Copyright: Copyright © 1998, 2001 by Pete Ness
Citation: http:


Alerts

What is an alert?

Alerts basically monitor the conditions of a specific IP address - and then do something when those conditions exceed a specific range. The things you can do with an alert are:

•	Send an email (most popular)

•	Play a .WAV file

•	Log to a text file.

So let's say you have a machine that you want to know when it stops responding. You can attach an alert to that IP address that sends you an e-mail alert if the last 10 of 10 sample requests are lost.

Another possible alert condition to check for is if the average for the last 10 samples is > 300 (or any other number) - you can send an alert - or maybe play a .WAV file (if you're usually within hearing distance). Also, if you're trying to show your ISP there's a problem, you might log the data to a file so you have records of every time it happened over a time period.

Setting up an alert.

So, let's set up the alert for the last 10 samples > 300ms. Run Ping Plotter and go to the "Edit/Alert Setup" menu. If you've never set up an alert, you won't have any listed here. Hit the "New" button. Enter a name for the alert (I'm using "Bad Packet Loss"). In traces to examine, use "10".  Set it to alert when 4 or more samples are over 9999.  (Note: 9999 is not a magic number.  A lost packet is always greater than any number entered, so you can use 1000, or 20000 here and a dropped packet will exceed either of those numbers).  That setting will alert when 40% packet loss is acheived.

Next, select what you want to happen when the alert fires. I usually start off by playing a .WAV file - that way I can hear when the alert fires - and get instant feedback that things are working.

E-Mail alerts.

If you want to set up an e-mail alert (try doing the WAV one first!), you'll have to set up your e-mail setups in the "Edit/Email Setup" and enter your SMTP server and e-mail address first. This is important so Ping Plotter knows how to send messages.

After you've set up your return address/SMTP server, create a new alert or edit an existing one (Edit/Alert Setup <g>). Turn on the checkmark for "Send SMTP Email to:..." and enter the e-mail address you want it sent to. You can customize the subject for the e-mail that will be sent.  Including $host in the subject will substitute the destination you're tracing to.

The next two settings control the frequency at which you'll get e-mails during alert conditions. The first (Maximum e-mail frequency) is pretty self-explanatory - you'll only get e-mails that often. The second (How long to wait for worse conditions) specifies how long Ping Plotter will wait after it's first alert condition to send an e-mail. You man not want one immediately - because you'll want to a bit more info to be included - so you may want to wait 5 minutes or so before that first e-mail gets sent off. During testing, you probably want both of these settings pretty low, though.

Once you have your e-mail set up, use the "test" button to see what the message will look like (and also to make sure all the settings are working).

Tying an alert to an IP.

Once you've got your alert set up, you need to tell it which IPs to monitor for those conditions. To do this, trace to a destination just like you normally would. Once the path has listed, pick the router/destination from the list you want to monitor - and right-click on the hop number. From the popup, select "Add Monitor". You'll get a dialog that shows the DNS name (if there is one) and the IP address you selected - and then a list of available and selected alerts. Move the alerts you want applied to this IP address into the "Selected" list - and then close the dialog. Monitoring will start immediately.

When a hop is being monitored for an alert, the hop number will have brackets around it (i.e.: [9]). You can stop monitoring by right clicking on the hop number and selecting "Modify Monitor" and then removing any alerts from the selected list.

A note about "average" response times.

Before version 2.30, Ping Plotter used to support alerting on average response times.  The real problem with averages is when a server stops responding - what is the average of the last 10 samples if the last 10 were timeouts?  Because of the problem with this, version 2.30 changed the alerts so you always have to do "when X or more samples is > Y".  You can still get pretty good alerts that work similar to how averages worked - by saying "when 5 or 10 samples exceeds 300 ms" (this would be like an average over 300ms, but would also fire when there were lost packets).


Almost Simultaniously
So that your network bandwidth doesn't get saturated, Ping Plotter waits a tiny amount of time (configurable - but defaults to about 1/50th of a second) between sending out each hop.


Command Line Arguments

You can have Ping Plotter do a few things automatically on startup by specifying command line parameters.  You can put these parameters in a shortcut - or enter them from a DOS command line window.

PingPlotter [File to Load] [/TRACE:[Address To Trace]] [/SAVE]

Loading a file at startup

If you enter a parameter without a / on it, PingPlotter will try and find a file by this name - and load it if it's found.

Example:

pingplotter www.pingplotter.com.pp2

/TRACE

This option will start tracing automatically when PingPlotter loads.  If use the option to load a save file on startup, then tracing will begin to this address.  Otherwise, Add a colon (:) and the IP Address or server name you want to trace to.

Example:

pingplotter www.pingplotter.com.pp2 /TRACE

or

pingplotter /TRACE:www.pingplotter.com

/SAVE

This option can only be used when you specify a file name on the command line.  If you use /SAVE, then any new traces (to the original address specified in the save file only) will be saved to that file on shutdown automatically (without asking you if you want to save).

Example:

pingplotter www.pingplotter.com.pp2 /TRACE /SAVE

/SINGLEINSTANCE

If Ping Plotter is run with this parameter, then it checks to see if another copy of the program is running.  If it is running, then it exits.

Also, if you passed in an address to trace (via the /TRACE:address option above), then this address will be passed to the currently running version.  The currently running one will start tracing to that address.

Example:

pingplotter /SINGLEINSTANCE /TRACE:www.pingplotter.com

/INIFILE

You may want to start Ping Plotter with a different set of parameters and setups.  This is particularly useful if you're auto-starting Ping Plotter and having it trace automatically.  In this situation, you may want to have different trace intervals, or graph times, or whatever.  Starting Ping Plotter with an alternate INI file allows you to save multiple setups and use these different setups as needed.

Example:

pingplotter /INIFILE:alternatesetup.ini

/?

Show this help screen.

Example:

PingPlotter ?


Features

Ping Plotter is an enhanced trace route program.  It does all the things a normal trace route program does - just faster (and better).  It also adds some great features (graphing, enhanced statistics, long term monitoring, alerts, etc.).

Ping Plotter was originally written to help troubleshoot internet connections.  (Of course most trace route utilities were written to do that - most of us don't mess with this kind of thing when things are working well!)  But Ping Plotter is no regular trace route program.

Long term monitoring is a key feature and focus of Ping Plotter.  This allows you to see trending - and to capture problem periods for later review.

Version 2.3 has quite a bit that the freeware version 1 doesn’t.  Version 1 is still freeware (and available on the Ping Plotter web site, but won't be enhanced in the future.

Version 2.3 features:

Easy to use!  Ping Plotter's basic mode means you just type in the address you want information about and hit "Trace".  It starts tracing and shows you a graph.  Someone with no network experience can see where their packets are being dropped and contact their ISP with this information.

