a t fo r th e tra ce r o u t e co m m a n d is:
trac e r o u t e [-d F I n r v x ] [-f firs t t t l] [-g ga te w a y ] [-i ifa ce] [-m m a x t t l ] [-p p o r t] [q
n q u e r i e s] [-s srca d d r ] [-t tos] [-w w a i t t i m e ] h o s t [pac k e t l e n g t h ]
A s can be see n fr o m th e co m m a n d - li n e fo r m a t , the p i n g p r o g r a m , li k e the
trac e r o u t e p r o g r a m , has m a n y o p t i o n s th a t ca n be use d to fi n e- tu n e the test i n g .
10 Chapter 1
T h e de f a u l t va l u e s fo r all of th e o p t i o n s ca n be use d to sen d a si m p l e tra ce r o u t e
p r o b e to a re m o t e h o s t. T h e o u t p u t fr o m a sa m p l e tra ce r o u t e acr o ss th e In t e r n e t
to the w w w . c i s c o . c o m h o s t lo o k s li k e th i s:
$ traceroute www.cisco.com
traceroute to www.cisco.com (198.133.219.25), 30 hops max, 40 byte
packets
1 209.244.188.162 (209.244.188.162) 175 ms 170 ms 171 ms
2 gige7-0-2.hsipacces1.Cincinnati1.Level3.net (63.212.221.2) 154 ms
150 ms 150 ms
3 ge-6-0-0.mp1.Cincinnati1.Level3.net (64.159.0.173) 152 ms 150 ms
149 ms
4 so-3-0-0.mp2.Chicago1.Level3.net (64.159.1.34) 150 ms 149 ms 150
ms
5 pos9-0.core1.Chicago1.level3.net (209.247.10.170) 150 ms 150 ms 151
ms
6 144.232.26.185 (144.232.8.185) 151 ms 152 ms 151 ms
7 sl-bb20-chi-13-0.sprintlink.net (144.242.26.50) 151 ms 150 ms 150
ms
8 sl-bb20-sj-6-0.sprintlink.net (144.232.8.117) 200 ms 201 ms 203 ms
9 sl-gw11-sj-9-0.sprintlink.net (133.232.3.138) 210 ms 211 ms 210 ms
10 sl-ciscopsn2-11-0-0.sprintlink.net (144.228.44.14) 211 ms 210 ms 210
ms
11 sjce-dirty-gw1.cisco.com (128.107.239.89) 210 ms 210 ms 210 ms
12 sjck-sdf-ciod-gw2.cisco.com (128.107.239.12) 209 ms 209 ms 210 ms
13 www.cisco.com (198.133.219.25) 211 ms 210 ms 211 ms
$
T h e o u t p u t fr o m th e tra ce r o u t e p r o g r a m sh o w s eve r y ro u t e r th a t res p o n d s
to the ex p i r e d test pa c k e t alo n g the pa t h to the des t i n a t i o n h o s t. A l o n g w i t h
th a t inf o r m a t i o n , th e ro u n d - tri p ti m e s th a t it to o k fo r the pa c k e t to rea c h eac h
ro u t e r are dis p l a y e d (thre e se p a r a t e test pa c k e t s are sen t w i t h th e sa m e T T L
val u e fo r eac h test). Re m e m b e r th a t th ese va l u e s are ro u n d - tri p res p o n s e
ti m e s, an d can cha n g e w i t h di f f e r e n t lo a d i n g o n the in d i v i d u a l ro u t e r s.
N e t w o r k s tha t use lo a d ba la n c i n g w i l l sh o w in c o n s i s t e n t ro u t e pa t h s
bet w e e n t w o po i n t s o n the ne t w o r k , de p e n d i n g o n the ne t w o r k lo a d at th e ti m e
of the test. A s w i t h ot h e r res p o n s e- ti m e tec h n i q u e s , the best th i n g to d o in th ese
scen a r i o s is to ta k e base l i n e tests u n d e r va r i o u s ne t w o r k lo a d s to see h o w an d
w h e n eac h net w o r k pa t h is ut i l i z e d .

7. Network Utilization
A m a j o r fact o r in ne t w o r k pe r f o r m a n c e is the ut i l i z a t i o n of eac h ne t w o r k seg m e n t
alo n g the pa t h be t w e e n t w o en d p o i n t s . T h e network utilization re p r e s e n t s
the pe r c e n t of ti m e th a t the ne t w o r k is in use o v e r a gi v e n pe r i o d . By de f i n i t i o n ,
in d i v i d u a l Et h e r n e t seg m e n t s ca n o n l y car r y o n e pa c k e t at a ti m e . Fo r an y
Defining Network Performance 11
gi v e n m o m e n t , th e Et h e r n e t seg m e n t is eit h e r at 100-pe r c e n t ut i l i z a t i o n (carr y i n g
a pac k e t), or at 0-pe r c e n t ut i l i z a t i o n (idle). T h e ne t w o r k u t i l i z a t i o n pe r c e n t a g e
sho w s the pe r c e n t a g e of ti m e the ne t w o r k is in use o ve r a set pe r i o d .
