16

This is the first time I've seen this and I'm not sure what it means;

64 bytes from 74.125.93.99: icmp_seq=6233 ttl=53 time=545.493 ms  
64 bytes from 74.125.93.99: icmp_seq=6234 ttl=53 time=776.093 ms  
64 bytes from 74.125.93.99: icmp_seq=6235 ttl=53 time=-705.731 ms  
64 bytes from 74.125.93.99: icmp_seq=6236 ttl=53 time=52.549 ms   
64 bytes from 74.125.93.99: icmp_seq=6237 ttl=53 time=44.470 ms

Has anyone ever seen a negative ping time before? A friend of mine told me he saw it once on a wireless link, and this was over a wireless connection, but.. how does that happen?

Sathyajith Bhat
  • 62,374
Jeff Welling
  • 575

4 Answers4

17

Did NTP or Windows Time Service sync the system clock during the ping?

Hydaral
  • 1,760
  • 9
  • 11
4

I find it hard to believe, but this discussion seems to indicate this is behavior from certain AMD CPUs.

Personally, I wouldn't worry about it and assume it's a conceptual flaw in ICMP... Maybe a packet that went through a different path or something weird involving machines/routers with their clocks set differently.

James T Snell
  • 5,932
1

I believe it's a bug in the way the ping command times the packets and is aggravated by AMD processors more than Intel.

The functions that are used for high resolution timing in windows are QueryPerformanceCounter and QueryPerformanceFrequency.

Unfortunately, they are broken for multi-core processors as these processors do not return the same numbers.

The fix to ping is to set thread affinity in ping. I doubt it's doing this which would explain the negative timing. There are also patches from AMD and MS which are supposed to help sort it out.

Kevin Panko
  • 7,466
hookenz
  • 4,095
1

Unfortunately, this is not limited to AMD processors, but it seems to affect XP quite a bit. To date, and after a few years of searching for answers, I know a quick fix, but I can't do it to servers that won't reappear by remote after booting.

To reset TCP/IP (and timings), open an admin CMD window and enter the following:

ipconfig /flushdns
arp -d
gpupdate /force
netsh int ip reset null
netsh winsock reset

Now, you MUST reboot. Network adapter reverts to DHCP, so beware remoters.

So what happens here?

For some reason, TCP/IP has a time stamp it uses to calculate timing, and it gets fudged somehow. I used to see it all the time at one location, but it's finally stopped. Unfortunately, it continues at the warehouse I manage. Tonight, all points seem to be stuck at 237ms, but 2 popped back with multiple pings.

pingpath is a very handy utility, and I will be using this more often. Unfortunately, it came up with the same results...

Sad thing, this clears ping miscounts in games also.

note- if you want to see the log file, replace null with a filename, such as c:\log.txt -- Null just means no file (technically)

50-3
  • 3,999
Jeff Mathews
  • 11
  • 1