Fun to use!  (OK, maybe this is stretching it a little, but ...).  When I first developed Ping Plotter, I spent hours just typing in addresses and checking out the routes packets take, performance bottlenecks, etc.

Graphs the response time through the route of the packet from source to destination.  This really highlights problem hops and lets you concentrate on trouble areas.

Uses multiple threads to increase performance.  This means that Ping Plotter doesn't wait for hop 1 to respond before sending out a request to hop 2.  A complete 1 sample trace can be done in about 5-10% of the time it takes to do a trace with Windows "TRACERT" command (usually less than 1 second for Ping Plotter vs 15-45 seconds for TraceRT).

Uses multiple threads to increase performance and accuracy. This means that Ping Plotter doesn't wait for hop 1 to respond before sending out a request to hop 2. A complete 1 sample trace can be done in about 5-10% of the time it takes to do a trace with the Windows "TRACERT" command (usually less than 1 second for Ping Plotter vs 15-45 seconds for TraceRT).

Graphs any host over time - lets you scroll back and forth over time, and zoom in on any specific time to find out where problems occur. You can even graph multiple hops at the same time.

Ping Plotter's graph can be resized, rescaled, zoomed, dragged and manipulated to give you exactly the information you need to find a problem. Helps you identify whether a connectivity problem is your ISP or network, the host you're connecting to or somewhere on the internet between you and the remote host. Ping Plotter will even help you identify which network (Digex, Cable & Wireless, Alternet, MCI, Sprint, etc.) is the source of your problem down to the specific node.

Creates nice images (via clipboard copy, or saving as .BMP or .PNG files) that can be sent that can be sent via e-mail. Face it, text dumps of a bunch of numbers aren't always the most compelling evidence. Put a picture on that data that shows where the problem lies and let your network provider argue with you then!

Schedule automatic saving of images (in BMP or PNG format), or saving of the underlying raw data. Use this to collect data over a long period automatically.

Keep track of route changes. No other product tracks route changes like Ping Plotter - giving you the ability to see what route your data was taking at any time in your tracing session.

Exports any portion of your collected data to a text file for analysis by other software packages (e.g. Microsoft Excel). If Ping Plotter doesn't graph it the way you want it, use your favorite graphing software and do it yourself!

Built for long-term monitoring. Ping Plotter works GREAT for overnight or even multiple-day monitoring projects. Set your interval and let it run. Check back later and review the history to find out trends and problem times. Does the speed degrade at 9PM and improve at 1AM? Ping Plotter will make that VERY clear and give you all the data to present to your ISP.

Will save your accumulated data for a host to a file and then allow you to reload and continue. Some users have reported running Ping Plotter over several weeks, and accumulating over 50,000 sample sets!

You can save and load sample sets - and then resume the trace. This way you can have multiple sessions of data in the same graph.

High performance, low overhead. There is no trace route package available that returns results faster. Ping Plotter is FAST and it uses very little CPU to do its job. That means you can run it continuously without interfering with your other tasks.

Alerts! Alerts will allow you to set parameters where you want to be notified of the condition. If the conditions fire an alert, you can log that data to a text file, play a wave file, or send yourself e-mail with the pertinent information included.

Built-in Whois. You can query the Internic servers by name, or the ARIN servers by IP address (to see who owns and runs a particular IP address).

Still not convinced?  There's a lot more in there - just download it and check it out yourself!


Frequently Asked Questions

Troubleshooting Questions

Whenever I try to run the program I get an error message "Can't get a handle on icmp.dll".
Ping Plotter uses a .DLL that's provided by Microsoft and is used by their "PING" and "TRACERT" packages. If you haven't installed these, then that .DLL might not be installed. If you're running Windows NT, these are installed by adding "Simple TCP/IP Services" to the "Services" tab of your network setup. If you're running 95/98, they should have been already installed - you may need to re-install your TCP/IP protocol.

Why doesn't Ping Plotter work on my machine?  It gives me some kind of error message and doesn't work!

The first thing to do in this situation is to try the Windows "TraceRT" command from a DOS command line.  Ping Plotter uses Windows API calls to do its tracing - and TraceRT uses exactly the same API calls.  If TraceRT doesn't work, it's extremely unlikely that Ping Plotter will work.  If TraceRT DOES work, then so should Ping Plotter.

Why do all hosts show up as "Destination Unreachable" on the 2nd (or 1st or 3rd) hop?

Are you connecting to the Internet via a firewall or proxy server?  Sometimes these services block ICMP echo requests (which Ping Plotter and all Windows trace route software use).  Try using the Windows "TraceRT" command to see if it gives you similar results.

I'm using a proxy server. Why can't I see anything beyond the proxy server with Ping Plotter?
I don't know of any proxy servers that pass on PING/TRACERT requests. This means that Ping Plotter doesn't work with a proxy server at all. The only way you can really measure network performance on the other side of the proxy server is to run Ping Plotter on the proxy server (or a machine that's not behind the proxy).
I've had some really good success with NAT type IP sharing, though - NAT seems work much better than proxy solutions do for hooking a network up to the internet and only using a single IP address. I've been using WinRoute and am very impressed by the capabilities.

Why does a trace to www.microsoft.com (and it's affiliates) always return "Destination Host Unreachable"?  How about some of the other sites that return this all the time?  I can connect to these sites fine with Internet Explorer!

One of the routers used between you and the destination site are not passing through ICMP echo requests.  This isn't TOO common, but does happen sometimes.  If you feel you really need to trace to these sites, contact them to find out what you can do about it.

When I set up an alert, it never seems to fire - although the "Test" button sends me an e-mail just fine.
Once you've set up an alert, you have to attach the alert to the IP address you want to monitor. This gives you the capability to use different alerts for different IP addresses.

To attach an alert to an IP, trace to the host you're interested in. Then, right-click on the hop you want to monitor. Select "Add Monitor". Then select an alert (or multiple alerts) from the list. This should put a [...] around the hop that's being monitored.

For a detailed explanation of alerts go here.

Other Questions

Why does one particular hop in the route often show a really bad time - but the hop right after it performs well?
It appears that some routers just don't prioritize timed out ICMP requests very high (ICMP requests where the TTL equals 0 after reaching them). If the hop right after consistently performs well, just don't factor this hop into your troubleshooting equation (i.e. ignore it).

Why does hop 1 (or any number of initial hops) lose packets 100% of the time?
Often your local router just doesn't respond (or respond fast enough) to ICMP requests. If you have this happening, you can ignore the initial hops that are timing out (View/Ignore first hop(s)).

How much difference should I see between hops on a good connection?  If hop 5 is returning in 200 ms, and hop 6 is consistently returning in 300 ms, is that good or bad?

