Network measurement tools: a practical toolbox
When a network is slow or broken, a dozen free tools answer most questions: is the host reachable, where does the path go, where is the loss, how much throughput is really there, and what the packets actually say. Start at the top of the list and work down; each tool narrows the problem for the next one.
The toolbox
| Tool | Use it to | Example |
|---|---|---|
| ping | Check reachability, round-trip time and loss | ping -c 20 example.com |
| ping (MTU test) | Find whether 1,500-byte packets pass unfragmented | ping -M do -s 1472 example.com |
| traceroute | List the routers on the path | traceroute -n example.com |
| tracepath | Trace the path and discover its MTU, without root | tracepath -n example.com |
| mtr | Ping every hop repeatedly and show loss and delay per hop | mtr -rwc 100 example.com |
| iperf3 | Measure achievable TCP or UDP throughput between two hosts | iperf3 -c server -R |
| tcpdump | Capture packets on the command line | sudo tcpdump -i eth0 -n port 53 |
| Wireshark | Capture and decode packets in a graphical tool | Display filter ip.addr==192.0.2.10 |
| ss | List sockets and show per-connection TCP details (RTT, congestion window) | ss -ti |
| nstat | Read kernel counters such as TCP retransmissions | nstat TcpRetransSegs |
| ethtool | Check NIC speed, driver, offloads and error counters | ethtool -S eth0 |
| perfSONAR | Run scheduled latency, loss and throughput tests between sites | pscheduler task rtt --dest host.example.net |
| RIPE Atlas | Run ping, traceroute, DNS, TLS and NTP tests from thousands of probes worldwide | Create a measurement on atlas.ripe.net |
A simple order of work
- Reachability and delay:
ping. Note the minimum round-trip time; it is your baseline. Ping prints min/avg/max/mdev at the end, where mdev shows how much the delay varies. - Path:
mtrortracepath. Loss that starts at one hop and continues to the destination points to that hop or link. Loss that shows at one middle hop but not at the hops after it is usually that router being slow to answer probes addressed to itself, not loss on the path. - Throughput:
iperf3in both directions (-Rreverses). If the result is far below the link speed on a long path, read about the TCP window size and TCP tuning. - Host and NIC:
ss -ti,nstatandethtool -Sshow retransmissions, small windows and interface errors on the machine itself. - Packets: when you still do not know, capture with
tcpdumpand read the trace in Wireshark.
Measure from more than one place. A problem seen from one host only is usually local. RIPE Atlas probes and perfSONAR nodes let you test the same path from outside.
Guides in this section
- Passive measurementWatching real traffic without adding any: tcpdump and Wireshark captures, capture filters, pcap files, NetFlow, IPFIX and sFlow flow records, and the privacy rules.
- Active measurementActive measurement explained: round-trip versus one-way delay, clock sync, OWAMP and TWAMP, perfSONAR, RIPE Atlas probes and SmokePing-style latency and loss monitoring.
- AS numbers and BGPWhat an autonomous system is, how 16-bit and 32-bit AS numbers work, how BGP picks routes, and how to inspect routing with bgp.tools, RIPEstat, RouteViews and RPKI.
- IPv4 exhaustion and IPv6How IPv4 ran out: the IANA pool ending in February 2011, each registry's run-out date, NAT and carrier-grade NAT, and how far IPv6 adoption has come by November 2026.
- GlossaryPlain-English definitions of 50 networking terms used on this site, from AS_PATH and bandwidth-delay product to RPKI, Squid SSL-Bump, TWAMP, Vary and path MTU discovery.
Sources
- ping(8) manual page, iputils
- traceroute(8) manual page
- tracepath(8) manual page, iputils
- mtr(8) manual page, Debian
- Invoking iperf3, ESnet
- tcpdump(1) manual page, tcpdump.org
- Building display filter expressions, Wireshark User’s Guide
- ss(8) manual page, iproute2
- nstat(8) manual page, iproute2
- ethtool(8) manual page
- Running tasks with pScheduler, perfSONAR documentation
- User-defined measurements, RIPE Atlas documentation