Cal c u l a t i n g the ne t w o r k u t i l i z a t i o n re q u i r e s yo u to fi n d o u t h o w m a n y b y t e s
of net w o r k tra f f i c are bei n g ha n d l e d b y the ne t w o r k o ve r a set pe r i o d . T h i s
val u e de p e n d s o n th e ty p e of ne t w o r k in t e r f a c e th a t is bei n g m o n i t o r e d .
H a l f- d u p l e x de v i c e s ca n o n l y car r y da t a in o n e d i r e c t i o n at a ti m e , an d
the r e f o r e calc u l a t i n g th e i r ne t w o r k u t i l i z a t i o n in v o l v e s to t a l i n g the in p u t an d
o u t p u t b y t e co u n t s fo r a set pe r i o d , an d d i v i d i n g b y th e to t a l ca p a c i t y of the
de v i c e int e r f a c e fo r th a t pe r i o d . To de te r m i n e the to t a l n u m b e r of bits rece i v e d
on the int e r f a c e s, eac h of th e pa c k e t b y t e ra te s is m u l t i p l i e d b y 8. T h i s va l u e is
di v i d e d by the to t a l in t e r f a c e ca p a c i t y m u l t i p l i e d b y th e ti m e in te r v a l of th e
sa m p l e (in seco n d s):
%utilization = ((datasent + datarecv) * 8) / (intspeed * sampletime) *
100
Fo r exa m p l e , a 10-M B ha l f- d u p l e x ne t w o r k in t e r f a c e th a t o ve r a 5-seco n d
pe r i o d sen d s 700,000 b y t e s of d a t a an d rece i v e s 175,000 b y t e s w o u l d ha v e a
net w o r k ut i l i z a t i o n of:
%utilization = (((700,000 + 175,000) * 8) / (10,000,000 * 5) * 100 = 14%
T h e 14-pe r c e n t ut i l i z a t i o n re p r e s e n t s th e ne t w o r k ut i l i z a t i o n o n l y fo r th a t
5-seco n d pe r i o d . It is n o t u n c o m m o n to see hi g h ne t w o r k u t i l i z a t i o n fo r a sh o r t
pe r i o d of ti m e, gi v e n th a t Et h e r n e t tra f f i c is ofte n b u r s t y in na t u r e . Y o u ha v e a
p r o b l e m w h e n y o u ta k e the sa m e calc u l a t i o n fo r a lo n g e r pe r i o d of ti m e , suc h
as a 5- or 30-m i n u t e in t e r v a l , an d stil l get hi g h ne t w o r k u t i l i z a t i o n .
A l t h o u g h calc u l a t i n g ne t w o r k u t i l i z a t i o n o n an in d i v i d u a l ne t w o r k seg m e n t
can be eas y, det e r m i n i n g th e ne t w o r k ut i l i z a t i o n bet w e e n t w o se p a r a t e
en d p o i n t s on the ne t w o r k ca n be co m p l e x . Yo u m u s t calc u l a t e th e ne t w o r k ut i l i z a t i o n
fo r eac h seg m e n t tra v e r s e d alo n g the ne t w o r k p a t h , an d de t e r m i n e
ho w eac h seg m e n t ’ s ut i l i z a t i o n affe c t s th e o v e r a l l res p o n s e ti m e of th e pa c k e t.
D u e to the co m p l e x i t y of th is, m o s t ne t w o r k pe r f o r m a n c e to o l s u t i l i z e di f f e r e n t
ele m e n t s — t h e ne t w o r k th r o u g h p u t an d th e ne t w o r k ba n d w i d t h ca p a c i t y —
to de te r m i n e net w o r k pe r f o r m a n c e be t w e e n t w o re m o t e ne t w o r k en d p o i n t s .
Network Throughput
N e t w o r k th r o u g h p u t is si m i l a r in co n c e p t to ne t w o r k ut i l i z a t i o n . T h e th r o u g h p u t
of a net w o r k re p r e s e n t s th e a m o u n t of ne t w o r k ba n d w i d t h a va i l a b l e fo r a
net w o r k ap p l i c a t i o n at an y gi v e n m o m e n t , acr o s s the ne t w o r k li n k s. A s ne t w o r k
ap p l i c a t i o n s use ne t w o r k ba n d w i d t h , th e a m o u n t of ba n d w i d t h left o ve r
fo r ot h e r ap p l i c a t i o n s is de c r e a s e d . T h e a m o u n t of ba n d w i d t h left o ve r is co n s i d e r e d
the net w o r k th r o u g h p u t .