A good router in itself should really add no latency to your trace.  Something that does have a huge impact on latency, however, is the speed of light over a distance.  Moving your packet across the country (if your country is very big!) is likely to add some latency.

It's important to realize that sometimes a hop will report high numbers - and the hop right after it will report low numbers.  In this case, that hop is probably not the problem (see the prior question for more details).  If the server at hop 6 is consistently adding 100ms - and hop 7 is showing this as well (i.e. hop 7 is 300+ as well), then it's likely that there's a problem at hop 6 or between hop 5 and hop 6.  I hope to add some additional information on this topic soon (with examples) - Check the Ping Plotter web page.  If you have some particularity good examples that you wouldn't mind me posting, send me some mail.

When I stop a trace for some reason, I'd like Ping Plotter to automatically reset the graph instead of just "Resuming".

If you'd rather completely reset a running (or paused) trace, just right click on the "Stop" (or Resume - if you've already stopped it) and then select the "Reset and Restart" option.  This will clear the current graph completely before it restarts the trace.

The ping times don't always seem to add up logically to me. For example, I commonly see the avg time for a single hop being longer than the total return trip number. This doesn't make sense to me. Can you explain this to me?
It appears that some routers just don't prioritize timed out ICMP requests very high (ICMP requests where the TTL equals 0 after reaching them). This often means that a specific site will take a lot longer to respond back to you than it does to send the packet on to the next host. If the hop right after consistently performs well, you can often just not use this hop in your troubleshooting equation. On the other hand, if you start dropping a lot of packets at this hop (that show up in later hops as well), this may indicate that the router is overloaded (ie - doesn't have enough processor time to do all it's tasks).


History

5/20/2001 - Version 2.30 released

Added some usability features, fixed some problems, etc..  See here for more details on what’s new in version 2.30.

7/23/2000 - Version 2.20 released

This is a pretty major update.  See here for more details on what’s new in version 2.20.

11/15/98 - Version 2.03 released - bug fix

This version is *mostly* a bug fix version. It includes the following changes:

Bugs Fixes

Fixed case sensitivity on registration code bug.

Fixed occasional access violation when tracing

Fixed occasional lockup under Win95

Fixed so DNS name doesn't ever return your own computer's name when a hop times out.

Fixed so DNS lookups always happens - even if the first hop times out.

Fixed the alert system so it works correctly now. Alert system is much more reliable.

Fixed the alert system so more than one alert can be tied to any IP address

Fixed problem where saving a sample set would sometimes not work (when there was no DNS name).

Minor changes to registration code system.

New Features

Export to text file now allows exporting with the samples in rows rather than columns (to overcome Excel's 255 column limit).

8/9/98 - Version 2.02.2 released - bug fix

Fixed a bug that caused "Runtime error 217 at 0000xxxx" when running Ping Plotter on some machines - depending on the regional settings of the date format.

8/5/98 - Ping Plotter Version 2.02 released (minor features and bug fixes)

New Features

Enhanced /SINGLEINSTANCE support - works better with Ping Tool Quake browsing utility.

Added a Packet Loss % column - made the ERR column optional.

Added hints on column headers.

Registration code enhancements (added multi-user licenses).

Alert "BEEP" additions for machines without a sound card installed.

Right-clicking the "Stop" or "Resume" button now brings up an option to reset the trace before restarting.

Bugs Fixes

When run on a multi-processor, Ping Plotter would sometimes not shut down correctly.  This has been fixed.

Fix where IP address would sometimes show up as 0.0.0.0.

Fixed odd "Floating Point Error" that would occasionally pop up.

Passing an IP address on the command line no longer adds that address to history (addresses still do, though)

Fixed the menu option for "Add Monitor/Modify Monitor" so it displays correctly.

Improved display when using large fonts.

V 2.01 - Released 7/8/98

Fixed bug in registration code checking that would cause the reminder dialog to pop up on the first try (oops).

Timeline graphs are automatically enabled on the destination host now.

Fixed weird timeline graph sizing problem where if only one graph was shown, then the graph would be drawn 4 pixels too tall and cut off the bottom of the date/time display.

Whois lookups were corrected for change in Internic format.

V 2.00 - Released 7/3/98

This is a major revision - see the web site for differences between version 1 and version 2.


Initial Setup

Ping Plotter is pretty simple, but there are some initial options you may need to set to get best results.

1)  If you have a 256 color (or less) display, you may want to turn of the graph colors (see Options).

2)  Depending on the speed of your internet connection, you may want to change some of the threshold values (see Options).

3)  (Future versions of this help will probably have more here).


Introduction

Ping Plotter was inspired by the need to find out why my internet connection was so erratic.  Sometimes it was really fast, other times terribly slow.  I wanted a way to find out (easily) where the problem was and then be able to use the information I gathered to send to the person that could fix the problem.

Basically, Ping Plotter is a trace route program - but adds some graphs, long term monitoring, plus some serious performance upgrades.

Graphs

The "old" way of troubleshooting internet problems is to look at a pile of data using the "traceroute" or "tracert" tools.  While this gave information that you can use, it was hard to read.  You really had to look over the data to determine where the problem was.

Ping Plotter takes all this great data that the trace route tools delivered, and puts it in a visual form that can really help you see where the problems lie.  The pieces of information shown on the graph are focused specifically to help you determine where the problems lie.  A quick look at a graph can help pinpoint a problem that would be really hard to find in text.

Long term monitoring

Ping Plotter can be run continuously, and collects the data it generates.  This data can then be graphed long-term (see the graph at the bottom of this page for an example of where 2 days worth of data can really show a problem), and massaged, twisted and graphed post-fact to help communicate the problem areas to those who can help correct the problem.  This was the goal of Ping Plotter when I wrote it - help communicate the problem to the people that can help solve it.  There are now many ISPs across the country that know how to read a Ping Plotter graph - because it makes their job much easier.

Multi-threading

Ping Plotter is fast.  Ping Plotter does many of its tasks in parallel - which allows it to deliver immediate results in less than a second in most cases.  There is no utility that can deliver the same data that Ping Plotter does any faster (and there are no utilities in its price range that allow you to graph data like Ping Plotter does).

Here's an example of a graph taken in fall of 2000 (I've since changed providers, and my source for data like this is no longer available.  My current provider is rock-solid and the graphs are just not interesting any more).

Notice the jump in latency (from 94 avg to 203 avg) between hop 7 and hop 8 there?  Notice the big packet loss added at hop 9 (25%!)?  Notice the "trending" in the lower graph - where performance and packet loss is pretty good in the morning hours (2am), but then deteriorates under load (afternoon/evening)?  All 3 of these point to a problem between rr.com (Roadrunner) and Alter.net.  Without the graph, this analysis would be hard to do, but with Ping Plotter, it's quite evident.


