While investigating the stats from a 24 hr sample period using Edit -> copy as summary text function I notice that the "sent" count on the second to last hop is much lower than the others
Date/Time: 3/14/2005 12:07:54 AM to 3/15/2005 12:07:34 AM

Hop Sent Err PL% Min Max Avg
1 2880 0 0.0 0 5 0
2 2880 0 0.0 0 198 0
3 2877 0 0.0 12 204 27
4 2877 1 0.0 13 179 27
5 2877 1 0.0 38 241 53
6 2877 3 0.1 38 220 54
7 533 5 0.9 39 157 43
8 2880 4 0.1 39 266 54

However, if I then take two twelve hour samples of the same period while I still see a reduced count the numbers for hop #7 don't seem to add up. Expect the total to be 533 as in the 24 hr sample. Notice that hop #6 correctly adds up to the expected 2877.

Date/Time: 3/14/2005 12:04:54 AM to 3/14/2005 12:04:29 PM
Hop Sent Err PL% Min Max Avg
1 1440 0 0.0 0 1 0
2 1440 0 0.0 0 23 0
3 1440 0 0.0 12 183 27
4 1440 1 0.1 13 179 27
5 1440 0 0.0 38 211 53
6 1440 0 0.0 38 216 54
7 1440 0 0.0 39 210 53
8 1440 0 0.0 39 227 53

Date/Time: 3/14/2005 11:57:59 AM to 3/14/2005 11:57:33 PM
Hop Sent Err PL% Min Max Avg
1 1440 0 0.0 0 5 0
2 1440 0 0.0 0 198 0
3 1437 0 0.0 12 204 28
4 1437 0 0.0 13 172 28
5 1437 1 0.1 39 241 55
6 1437 3 0.2 39 220 55
7 513 5 1.0 39 157 43
8 1440 4 0.3 39 266 56

So I guess a two part question .. what might cause the sent count to be lower and secondly why don't the numbers seem to add up ?

Thanks ...bob

Hi, Bob.

This behavior is due to a route change. If multiple routers respond at the next-to-the-last hop, then some sub-set number of samples were sent to that particular router (because some other router received the other ones).

As you scroll back in time, PingPlotter always tries to pick a route that was active in the time period you're focused on, so when you did this for some time in the past, the *other* router was shown. That's why you have two different numbers here. At sometime 533 samples before the current time, this hop had another router servicing it.

There are a few ways of handling this.

First, if you understand what's happening, the data representation might match your needs. You can see the routes that participated during this sample period in the "Route Changes" panel on the left. Selecting a different time in that area will show the route as of that time (and doing a "Copy as ..." will use the data that was sent to the routers participating in that route.)

If you find that you don't care about the change to the router at that hop, you can combine this data by right-clicking on the hop in question and selecting the "Add route change mask" option, which will treat these two routers as a single router in the future, and will also merge that data for these two routers together in the data you're currently reviewing. Doing a "Copy as ..." after this should show you results a bit more consistent with your previous expectations.

Let us know if this makes sense!

- Pete

Thanks Pete Understand.. you know I had wondered about route changes. I had noticed the option regarding route change notification so I knew they existed but I never saw a flag so I presumed they were not occuring... alas I have been analyzing data on a different machine that running the pings (using the autosave files from the running machine as input) which begs the question is there anyway to visualize these route changes when looking at previously saved sample sets?
A point of clarification ... am I correct in asuming that when you click on a particular route change event that the top graph reflects the route after change event but the counts shown still reflect current sample window ?

thks,
Bob

Hi, Bob.

All the route change information is saved along with the sample information in the save file. The save file included everything you need to do full analysis.

When you re-load a saved set, the route information gets populated in the route change window automatically. If the route change window is not visible, then you'll need to grab the splitter below the target history window to open it up. (I've attached a picture to highlight that splitter). Just click the splitter or drag it to open it to an appropriate size.

You are correct - when you click on a particular route change even, the upper graph shows that route using the focus period you have selected. In many cases, the router in the upper graph might not have participated during that time period, so you'll see no samples sent.

Whenever you select a period on the time graph, PingPlotter automatically selects the most recent valid route during that time period. This keeps the route in sync with the history period you have selected. Manually selecting the route in the left route window is the "override", and may require you to manually highlight the right time period to show valid statistics.

Additionally, if you want to find out what routers are different between two (or more) routes, you can just multi-select the routes in the route change list. The upper graph will highlight the routers that were different between these routes.

- Pete

Hi Pete,

That did the trick .... Most excellent !

Many Thanks,
/bob