Timeouts: Beware Surprisingly High Delay

Active probing techniques, such as ping, have been used to detect outages. When a previously responsive end host fails to respond to a probe, studies sometimes attempt to confirm the outage by retrying the ping or attempt to identify the location of the outage by using other tools such as tracer-oute. The latent problem, however, is, how long should one wait for a response to the ping? Too short a timeout risks confusing congestion or other delay with an outage. Too long a timeout may slow the process and prevent observing and diagnosing short-duration events, depending on the experiment's design.We believe that conventional timeouts for active probes are underestimates, and analyze data collected by Heide-mann et al. in 2006-2015. We find that 5% of pings from 5% of addresses take more than 5 seconds. Put another way, for 5% of the responsive IP addresses probed by Heidemann, a false 5% loss rate would be inferred if using a timeout of 5 seconds. To arrive at this observation, we filtered artifacts of the data that could occur with too-long a timeout, including responses to probes sent to broadcast addresses. We also analyze ICMP data collected by Zmap in 2015 to find that around 5% of all responsive addresses observe a greater than one second round-trip time consistently. Further, the prevalence of high round trip time has been increasing and it is often associated with the first ping, perhaps due to negotiating a wireless connection. In addition, we find that the Autonomous Systems with the most high-latency addresses are typically cellular. This paper describes our analysis process and results that should encourage researchers to set longer timeouts when needed and report on timeout settings in the description of future measurements.