Introduction to trace route

At its heart, Ping Plotter is a trace route utility.  It's souped up and on steroids, but the basic concept is the same as any other trace route utility.

Trace route is a modified "ping" packet (echo request).  When you "ping" a site, you send over an echo request and that site responds back that it received it.  The amount of time it takes for the packet to get to that site and then return to you is the "ping time" (also called "latency").  In general, the lower this is, the better your connection to the site.  This time is usually specified in milliseconds (1/1000 of a second).

One of the parameters on a ping packet is something called "Time to live" (TTL).  This is set to some suitably high number (something like 35).  As this packet moves through the route to the destination, this number is decremented by 1.  If any router sees that the TTL is 0, then it sends the packet back to the computer that sent it.  One reason this happens is so that packets don't get caught in an endless loop (this can happen when there is a route change, and the routers involved don't all know the same information as new information is being replicated out).

Trace route plays with this TTL number on outgoing packets.  It first sends out a packet with a TTL of 1.  The first router that sees this decrements it to 0 and then sends it back.  It also sends back its own IP address with the packet.  So your computer receives back a packet with an IP address in it - and you have the time it took to traverse this route.

Ok, so next trace route sends out a packet with a 2 as the TTL.  So it can find out what the next computer in the route is.  This is repeated until the final destination is reached.  At that point, you know the entire path the packet has traversed to reach the destination computer - and the time it takes to get to any of the router in between.  Pretty cool.  Each server in this chain is called a "hop"

So the last hop in a trace route is actually the round-trip time to the destination server.  This is an important concept to understand.  You don't add up all the times between you and the destination host - as that time has already been added.  The time to the last hop in the chain is exactly the same is if you'd used a ping utility to that host.  So a trace route utility is actually two utilities - ping AND trace route.

Ping Plotter speeds up this process by sending out packets to the first 35 servers in the route all at the same time.  This makes a HUGE difference in overall speed.  It also means that the network conditions for each hop is very similar - so the number are better compared.


New in Version 2.0

Version 2.0 of Ping Plotter introduces a bunch of great new features.  Among them are:

Will graph single hops (from one to all) from your trace over time - and display them on a graph. This graph can be resized, rescaled, zoomed, dragged and manipulated to give you exactly the information you need to find the problem.

New "Alert" system. This will allow you to set parameters where you want to be notified of the condition. If the conditions fire an alert, you can log that data to a text file, play a wave file, or send yourself e-mail with the pertinent information included.

You can save and load sample sets - and then resume (right-click the trace button when you have existing data and you're not tracing) the trace. This way you can have multiple sessions of data in the same graph.

Exporting to comma delimited text file for use with external programs (Excel) is supported.

You can now "Fix" the graph scale to a specific size so that bad hops don't cause all valid points to be resized into a tiny graph.

The icon can be moved from the taskbar to the tool tray for long-term monitoring projects.

You can ignore 1-5 of the first hops in your trace (as opposed to the 1 that version 1.00.2 supported).

Round Trip time is now shown below the last hop. This time is exactly the same as the last hop, but many people me what the round trip time was, so I included it to make things easier for people to understand.

All columns of the graph are now resizable.

The numbers for min and max time are now displayable on the upper graph (right-click the graph).

An option has been added so that PingPlotter works better under NT 3.51 (under Advanced options, "Use non-threaded name lookups"). This is automatically turned on when installed under NT 3.51.

Timeout time and "attack rates" (time PingPlotter waits between sending out requests for each hop - this was 25ms in 1.00.2, but really bad connections might need to make this longer) can be customized.

PingPlotter 2.0 uses significantly fewer resources while tracing.

Limited whois functionality is included. Right now, it only queries the Internic server - a future release may expand on this based on requests.

The "Copy as Image" feature includes more information and looks nicer.

This version will be shareware - and will cost $15.00 to register. The unregistered version will allow you to use all these features to evaluate, but will include "reminder" notices to encourage people to register. The current freeware version will remain freeware and will remain available to those that prefer it.

More (what feature list would be complete the ubiquitous "More" feature?).


Operation

Click inside a circle [image] to get more details about a feature.


Options

Click inside a circle [image] to get more details about a feature.


Auto-Save Options

Click inside a circle [image] to get more details about a feature.


Packet Options

Click inside a circle [image] to get more details about a feature.


Route Change Options

Click inside a circle [image] to get more details about a feature.


Popup_ERR_Col
The PL% Column indicates the percentage of packets lost (number lost divided by the samples to include that have been sent out)

If you're only including the last 10 samples, then only the number of packets lost in the last 10 samples are shown here. If you want to find out packet loss over the entire session, change the "Samples to Include" number to 0 (which includes ALL samples).

The number of packets lost can be shown by enabling the ERR column by right-clicking the graph.


Popup_AddressToTrace
The "Address to Trace" edit box allows you to pick a new host to trace to. You can either type in an address or select one from the list below (double clicking will make it start tracing as well).

Make sure the address doesn't have a protocol specifier, or sub-directory. If you're trying to find out why http://www.pingplotter.com/orders.html isn't responding, just enter www.pingplotter.com.

Any time you successfully trace to a host, that host is added to the list below.

To delete a host, right-click it in the list and then select "Delete".


Popup_Alert_Average
Pick this option if you want the alert to fire when the average of the last X samples is over the specified number.  Be aware that timeout packets are NOT included in this average.  If you want to look for timeouts, use the other event type (single out of range samples instead of average).


Popup_Alert_EMail
If an alert fires, you can send an e-mail.  Before you can set up an alert that uses e-mail, you need to set up your e-mail server name and your email address (do this from the edit menu).

E-mail alerts are kind of unique.  You don't want to send e-mail every 3 minutes when an alert fires, but you probably want to know pretty quickly when something does happen.  Ping Plotter allows some flexibility here.

The maximum e-mail frequency (in minutes) tells Ping Plotter how often you'll accept e-mails.  Something like 60 minutes works pretty well here - it doesn't overwhelm you, but you still get a pretty good flow of information.

How long to wait for worse conditions means that once Ping Plotter hits an alert situation, it won't send the e-mail for this many more minutes.  Often, when an alert fires, the worst is yet to come.  This option allows you to wait a few minutes to find out if it was a temporary or more permanent alert condition.  I like to use 5 minutes here.


Popup_Alert_LogToFile
This option will log the alert sample set to a log file.  If your final destination is:  www.pingplotter.com, then the text file will be called www.pingplotter.com.txt.


Popup_Alert_Name
The alert name is used to identify the alert when attaching to a host.  Make sure you name this something besides "New Alert 7" or it's going to be hard to figure out what it does later... :)  Of course you can always change the name later, too...


