DOWNLOAD hrPING v2.41

Why another PING utility?

Many PING utilities are already available, one is even released with Windows itself, called PING. But there is a couple of things Windows PING doesn't offer or which are too inaccurate. That's where hrPING comes in.

So - what's the features?

Like every PING, hrPING sends "ICMP Echo Request" packets to the remote computer and listens to the matching "Echo response" packets.

The first thing that is different is that hrPING times the round trip delay in microseconds. This is done by using the CPU's "Time Stamp Counter" which is incremented with the CPU's clock cycle. You can not get any more accurate with standard PCs today!

The next thing Windows PING can not do is send more than one PING packet at a time. Windows PING always sends one packet, waits for the reply, then prints its output line, repeat.

hrPING sends out one PING packet every x milliseconds (you can adjust this time with the -s parameter) while listening for incoming replies and printing the output if there is any.

The reason why you should like this is easy: with DSL or the like you often have a delay of some 40 msec, while the upstream bandwidth of the whole connection is some 16 to 20 kbytes/sec. So, with a "standard" PING packet of 20+8+64 bytes (IP header + ICMP header + PING payload) you can send 7 packets before you get the first reply. If you want to test line conditions, thruput, etc. this "overlapped" way of sending is really helpful.

What's more, hrPING has much better statistics than Windows PING. You get the round trip times for ICMP error message replies as well! This way you can e.g. monitor the delay of a TTL exceed. hrPING counts the replies and error messages separately, so the global statistics don't mess up one another.

There's a lot more goodies hidden in hrPING, just use it and you will find out about small but useful features.

And this is how to use it:

hrPING [<options>] <host>

<host> may be the IP address or the hostname. In the latter case the name will be resolved to its address at the beginning of the PING loop.

There are a couple of options:

Loop forever. You can abort hrPING any time with CTRL-C or CTRL-Break. Unlike Windows PING, hrPING will still print the statistics gathered so far when you abort. CTRL-C waits for some time for replies still to come in, while CTRL-Break aborts right away.

Specify the number of PING packets to send. Default number is 4.

This is nice for batch files or for coordinating with a background job. hrPING will loop as long as usual (i.e. depending on -t or -n options), but will furthermore check for the existance of <file>. If <file> comes into existance, hrPING will exit the loop.

How may bytes payload should be send? Remember that each packet is of the form: IP header (20 bytes) + ICMP header (8 bytes) + payload. You may only specify the payload size. Minimum is 0, maximum is 64k-1-20-8, i.e., 65507 bytes. Default is 64 bytes.

Same as the above, only that this size here is the size for the total IP datagram.

Set the "Don't fragment" bit in the IP header of the PING packet. Default is not set.

Set the "Time To Live" value in the IP header of the PING packet. Default is 255.

Set the "Type Of Service" bits in the IP header of the PING packet. Default is 0.

Maximum timeout to wait for a reply. This is almost only of use if you switch to non-overlapped (i.e., Windows PING like) mode. In overlapped mode, this time only applies when hrPING has stopped sending (because the count was exceeded or because you pressed CTRL-C) and is waiting for missing replies. Default is 2000 milliseconds.

This is the number of milliseconds between sending of two PING packets. hrPING will try to stick to this number very accurately. If sending took a little longer for one packet it will send out the next packet a little earlier. Default is 500 milliseconds. (You can use decimals for a very fine grained interval: -s5.4 will send a packet every 5400 microseconds, on average!)

hrPING contains a traceroute utility! It works almost the same as Windows TRACERT, except that it only does one test per host, not three. By default, IP addresses are not resolved to names. Use -a to do that.

No need to say more.

hrPING automatically decides if it uses the CPU's timestamp counter (TSC) or the operating system's performance counter for timings. On some CPU's the TSC is not reliable, since it doesn't tick at the same speed all the time. On multiprocessor systems, not all TSC have to tick exactly in sync. In almost all cases, hrPING will use the performace counter. If you want to force TSC usage, use -tsc.

If specified, hrPING will send one uncounted ping before all others. This "warm up" is useful with some firewalls that somehow cause the first block to be much slower than the following ones.

Preceed each line of output with a timestamp of the form
"2006-11-22 10:55:27.201: "

Set the "Identification" IP header field to the value specified. It is possible that Windows erases or overwrites this field when sending the packet

Be quiet.

Loop as long as there are no replies (or even error messages if -AA).

Use Windows PING like synchronous sending of one packet, waiting for the reply and so on. Off by default.

We need you to accept the software license. This is done the first time you start hrPING. If you want to re-read it, use this option.

Return codes:

0

All sent echo requests were answered with echo replies.

1

All sent echo requests were answered with either echo replies or error messages.

