Packets Addresses
Survey-detected 9,644,670,150 4,008,703
Naive matching 9,768,703,324 4,008,830
Broadcast responses 33,775,148 9,942
Duplicate responses 67,183,853 20,736
Survey + Delayed 9,667,744,323 3,978,152
Table 1: Adding unmatched responses to survey-detected
responses
responses from the dataset. We then group the survey-
detected responses and delayed responses together to de-
termine what timeout values would be necessary to recover
various percentiles of responses. Some IP addresses observe
very high latencies in the ISI dataset; we verify that these
are real in Section 5 and examine causes in Section 6.
4.1 Incorporating unmatched responses
ISI detected 9.64 Billion echo responses from 4 Million
IP addresses in 2015 in the IT63w (20150117) and IT63c
(20150206) datasets, as shown in the first row of Table 1.
The next row shows the number of responses we would have
obtained if we had used a naive matching scheme where
we simply matched each unmatched response for an IP ad-
dress with the last echo request for that IP address, without
filtering unexpected responses. The number of responses
increases by 1.3% to 9.77 Billion; however, this includes re-
sponses from addresses that received broadcast responses
and duplicate responses. After filtering unexpected responses,
the number of IP addresses reduces to 99.23% of the original
addresses. Of 30,678 discarded IP addresses, 9,942 (32.4%)
addresses were discarded because they also received broad-
cast responses. The majority of discarded IP addresses,
20,736 (67.6%) were addresses that sent more than 4 echo
responses in response to a single echo request.
Though the number of discarded IP addresses is rela-
tively small, removing them eliminates responses that clus-
ter around 330, 165, and 495 seconds. Figure 6 shows the
distribution of percentile latency per IP address before and
after filtering unexpected responses. Comparing these two
graphs shows that the “bumps” in the CDF are removed by
the filtering.
After discarding addresses, our matching technique yields
23,074,173 additional responses for the remaining addresses,
giving us a total of 9.67 Billion Echo Responses from 3.98
Million IP addresses. We perform our latency analysis on
this combined dataset.
4.2 Recommended Timeout Values
We now find retransmission thresholds which recover var-
ious percentiles of responses for the IP addresses from the
combined dataset. For each IP address, we find the 1st,
50th, 80th, 90th, 95th, 98th and 99th percentile latencies.
We then find the 1st, 50th, 80th, 90th, 95th, 98th and 99th
percentiles of all the 1st percentile latencies. We repeat this
for each percentile and show the results in Table 2.
The 1st percentile of an address’s latency will be close to
the ideal latency that its link can provide. We find that
the 1st percentile latency is below 330ms for 99% of IP ad-
dresses: most addresses are capable of responding with low
latency. Further, 50% of pings from 50% of the addresses
have latencies below 190ms, showing that latencies tend to
be low in general.
% of pings
1% 50% 80% 90% 95% 98% 99%
% of addresses
1% 0.01 0.03 0.04 0.07 0.10 0.13 0.18
50% 0.16 0.19 0.21 0.26 0.42 0.53 0.64
80% 0.19 0.26 0.33 0.43 0.54 0.74 1.21
90% 0.22 0.31 0.42 0.57 0.84 1.61 3
95% 0.25 1.42 2.38 3 5 9 15
98% 0.30 1.94 4 6 12 41 78
99% 0.33 2.31 4 8 22 76 145
Table 2: Minimum timeout in seconds that would have cap-
tured c% of pings from r% of IP addresses in the IT63w
(20150117) and IT63c (20150206) datasets (where r is the
row number and c is the column number).
However, we see that a substantial fraction of IP addresses
also have surprisingly high latencies. For instance, to cap-
ture 95% of pings from 95% addresses requires waiting 5 sec-
onds. Restated, at least 5% of pings from 5% of addresses
have latencies higher than 5 seconds. Thus, even setting a
timeout as high as 5 seconds will infer a false loss rate of 5%
for these addresses.
Note that retrying lost pings cannot be used as a substi-
tute for setting a longer timeout since a retried ping is not
an independent sample of latency. Whatever caused the first
one to be delayed is likely to cause the followup pings to be
delayed as well, as we show in Section 6.
At the extreme, we see 1% of pings from 1% of addresses
having latency above 145 seconds! These latencies are so
high that we investigate these addresses further. We now
consider 60 seconds to be a reasonable timeout to balance
progress with response rate, at least when studying outages
and latencies, although an ideal timeout may vary for differ-
ent settings. A timeout of 60 seconds easily covers 98% of
pings to 98% of addresses, yet does not seem long enough to
slow measurements unnecessarily.
5. VERIFICATION OF LONG PING TIMES
In this section, we address doubts that long observed ping
times are real: that they are a product of ISI’s probing
scheme, that they might be caused by errors in a partic-
ular data set, or that they might derive from discrimination
against ICMP.
5.1 Are high latencies observed by other prob-
ing schemes?
Some of the latencies in Table 2 are so high that we con-
sidered if they could be artifacts of ISI’s probing scheme. We
investigate latencies obtained using two other probing tech-
niques, Zmap and scamper, and check if the high latencies
observed in the ISI datasets are reproducible.
Does Zmap observe high latencies?
We check for high latencies using the Zmap scanner [5]. As
part of our extension of the ICMP probing module in the
Zmap scanner, we also embed the probe send time into the
echo request, and extract it from the echo response, allow-
ing us to estimate the RTT, albeit without the precision of
kernel send timestamps.
Zmap has performed these scans since April 2015. Scans
have been conducted over a range of different times, differ-
ent days of the week and across four months in 2015 (as of
Sep 5, 2015), as shown in Table 3. Typically, scans were per-