Popup_Alert_Out_Of_Range_Count
Select how many out of range samples you want to have to happen before the alert fires.  Also, select here what "out of range" means.  Note that a timeout is always out of range, so you can select any reasonably high number (ie: 9999) to mean timeouts.


Popup_Alert_PlayWave
When this is turned on (and a .WAV file is selected), the .WAV file will be played every time the event fires.  This can happen quite often (for example when a server goes down) once the initial alert fires.  Enter "BEEP" (no quotes) here if you just want to beep the computer speaker instead of playing through the sound card.


Popup_Alert_TraceCount
This specifies the number of samples to examine.  This does NOT have to match the "number of samples to include" from the main screen - so you can set up whatever conditions you want.  Ping Plotter uses this number when determining if the alert should fire.


Popup_Average
The Avg column shows the average response time of the last N samples (where N is the samples to include).  Any timeouts are not included in this sample.


Popup_Avg Line
The red line on the graph shows the average response times for the route. Lost packets are not included in this average.


Popup_Brackets
Any hop number surrounded by brackets (like [12]) means that that hop is being monitored for an alert (see alerts for details on setting up an alert). Multiple alerts can be configured for the same IP, and alerts don't work unless some IP in your current route is being monitored (ie: has brackets around it).


Popup_CurrGraph
The blue X on the graph is the graph of the current (or most recent) sample taken.


Popup_Current
This column shows the individual sample time of the most recent sample included in the set.  If a number is displayed as ERR, that means that the packet was lost - a packet was sent out but was never returned.


Popup_Err Column
The PL% Column indicates the percentage of packets lost (number lost divided by the samples to include that have been sent out)

If you're only including the last 10 samples, then only the number of packets lost in the last 10 samples are shown here. If you want to find out packet loss over the entire session, change the "Samples to Include" number to 0 (which includes ALL samples).

The number of packets lost can be shown by enabling the ERR column by right-clicking the graph.


Popup_Graph Scale
The number shown here indicates the graph scale.

If a dynamic scale is being used, then this number is the maximum response time of any of the included sample set.  This number can change (and WILL change) as new samples are received.

If a fixed scale is being used, this number will always equal that scale.  You can change to a fixed scale by going to Advanced Options.


Popup_Option_Color Background
The background of the graph uses colors that don't display well unless your video drivers are set for more than 256 color.  Turn off this option if you're having problems seeing the graph (ie:  It has little speckled dots instead of a solid color).


Popup_Option_Color Hop
This option can probably be left on all the time - it marks whether or not the red/yellow/red is painted onto the background of the HOP column.  The colors used should work fine on a 16 color screen, though, so you're probably going to be OK leaving it on.  If you want a "Copy as Image" to show up without color, turn this off.


Popup_Options_Color Speeds
These boxes control the point at which the colors change.  By default, all response 200 ms and below will paint green.  From 201 to 500 will paint yellow, and over 500 will paint red.  These numbers apply to both the HOP column and the graph background.  In addition, the legend on the graph screen will be updated with these number.

You'll probably want to change the numbers based on your internet connection speed.  If you've got a T1 or a cable modem, the listed numbers are probably pretty good (you might move them down a little if you're tracing to a fast site).  If you have a modem, you probably want to crank these numbers up a bit.

A reasonable number for a modem would be 350 for Warning and 600 for Critical.  You might want to play around a little with these, though.


Popup_Options_Hop Interval
This can be an interesting number to manipulate.  It's really meant for "advanced" users, so you don't NEED to change it.

Ping Plotter sends out multiple packets at the same time and times everything at once.  Actually, it leaves a tiny interval between each packet so as not to completely saturate your bandwidth when it sends out 30 packets.  This time interval is adjusted by this parameter.  Most of the time, 25ms is good.  This falls within realm of what a 28.8 modem can perform.  If you've adjusted your packet size, or your connection to the internet is really slow, you might want to crank this number up a little.  If you have just oodles of bandwidth, you can crank it down a little.  Be aware that a too-small number can adversely affect your data.


Popup_Options_Non-threaded lookups
NT 3.51 in particular doesn't like to have multiple IP addresses resolved into names at the same time.  NT 4.0 and Windows 95/98 work fine with this check mark turned off.  Performance is best with this turned off.

When this switch is on, Ping Plotter will still uses multiple threads to do tracing, but the looking up of names is done one at a time.  When installing onto a machine running NT 3.51, this option is turned on by default.

Symptoms of having this switch off under NT 3.51 is that Ping Plotter stays in memory - even after you close Ping Plotter.  When you close Windows NT, it notifies you that Ping Plotter is still running.  If you run into this problem, turn this switch on.


Popup_Options_Packet Size
This adjusts the size of the packet that Ping Plotter sends out to the host.  Sometimes routers in the path can be adversely affected by packet size.  You can play with the packet size if you suspect that one of the routers is incorrectly configured or is likely to cause problems with larger (or smaller) packets.

Having this number too high will HUGELY affect your performance.  It's best to leave this pretty small.  Valid ranges are from 10-512 bytes.  Actually, anything up to 32K will be accepted, but using a packet size over 512 bytes is just asking for trouble.

Note that setting this too high can cause the FINAL hop in the trace to appear to be responding poorly.  This is because all hops before the final one are timing out and returning a small "Timeout" packet, but the final destination will be returning the full data that was sent.  Keep this number small for the most consistent response times.


Popup_Options_Scale
By default, Ping Plotter will automatically adjust the scale of the graphs to fit the data you're collection.  Sometimes, if one of the hops in your trace has really bad performance, this can cause the graph to become almost unreadable.  If this happens, you can fix the scale of the graph so it doesn't change.  Both the trace graph - and the time-line graph are fixed by this number when set.


Popup_Options_Show X
To watch "trending", it's sometimes nice to see what the most recent sample is.  This option will enable that.  A little blue X will be drawn on the graph that represents the most recent sample.  You might want to turn this off when submitting a picture to an ISP so as not to confuse them or add anything they can question.


Popup_Options_Timeout Speed
This option allows you to fine-tune your performance a little.  By default, Ping Plotter will wait for 10 seconds for any packet to return.  If the packet doesn't return in 10 seconds, then it is counted as a lost packet.  If patience isn't one of your virtues, you can turn this down somewhat.  No matter what your value is here, timed out packet will show with the time "9999".

Because of the performance enhancements offered by Ping Plotter, it's unlikely that this option needs to be changed.  If it's set too low, it can cause misleading data to be generated.  For best results, leave this at 9999.


Popup_Querying
When the word "Querying" is displayed here, Ping Plotter is waiting on the internet for something - either a trace packet to return or a name lookup to return.  When nothing is displayed here, Ping Plotter is just waiting for you to hit "Trace" or "Resume" - or it's waiting for the specified time interval to elapse so it can get its next sample.