2

At least some echo requests were answered with either echo replies or error messages.

9

Otherwise.

Now a test run:

C:\> hrPING www.cfos.de
This is hrPING v2.41 by Chris Lueders of cFos Software -- http://www.cfos.de

Using CPU TSC; calibrated to 603.219 MHz
Pinging www.cfos.de [194.95.249.23]
with 64 bytes data (92 bytes IP) (overlapped):

Reply from 194.95.249.23: seq=0001 time=77.413ms TTL=247
Reply from 194.95.249.23: seq=0002 time=74.425ms TTL=247
Reply from 194.95.249.23: seq=0003 time=71.707ms TTL=247
Reply from 194.95.249.23: seq=0004 time=71.838ms TTL=247

Statistics for www.cfos.de:
    Packets: sent=4, rcvd=4, error=0, lost=0 (0% loss) in 1.572300 sec
    RTTs of replies in ms: min/max/avg: 71.707 / 77.413 / 73.845

You see that hrPING numbers the packets in ascending order. The sequence numbers of the replies are listed (if there is an out-of-sequence packet, hrPING will write "SEQ=" instead of "seq=", so you notice).

Notice the times in microseconds (milliseconds with 3 decimals).

Furthermore, we see the TTL, which is the TTL of the sender, minus the number of hops the packet took to come here. I guess TTL was initially set to 255, so it took the packet 8 hops to come here.

Now let's look at a second test run:

C:\> hrPING -i1 www.cfos.de
This is hrPING v2.41 by Chris Lueders of cFos Software -- http://www.cfos.de

Using CPU TSC; calibrated to 600.797 MHz
Pinging www.cfos.de [194.95.249.23]
with 64 bytes data (92 bytes IP) (overlapped):

Reply from 217.5.98.50: TTL expired in transit; seq=0001 time=58.307ms
Reply from 217.5.98.50: TTL expired in transit; seq=0002 time=59.456ms
Reply from 217.5.98.50: TTL expired in transit; seq=0003 time=51.693ms
Reply from 217.5.98.50: TTL expired in transit; seq=0004 time=51.804ms

Statistics for www.cfos.de:
    Packets: sent=4, rcvd=0, error=4, lost=0 (0% loss) in 1.552238 sec
    RTTs of errors in ms: min/max/avg: 51.693 / 59.456 / 55.315

Notice that this is a list of ICMP error messages, yet there are still the sequence numbers and round-trip-times listed.

Now let's see what we can learn using hrPING...

We can find out about the delay of our DSL connection. We use the smallest PING available and we use the shortest route available. We could use traceroute mode to find the first hop and ping that one. But experience shows that this hop often doesn't answer to PINGs. So we use a trick: we send out packets with TTL 1: they will be bounced on the first hop.

C:\> hrPING -i1 -l0 www.cfos.de
This is hrPING v2.41 by Chris Lueders of cFos Software -- http://www.cfos.de

Using CPU TSC; calibrated to 605.874 MHz
Pinging www.cfos.de [194.95.249.23]
with 0 bytes data (28 bytes IP) (overlapped):

Reply from 217.5.98.50: TTL expired in transit; seq=0001 time=55.605ms
Reply from 217.5.98.50: TTL expired in transit; seq=0002 time=50.232ms
Reply from 217.5.98.50: TTL expired in transit; seq=0003 time=50.289ms
Reply from 217.5.98.50: TTL expired in transit; seq=0004 time=49.771ms

Statistics for www.cfos.de:
    Packets: sent=4, rcvd=0, error=4, lost=0 (0% loss) in 1.550524 sec
    RTTs of errors in ms: min/max/avg: 49.771 / 55.605 / 51.474

So, the minimum delay seems to be some 49.7 ms. If you increase the number of tries you might find an even smaller delay, but it's not very likely it will shrink a lot more. (After 1000 tries the minimum was 47.3 ms).

System requirements:

hrPING should work well on all systems running Windows NT 4.0 and above (Windows 2000, Windows XP Professional and Home) as well as Windows 95 and above (Windows 98, Windows Me).

hrPING will not work on DOS, OS/2 or Windows 3.x or below.

With Windows NT, Windows 2000 and Windows XP Professional you have to be a member of the Administrator group to run hrPING. If not, hrPING will be unable to create a "raw socket", which is required for its work. It is by Microsoft's design that only admins can access the raw sockets (under Windows XP Home everybody is an admin, so it's not a problem there).

If you want to enable access to raw sockets to everyone anyway you can set the following Registry key under

HKEY_LOCAL_MACHINE to 1 (DWORD):
System\CurrentControlSet\Services\Afd\Parameters\DisableRawSecurity

Share and enjoy! <tm>