For many online services, such as SSH and transaction services, network delay can be crucial. Hence, to ensure that overall service performance is high, it is essential to monitor both application latency and network delay constantly in order to detect slow-downs.

A white paper jointly generated by Luca Deri of ntop.org and Michael Patterson of Plixer.com

explains how to determine latency from flows on the network which have been captured by the nProbe developed by Deri.

The nProbe, which is an open source network probe, resides on a workstation or server and turns traffic into traditional NetFlow v5 data. Data are further collected by a NetFlow analyzer like Plixer International’s (News - Alert) Scrutinizer to determine network latency.

Now latency from the nProbe comes in the following formats:

• APPL_LATENCY

• CLIENT_NW_DELAY

• SERVER_NW_DELAY

As explained in the paper, the APPL_LATENCY and CLIENT_NW_DELAY are determined when the nProbe observes the TCP flags in a transaction. In a typical transaction, the time delta is divided by two, as the desired results required for computing the network latency are assumed to be half of the transaction’s round trip time. The nProbe measures latency in milliseconds (.25 msec and .01 msec) and can be displayed as a CSV export by using the FlowView feature of the NetFlow analyzer Scrutinizer.

Because application latency is computed as the time needed by an application to react to a client request, application latency depends on where the probe is placed. For this reason, nProbe should be located as close as possible to the server in order to minimize the time it takes to pinpoint problems. With certain protocols such as ftp file transfer or video-over-ip, application latency cannot be computed, as they are one way communications without client->server and server ->client directionality.

In summary, by providing techniques for measuring both the delay introduced by the network and the server applications, the nProbe allows collectors to provide customers with full visibility of network service performance,. The physical location of the nProbe is crucial, so placement should be considered carefully. Accurate application latency is best determined by installing the nProbe on the same server as the application in question, or on a hardware probe nearest the server.

For further details on the nProbe, click here.