Popup_Round Trip
The round trip line is optional (it can be removed from the "View" Menu).  This shows exactly the same as the last server in the chain, but it's sometimes nice to have this number re-announced for ease of reading.  This line shows the time it takes to get from your computer to the destination server and back again.


Popup_Samples To Include
It’s somewhat important to understand how "Samples to Include" works.

When running a trace, Ping Plotter can look at just the most current samples.  This is great to watch "trending" (where the response changes over time).  If you include ALL samples (type 0 in this field), then after a bunch of samples, new samples don't affect the graph very much.  Setting this to something like 10 allows you to see how the response times are right now.  All numbers in the trace (upper) graph are affected by this.  When zooming in on the timeline graph, it’s important to not have this set to "ALL".


Popup_TimeGraphTimeIndicator
The time under the graph shows what time these samples were taken.  If you have more samples than can be displayed on the graph, you can either change the scale (by right-clicking the graph) or scroll the graph (by clicking on the graph and then dragging left or right).


Popup_TimeGraphTimout
A red line in the time-line graph indicates a timeout in this time period. You move the focus of the upper graph to this time by double-clicking it - to find out where the timeout first occurred (in the upper graph).

The height of the red line indicates the percentage of packet loss in the time period being represented by the pixel.  Keep in mind that based on the number of samples you collect and the scale of the lower graph you're showing, all timeouts may show up as 100%, or there may be multiple samples in any pixel.

If you're doing a trace every 10 seconds, and you're showing 10 minutes of samples, this is only 60 samples - and any one sample is going to take multiple pixels to display.  On the other hand, if you're doing that same thing and showing 48 hours, that's 17280 samples - and some averaging of samples needs to be done to display all the data.  This is where the packet loss percentage really makes sense in the lower graph.  In this case, you're probably going to have about 35 samples being averaged in any one pixel width, so the line height of the latency is going to be an average number, and the packet loss is going to be a percentage - based on how many failed and how many succeeded.  If there were no successful samples in a pixel width, then there will be no black line showing the latency, but instead a full-height red line to show 100% packet loss.


Popup_Trace Interval
The Trace Interval is the amount of time Ping Plotter will wait between each sample set.  If you're doing a long term monitoring project, you may want to set this to 1 minute (or more).  If you're just doing a quick set, you might want to set this to something lower (5 seconds or 10 second).  If the up/down arrow doesn't have the amount of time you want, just type in the time interval you want (e.g. 3.5 seconds).


Popup_TraceCount
The "# of times to trace" allows you to stop tracing after a certain number of traces.  If you're only interested in a set trace count, you can save some bandwidth usage by not allowing Ping Plotter to trace forever.


Popup_Variation
The black line on the graph indicates the range of times received.  The leftmost side of the line is the minimum response time - the rightmost being the maximum response time.

This is great for showing clear network bottlenecks. If the best response time of a hop is higher than the worst of the previous hop, you're pretty sure there's some problem between these two hops.


Registration

Please note that the most current ordering information can be found at: http://www.pingplotter.com/order.html

Ping Plotter is developed under the shareware concept. You're probably familiar with this - you can try out the software for a limited time (30 days) after which you need to pay for it.

It only costs $15.00 per computer to register (contact sales@pingplotter.com for multi-copy discounts or site licenses - or check the Ping Plotter web page).

You'll get the following by registering:

•	You can stop having to deal with the annoying registration reminders.

•	You can send questions and get more attention than people that don't send money.

•	You get free upgrades to future upgrades of Version 2.

•	You'll be able to run any beta version that becomes available.

•	You and your relatives will all become rich and famous.  (This has yet to be proven conclusively).

If you don't think Ping Plotter is worth $15.00, version 1 of Ping Plotter is freeware - and you can use it without registering. You won't get any of the great features of Version 2, though.

The easiest way to register is to check out the Ping Plotter home page (http://www.pingplotter.com), find a "Order" button, and use your credit card. You'll get a registration code immediately and you won't have to wait for your order to be processed by hand (as other methods require).

You can also register by check or money order by following these steps:

•	Check http://www.pingplotter.com/orderform.html to get a printable order form.  This order form will have the latest address and ordering prices and information.

•	Make out a check to "Pete Ness".

•	Make sure you include your e-mail address on the check.

•	Mail your check to:

Pete Ness
2648 N. Maywood Place
Boise, ID 83704

When your check is received, you'll be sent an e-mail with a registration code. Make sure you provide an e-mail address when sending a check.

These directions are all repeated on the Ping Plotter home page (and may have been updated since this file was made), so check there before you order.

Thanks,

Pete


Reporting

Ping Plotter doesn't have any built-in printing options.  What it WILL do for you though is copy its data to the clipboard or text file and let you manipulate it in your favorite software package from there.

There are several ways to output your data.

1.	The graph.  There are a few ways to get a picture as shown in the graph.  A quick way to do this is to select the Edit/Copy as Image option from the main menu to copy the graph and the legend to the clipboard.  The column and graph sizing will match what's on the screen, so make sure everything you want printed is displayed.  You can paste this into MS Paint or any other graphics application to print or save.  You can also go to the file menu and "Save as Image" in PNG or BMP format.

2.	Raw data - in TraceRT format.  Select the Edit/Copy as Text option to copy the raw data to the clipboard.  This is copied in a format that's similar to most text-based Trace route programs.  The difference here is that the "Samples to Include" option on the main screen is used to decide how many samples to include in this.  If you're sending a graph to someone trying to show them there's a problem in the network someplace, it's probably a good idea to include this data too.  Just paste this into your e-mail program or whatever.  For best results, use a fixed pitch font (Courier New) like I've done below.
Be careful about including too many samples in this.  I find 5 samples works pretty well - just go to the Samples to include and enter 5 - and then go copy.

Target Name: www.mci.net
         IP: 204.70.133.140
  Date/Time: 5/19/2001 10:09:02 PM

 1   *       *       *       *        []
 2   40 ms   30 ms   20 ms   20 ms   20 ms   akron2.neo.lrun.com [204.210.223.17]
 3   20 ms   20 ms   20 ms   20 ms   30 ms   twcneo-mci.neo.lrun.com [204.210.219.18]
 4   80 ms  350 ms  300 ms  120 ms   90 ms   bordercore2-hssi5-0-2.WillowSprings.mci.net [166.48.22.9]
 5   91 ms  160 ms  150 ms   80 ms  100 ms   core1.Reston.mci.net [204.70.4.229]
 6  101 ms  140 ms  270 ms   70 ms  140 ms     [204.70.176.22]
 7   81 ms  140 ms  190 ms  110 ms  120 ms   fuss1-0.Reston.mci.net [204.70.255.253]
 8  160 ms  190 ms  160 ms   80 ms   90 ms   beauregard.Reston.mci.net [204.70.133.140]

3.	Comma delimited text file.  This is especially built to import into a program like Microsoft Excel - so you can manipulate the numbers around and create output in different formats.
To export to a comma delimited text file, go to the File menu and select "Export to Text File".  From there, you can specify the file you want to export to and a couple of other options.  You can either export all samples in memory - or the range as specified on the main screen.
The option on this screen "Include sample times in export file" will specify whether or not to include the time each sample was taken at.  If you don't have this turned on, all the samples will be output, but you won't get corresponding times.  Turn this option on to include the times.


