CODEWITHSUNDEEP
network-programmingpingpacketnmap
Nagmat
Nagmat

Reputation: 380

What is the difference of Rtt values on ping and nping?

I am pinging host2 from host1 using ping

ping 10.0.0.1

PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.290 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.369 ms

When I use nping :

sudo nping --icmp 10.0.0.1

Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2022-06-10 12:28 PDT
SENT (0.0372s) ICMP [10.0.0.2 > 10.0.0.1 Echo request (type=8/code=0) id=52987 seq=1] IP [ttl=64 id=5607 iplen=28 ]
RCVD (0.2196s) ICMP [10.0.0.1 > 10.0.0.2 Echo reply (type=0/code=0) id=52987 seq=1] IP [ttl=64 id=2449 iplen=28 ]
...
Max rtt: 202.001ms | Min rtt: 15.774ms | Avg rtt: 97.067ms
Raw packets sent: 5 (140B) | Rcvd: 5 (230B) | Lost: 0 (0.00%)
Nping done: 1 IP address pinged in 4.13 seconds

My question is: Why am I getting different rtts for ping and nping?

Upvotes: 1

Views: 764

Answers (1)

DigiBat
DigiBat

Reputation: 274

RTT (round trip time) depends, among other things, on the length of the packet. The longer the packet, the longer it takes to transfer it at the same physical speed of the media. The two tools you use have different default packet lengths.

You can check the situation yourself using Wireshark. Watch the Length column.

enter image description here

The figure shows three pings and their responses made using nping (packets 147-156) and another three pings made using ping (packets 178-198).

In the Length column, you can see that in the first case, the Echo request has a length of 42 B and the Echo response is 60 B. In the second case, both request and response are 98 Bytes. Because the ping sends more data than the nping, its RTT is longer.

You can change the length of the data in the ping packet in Linux by the -s (packet size) parameter. To send shorter ping packets, use this command:

ping -s 16 <IP_address>

ping -s 0 <IP_address>

In the latter case (when -s is less than 16), sometimes RTT values are not displayed. You have to find them by capturing data using Wireshark.

Upvotes: 3

Related Questions