banshee/network-collection/network/icmp/ping

Ping of a host

Says whether a host answers ping, and returns its packet loss and its average response time. A host that answers no echo at all is critical, "Host down". Two watches are offered: packet loss, and slow replies.

Versions

Generic: any host that answers ICMP echo, in IPv4 or IPv6, whatever its system.

How it works

The poller sends ICMP echo requests to the address of the host (host:address), IPv4 or IPv6, and counts the replies. Three settings of the tree, set on the host or one of its folders, say how:

Variable	Says	Default
`protocol:icmp:count`	how many echo requests leave, 1 to 20	5
`protocol:icmp:timeout`	how long each reply is awaited, in seconds, 1 to 10	2
`protocol:icmp:interval`	how far apart the requests leave, in milliseconds, 100 to 5000	200

No reply at all: the collector stops as critical, "Host down", and says how many requests left and to which address. No value is returned: there is no response time to give.
Some replies: the loss is the share of requests left unanswered, in percent; the response time is the average of the replies received, in milliseconds, to the thousandth.

A name in host:address is resolved by the poller's system first; the address reached is the one named in the message of "Host down". The collector only reads: an echo request asks the host for nothing but its reply.

Prerequisites

The host answers ICMP echo (ping): no firewall on the way, nor on the host itself, drops it. A Windows server drops it by default until the rule "File and Printer Sharing (Echo Request - ICMPv4-In)" is enabled.
The poller is allowed to send ICMP: on Linux, through unprivileged ICMP sockets or the capability CAP_NET_RAW. Without it, the collector stops as misconfigured, icmp_not_permitted.

Outputs

Name	Label	Unit	Per instance
`loss`	Packet loss	%	no
`response-time`	Average response time	ms	no

Watches

Name	Title	Kind	Defaults	Checked by default
`loss`	Packet loss	above a threshold, on `loss`	warning above 20 %: two lost out of five	yes
`slow`	Slow replies	above a threshold, on `response-time`	warning above 200 ms, critical above 500 ms	no

"Host down" is not a watch: it is the stop of the collector, critical, whenever no echo is answered, and it cannot be unchecked. A host that is meant to be off has its probe disabled instead.

Limits

A host that drops ICMP is seen down while its services run: watch one of its services instead (network/tcp/ports, web/https/page).
With the defaults, one lost reply out of five (20 %) raises nothing: the warning is strictly above 20 %.
A reply that comes after its timeout counts as lost.