Support

Ping Plotter is supported under the model that most inexpensive shareware programs are: via e-mail. If you've registered, you're much more likely to have your feature requests incorporated into the new version - you're also much more likely to get help trying to figure out your problems and also help you figure out what's wrong with your internet connection based on the information provided by Ping Plotter.  That doesn't mean that unregistered users don't get support - you're just more likely to have time spent on you if you've paid a little money :).

Your first step in solving your problem should be to visit the support site on the Ping Plotter web site (http://www.pingplotter.com/).  That site can be kept much more current than the static help file on your hard drive.

If that doesn't help you, you're welcome to send an e-mail.  Also, if you have a feature request, send mail here.

Internet e-mail:

support@pingplotter.com

CompuServe:

102347,710

If you've had a good experience with Ping Plotter, send an e-mail on that too!  It's great to hear success stories!


Timeline Graphing

The timeline graph feature of Ping Plotter is specifically built for long-term monitoring projects.

Often, your ISP problems occur when you're not watching it.  The timeline graph feature of Ping Plotter allows you to trace over a long period of time - and then look back over this history to find when and where the problem occurs.

By default, Ping Plotter will automatically trace the last hop (the host you're tracing to) on a time-line graph.  You also trace any of the other hops by right clicking on that hop in the trace graph and then selecting "Show this Timeline Graph".  You can also turn off any graph by this same mechanism.

Once tracing, Ping Plotter will record each sample on the time-line graph.  The amount of data displayed on the graph can be changed by right-clicking on the timeline graph - then selecting the amount of time you want displayed.  This scale affects ALL timeline graphs and is saved when you shut down Ping Plotter.

If there is more data collected than you can show on the timeline graph with your selected scale, click on the graph and while holding down your mouse button, drag the graph.  This will allow you to move back in history and examine the samples.  You can also use the keyboard to scroll.  To scroll with the keyboard, select the timeline graph and use one of the following keys:

ALT-HOME  - scroll to the beginning of the collected data
ALT-END	- scroll to the end of the collected data
ALT-LEFT - scroll back in time (about 5% of the graph width)
ALT-RIGHT - scroll forward in time
ALT-PGUP - scroll back in time (about ½ of the graph width)
ALT-PGDN - scroll forward in time

If you find a time period that looks "interesting", you can double click on the timeline graph at that point.  The upper graph (the trace graph) will move to that time period.  This allows you to troubleshoot where the connection problem may have occurred.  Keep in mind that the upper graph always focuses in on the number of samples in "Samples to include".  If you have that set to ALL, then the upper graph can't zoom in on any piece of the graph.

It may be that you see a problem period in the 48 hour graph.  Double-click on that period, and the upper graph will focus on that period.  You can then change your timeline graph scale and the lower graphs will try to stay focused on the time period you selected.  This makes it easy to see details about a specific period.

When you're done zooming the graph, right-click on it and select "Reset focus to current".  This will return both graphs (the timeline and the trace graph) to the current time.

Because Ping Plotter takes so little CPU time when running, you can set it up to trace while you're doing something else.  One particularly interesting way to use it is to set it tracing to a site that is hosting a game you're playing, or server you're using (streaming stock quotes, for example).  If you notice your response slowing down, you can check out Ping Plotter and use it to quickly troubleshoot where the problem is coming from.


New in Version 2.2

Version 2.2 has the following new features and bug fixes (since 2.03):

•	Route changes are now handled, and all history is stored with the route that it was recorded on. This means you can see that your ISP (or someone in the route) changed the route to correct a problem (or make things worse!). Ping Plotter keeps track of all the routes for as long as you like.  Additionally, certain route changes can be excluded so normal changes aren’t flagged or logged.

•	You're now able to specify the maximum number of samples you want to keep in memory. This will allow tracing sessions of unlimited length (you'll no longer run out of memory after 2 weeks of hard non-stop tracing).

•	You can now "Save as Image" (instead of having to copy it to the clipboard and use another application to make the image). Supported file formats are .PNG and .BMP. (Before you ask: JPG is way too lossy for concise text/line based graphics, and GIF is owned by Unisys and requires a license to deploy).

•	You can now schedule your data to be automatically saved (at interval). The file name can include any portion of the date/time plus the host name so you can keep nice history files (use this with the maximum in-memory sample count to keep data around forever)

•	You can now schedule an image to be automatically saved (at interval). You might use this to keep an intranet page current, just keep nice images of history. These can be saved in PNG or BMP format.

•	Double clicking an entry in the history list now automatically starts tracing to that address.

•	Trace name/address now shows on taskbar title to distinguish multiple running copies

•	The .PPS file extension has been retired in favor of .PP2.  Microsoft PowerPoint used the PPS extension, and in cases like this, they win.  This extension can be overridden manually in your .INI file as well if you find that .PP2 interferes with some application you’re using.

•	Re-associating with the .PP2 extension now prompts before happening if it's already associated with something else.

•	Time periods on lower time graph *can* be user definable (send e-mail if you have reason to use this feature)

•	Changed WhoIS parsing to better parse new Internic output. Also updated to better work under Windows 2000.

•	Changed lower "time line graph" so that dropped packets don't automatically make the bar full height - if some good samples are included in that single-pixel time period, then the bar is the correct height for the good samples.

•	Entering an IP address (as opposed to a name) now starts tracing immediately (before the IP is resolved into a name). The name shows as (resolving) until the request is complete.

•	Misc. bug fixes including Alert system e-mail fix, high rate data loss, some settings not saving on exit, registration routines work better on NT if you don't have admin access, restoring from tray refreshes the timeline graph.

For changes from previous versions, see "New in version 2.0 "


Popup_Underline
Any hop that is underlined means that it's being traced on a time-line graph (in the bottom portion). The underline makes it easy to find the hops that should be de-selected to remove their lower time-line graphs.


Popup_Route Change
The "Route Change" pane is used to show the history of route changes.  Any time any hop in the route changes, Ping Plotter stores the old and new route data and adds the time of the change to this list box.  Double-clicking on any time will show the route as of that time.  This is the starting time for the change.

