I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this?
There are far to many connections, and pinging each ip is not practical. I was thinking, somehow measuring the time difference between when server send the syn/ack packet and when server receives the ack for it.
Is there a way to log this cheaply? Maybe using some magic tcpdump filter?
The goal of this exercise is to aggregate the data and figure if there are any routing inefficiencies. Say one ISP in one region maybe routing incorrectly, etc.
FWIW the webserver is nginx.
http://nginx.org/en/docs/http/ngx_http_core_module.html#variables
If you have access to a linux or unix machine1, you should use tcptrace. All you need to do is capture the client traffic with wireshark or tcpdump to a pcap file.
After you have that
.pcap
file2, analyze withtcptrace -xtraffic <pcap_filename>
3. This will generate two text files, and the average RTT stats for all connections in that pcap are shown at the bottom of the one calledtraffic_stats.dat
.The
.pcap
file used in this example was a capture I generated when I looped through anexpect
script that pulled data from one of my servers. This was how I generated the loop...END NOTES:
tcptrace
is capable of very detailed per-socket stats if you use other options...