Ping statistics

pingstatistics

When ping displays statistics the field mdev is the std deviation of all the ping times. It is the average time (in ms) to the average avg.

But because ping times are stricktly positive, I don't understand how mdev could be higher than twice the value of avg, like in this case:

I've got this ping times:

[...]
64 bytes from 192.168.1.1: icmp_seq=76 ttl=128 time=1.95 ms
^C
--- 192.168.1.1 ping statistics ---
76 packets transmitted, 76 received, 0% packet loss, time 75097ms
rtt min/avg/max/mdev = 1.617/13.289/468.557/66.726 ms

where mdev is five times avg.

EDIT: raw data: 1.91,2.83,4.41,1.83,2.98,2.18,2.15,1.68,2.30,2.04,1.64,1.98,1.69,1.88,1.91,1.83,1.70,2.00,2.03,1.89,2.36,2.12,2.07,1.91,1.84,2.04,2.05,2.10,2.19,2.22,1.94,2.13,1.98,2.08,1.62,3.29,2.17,1.99,2.38,2.55,2.16,1.90,1.92,1.90,2.89,2.04,2.05,2.12,2.18,1.61,2.08,1.90,2.17,3.01,1.84,2.12,20.9,362,2.07,2.31,2.42,2.05,2.47,2.55,2.13,2.56,2.07,468,2.33,2.32,1.93,1.87,2.50,1.82,2.45,1.95

Best Answer

The last value, labeled mdev under Linux and stddev under Solaris is computed slightly differently depending on these OSes.

The formula used by Linux ping is:

sqrt(smean-mean²)

while the one used by Solaris ping is:

sqrt((smean-mean²)*received/received-1)

with smean being the mean of rtt squares, mean the mean of rtt values and received the number of answers received.

Here is a small awk program using your data and showing how are computed these values.

echo "1.91 2.83 4.41 1.83 2.98 2.18 2.15 1.68 2.30 2.04 1.64 1.98 1.69 1.88
1.91 1.83 1.70 2.00 2.03 1.89 2.36 2.12 2.07 1.91 1.84 2.04 2.05 2.10 2.19
2.22 1.94 2.13 1.98 2.08 1.62 3.29 2.17 1.99 2.38 2.55 2.16 1.90 1.92 1.90
2.89 2.04 2.05 2.12 2.18 1.61 2.08 1.90 2.17 3.01 1.84 2.12 20.9 362 2.07
2.31 2.42 2.05 2.47 2.55 2.13 2.56 2.07 468 2.33 2.32 1.93 1.87 2.50 1.82
2.45 1.95" | awk '
function abs(v) {return v < 0 ? -v : v}
BEGIN {
  min=0x7fffffff;
}
{
  for(i=0;i<NF;i++) {
    received++
    v=$i
    min=v<min?v:min;
    max=v>max?v:max;
    sum+=v
    sum2+=v*v
  }
}
END {
  mean=sum/received
  smean=sum2/received
  printf("received=%d, min=%f, avg=%f, max=%f\n",received,min,sum/received,max)
  printf("Linux ping mdev: %f\n", sqrt(smean-(mean*mean)))
  printf("Solaris ping stddev: %f\n", sqrt(((smean-(mean*mean))*received)/(received-1)))
}
'

Its output is consistent with your test:

received=76, min=1.610000, avg=13.294211, max=468.000000
Linux ping mdev: 66.632781
Solaris ping stddev: 67.075529
Related Question