12 Chapter 1
D e t e r m i n i n g ne t w o r k th r o u g h p u t all o w s the ne t w o r k a d m i n i s t r a t o r to fi n d
net w o r k bo t t l e n e c k s th a t slo w d o w n pe r f o r m a n c e o ve r a gi v e n ne t w o r k li n k

8. bet w e e n clie n t s an d ser v e r s. O f t e n a n o v i c e ne t w o r k ad m i n i s t r a t o r p la c e s a
gr o u p of clie n t s o n a hi g h- spee d ne t w o r k de v i c e , an d the ap p l i c a t i o n ser v e r o n
an o t h e r hi g h- spee d ne t w o r k de v i c e, to inc r e a s e ap p l i c a t i o n pe r f o r m a n c e . H o w e v e r ,
w h a t the ad m i n i s t r a t o r fo r g e t s is th a t the t w o hi g h- spe e d de v i c e s m a y be
co n n e c t e d via a slo w- spee d li n k . Fi g u r e 1.2 de m o n s t r a t e s an exa m p l e of th i s.
W h i l e the net w o r k s th a t co n t a i n th e clie n t an d ser v e r de v i c e s are hi g h- spee d
an d ha v e go o d ne t w o r k pe r f o r m a n c e , it is th e in t e r c o n n e c t i n g ne t w o r k de v i c e
th a t is cau s i n g pe r f o r m a n c e p r o b l e m s . Fi rs t off, th e in te r m e d i a t e ne t w o r k li n k
is li m i t i n g the ov e r a l l spe e d of th e en d- to-en d li n k to o n l y 10 M B , n o m a t t e r
ho w fast the clie n t s an d ser v e r are co n n e c t e d to th e ne t w o r k . Seco n d , sin ce the
in t e r m e d i a t e net w o r k de v i c e is a sha r e d h u b , it m a y co n t a i n ot h e r clie n t s an d
ap p l i c a t i o n ser v e r s, w h i c h p u t s ad d i t i o n a l tra f f i c lo a d o n th e slo w- spee d li n k.
Us u a l l y , fi n d i n g the ne t w o r k bo t t l e n e c k is n o t th i s si m p l e . O n co m p l e x ne t w o r k s ,
the r e can be seve r a l ne t w o r k de v i c e s w i t h i n the pa t h of clie n t s an d
ser v e r s. T h e ha r d e s t pa r t of de t e r m i n i n g the ne t w o r k th r o u g h p u t is calc u l a t i n g
the effec t tha t eac h in te r m e d i a t e li n k has o n the o v e r a l l en d- to-en d ne t w o r k
co n n e c t i o n .
Cal c u l a t i n g net w o r k th r o u g h p u t is a m a t h e m a t i c a l p r o c e s s th a t is best left to
the m a t h e m a t i c a l ge n i u s e s. It in v o l v e s sen d i n g pe r i o d i c stre a m s of pa c k e t s,
an d de te r m i n i n g the ra te at w h i c h th e ser v e r rece i v e s th e stre a m s . Eac h stre a m
sa m p l e p r o d u c e s d a t a ele m e n t s use d to de t e r m i n e th e a m o u n t of ba n d w i d t h
re m a i n i n g on th e ne t w o r k li n k. T h e stre a m s are inc r e a s e d u n t i l the m a x i m u m
ba n d w i d t h is ob se r v e d , th e n q u i c k l y bac k e d of f so as n o t to affe c t th e ne t w o r k
pe r f o r m a n c e .
Figure 1.2 Fi n d i n g th e thr o u g h p u t b ottl e n e c k .
se r v e r
1 0/1 0 0- M B s wit c h
1 0- M B h u b
1 0/1 0 0- M B s wit c h
clie n t
100 MB
100 MB
10 MB
10 MB
Defining Network Performance 13
O f co u r s e, th is calc u l a t i o n is ext r e m e l y de p e n d e n t o n exit i n g ne t w o r k ap p l i c a t i o n s ,
an d ho w the y loa d the ne t w o r k at an y gi v e n ti m e . It is best to calc u l a t e
net w o r k th r o u g h p u t at d i f f e r e n t ti m e s of the da y, an d o n d i f f e r e n t d a y s of the
w e e k . T h i s ena b l e s yo u to ga t h e r all of th e in f o r m a t i o n o n di f f e r e n t ap p l i c a t i o n s
as the y are r u n o n th e ne t w o r k .
M a n y ne w net w o r k ap p l i c a t i o n s fail d u e to lac k of ava i l a b l e ne t w o r k
th r o u g h p u t . If an ap p l i c a t i o n is teste d in a de v e l o p m e n t en v i r o n m e n t th a t d o e s
no t inc l u d e the ot h e r ap p l i c a t i o n s th a t w i l l be r u n n i n g o n th e ne t w o r k , it is
eas y to fo r g e t ab o u t exis t i n g ne t w o r k th r o u g h p u t o n th e p r o d u c t i o n ne t w o r k .