Ping Monitoring Explained: Latency, Packet Loss and When Ping Isn't Enough.

Ping is the oldest and simplest health check on the internet: send a small packet, wait for the echo. It answers one question very well - "can I reach this host?" - and says nothing about whether the services on it work. Knowing both halves of that sentence is the key to using ping monitoring well.

Key takeaways

• Ping sends ICMP echo requests and measures whether replies come back and how long they take.
• Latency and packet loss trends reveal network problems before they become outages.
• Many firewalls and cloud providers block ICMP - a silent host isn't necessarily down.
• A host can answer ping while its web server, database or mail service is dead.
• Use ping for routers, servers and devices; add port or HTTP checks for the services on them.

How ping works

ping sends an ICMP echo request to an IP address. If the host is reachable and allowed to answer, it sends back an echo reply. The tool reports the round-trip time for each packet and, at the end, how many were lost:

ping -c 4 203.0.113.10
64 bytes from 203.0.113.10: icmp_seq=1 ttl=56 time=18.4 ms
64 bytes from 203.0.113.10: icmp_seq=2 ttl=56 time=18.9 ms
64 bytes from 203.0.113.10: icmp_seq=3 ttl=56 time=17.8 ms
64 bytes from 203.0.113.10: icmp_seq=4 ttl=56 time=19.2 ms
4 packets transmitted, 4 received, 0% packet loss

A ping monitor does the same thing on a schedule, from outside your network, and alerts when replies stop.

What the numbers mean

Round-trip time (latency)

The time a packet takes to reach the host and come back. Absolute values depend on distance: a few milliseconds inside a city, tens of milliseconds across a country, more across continents. What matters for monitoring is the trend - a host that normally answers in 20 ms and suddenly takes 200 ms is telling you something.

Packet loss

The share of requests that got no reply. Occasional single losses are normal on the internet. Sustained loss of a few percent makes TCP connections slow (they retransmit), and heavy loss makes them fail.

Jitter

The variation between consecutive round-trip times. High jitter barely matters for web pages but ruins voice and video calls.

Why a host may not answer ping

Before alerting on a silent host, rule out the usual suspects:

• ICMP is blocked by a firewall, security group or the provider's edge. Many cloud servers drop ping by default.
• Rate limiting - some routers answer only a few ICMP packets per second.
• The address is behind NAT and the public IP belongs to a gateway that doesn't forward ICMP.

If ICMP is blocked on purpose, use a TCP port check on a port that is open instead.

Ping is not a service check

A server can be perfectly pingable while:

• the web server has crashed and port 443 refuses connections,
• the application returns 500 errors,
• the disk is full and the database rejects writes.

Ping lives in the operating system's network stack, so it keeps answering as long as the kernel runs. That makes it a good reachability signal and a poor service signal. Layer your checks:

When everything fails at once, the lowest failing layer usually points at the cause.

Setting up a useful ping monitor

1. Monitor the device, not the service - routers, switches, firewalls, VPN endpoints and bare servers are the natural fit.
2. Alert on sustained failure - require several missed checks, or failures from more than one location, before paging anyone.
3. Watch latency, not only up/down - an alert when response time stays above a threshold catches congestion early.
4. Check from where your users are - a host reachable from one city and not another points at a routing problem, not a dead server. noc724 runs ping checks from several cities in Iran for this reason.

Frequently asked questions

• What is a good ping time?

  +

  It depends on distance. Under 30 ms is typical within one country, 100-200 ms between continents. Compare a host with its own history rather than with a universal number.

• Is 1% packet loss a problem?

  +

  Brief spikes are normal. Loss that stays above 1-2% for minutes usually means congestion or a faulty link and is worth investigating.

• Can ping monitoring replace website monitoring?

  +

  No. Ping only proves the host is reachable. Use HTTP or keyword checks to know the website actually works.