Double-clicking on the time-line graph will refocus the upper graph on the period you double-clicked on the lower time-line graph.  The route window will also follow this - to show the route that was current at the time you selected.


Popup_Options_Auto_Save_Data
Ping Plotter can be set to automatically create a .PP2 save file at a specified interval.  This can be coupled with "Maximum samples to hold in memory" to minimize the amount of memory used on long monitoring projects.  The "Save Interval" must have elapsed before the first save happens (this is so short-term tests don’t auto-save data).  A suggested number for this is 30 minutes.

The file name defaults to the current path.  The following variables can be used in the name:

$host	Host name (or IP address)

$year	Current Year

$month	Current Month

$day	Current day of month

$hour	Current hour

$minute	Current minute

$date	Same as $year-$month-$day.

Make sure your file name will resolve to a valid file name.  Remember that : should only be used with a drive letter, and the / isn’t a valid character.

A good example of a file name is:  $host $date $hour00

If the file already exists, it will be overwritten.  This means you can combine a pretty fast save interval, and couple that with a longer time file name (ie:  $host) and save your data often without creating a lot of extra files.


Popup_Options_Auto_Save_Image
Ping Plotter can be set to automatically create an image of the current data (as seen on the graph).  Using this, one could auto-save for a time period, then create some kind of "album" to post for proof of a problem.  The "Save Interval" must have elapsed before the first save happens (this is so short-term tests don’t automatically create images).

The file name defaults to the current path.  The following variables can be used in the name:

$host	Host name (or IP address)

$year	Current Year

$month	Current Month

$day	Current day of month

$hour	Current hour

$minute	Current minute

$date	Same as $year-$month-$day.

Make sure your file name will resolve to a valid file name.  Remember that : should only be used with a drive letter, and the / isn’t a valid character.


Popup_Options_Maximum_Memory_Sample_Count
This is the maximum number of samples that will be held in memory at any one time.  Older samples are purged from memory.  This can be coupled with auto-saving of data to keep your memory images small, but still have access to all the data collected.

Ping Plotter averages about 44 bytes per sample (this can be more or less, but this is the memory for a 20 hop route), so 20,000 samples is still less than 1 megabyte of memory.


Popup Options Autosave Image Type
Select BMP or PNG as the file format to save in.  PNG is a LOT smaller than BMP, but isn't as universally supported.


Popup_Options_Cargo
Note:  This is an advanced option that should probably not be changed.  This is used to diagnose network problems when specific *data* is sent - which is a highly unlikely problem for most networks.

By default, Ping Plotter pads the outgoing packet with repeating $AA.  If you suspect that your network may be having problems when you send specific byte codes, you can enter the hex code that you want repeated, OR a link to a file to read the byte string from.  The cargo space for the packet will be padded with this data.  Use this in conjunction with the packet size to create the network scenario you're looking to duplicate.


Popup Options Show Route Change Indicator
Normally, the route change window is hidden on the main screen.  If this is the case, then a red "notification" will pop up whenever there is a route change - which you can click on to show the route change window.

If you're getting a lot of route thrashing that you don't want to know about, you can turn off this indicator here.  This is *on* by default.


Popup Options Route Change Exclusions
By default, any route change is recorded and noted by Ping Plotter.  In some cases, this may not be desired behavior - an example of this is if something in your regular trace route oscillates between 2 (or more) routers based on load.

If you're seeing route oscillation (where a specific hop regularly changes between 2 or 3 different IP addresses, but the rest of the route doesn't change), then you can add a mask to this list to suppress route change notifications when this happens.

To do this, hit "Add IP Mask" and enter the first IP address.  Once it's in the list, select it, and then hit the next button down (Or with XX.XXX.XXX.XXX).  In the popup, enter the next IP address of the oscillating set.  Repeat this if there's a third one (or more).


New in Version 2.3

Version 2.3 has the following new features and bug fixes (since 2.20):

•	The timeline graphs now show packet loss percentages.  This adds information to time periods greater than a few hours (where it used to just show that there was at least one packet lost), and can help show trending quite a bit better.  If you prefer the old style graphs, hold down the shift key while right clicking on a timeline graph and enable "Old style timeline graphs".

•	Packet loss percentages can now be shown on the upper graph.

•	Added ability to turn on/off min/max lines on the upper graph.  This can help during long term monitoring where a single bad response could change the scale of the entire graph.

•	The lower timeline graphs can now be scrolled using ALT-LEFT, ALT-RIGHT, ALT-HOME, ALT-END, ALT-PGUP, ALT-PGDN.  These keys work when the upper graph is selected (because the lower graphs don’t actually accept focus).  Clicking on the lower graph will focus the upper graph.

•	Added an option to use high performance timers when tracing. This increases the accuracy when using Windows NT/2000 - where the best accuracy reported by ICMP.DLL is 10 ms.

•	Added ARIN Block IP lookups to see who owns an IP address.  This works even if the IP doesn’t resolve to a name.

•	All Open/Save dialogs have been updated to have the "Places" bar for Windows 2000/ME users.

•	Added automatic version checking.  Ping Plotter will now check to see if there’s an update available and let you know if there is.

•	Added support for multiple INI files.  This is useful when you automatically start multiple instances of Ping Plotter and want the output to be different between instances.

•	Added "zooming" logic so when you decrease the time shown in the timeline graph it tries to keep your selected time period in focus.  This can be useful to focus in on a period in the 48 hour graph, and then zoom down to the 30 minute (or similar) graph to see the period in more detail.

•	Changed the alert system to no longer use averages.  Averages were hard to understand in the context of lost packets, and in all cases we reviewed, the alternate method was superior.

•	Added ability to change the Subject line in alert e-mail messages.  $host can be included to show the final destination.

•	Exporting to text files was substantially improved.

•	Can ping only the final destination (rather than tracing all hops between you and the final destination).  While this turns off some of the core functionality of Ping Plotter, it can be handy if you’re using alerts, or only want to graph performance to the final destination and don’t want to use the extra bandwidth required to trace the intermediate hops

•	Registration codes are now validate against a server database.  See here for more details on this (this link is to the Ping Plotter web site).

•	Changing packet cargo options now take affect immediately.

•	Stability improvements (as always).  Several access violations fixed; a problem with save files was fixed; Improved alert reliability; minor graph overdraw no longer happens; PNG files now come out with better color; WhoIs processing cleaned up a bit; Minimizing to the tray works more reliably (including improved tray "click" behavior);

For changes from previous versions, see "New in version 2.2"


Popup_Packet_Loss_Scale
The red number on the right of the timeline graph is the scale of the packet loss numbers.  Depending on the number of samples included in the timeline graph, all timeouts may show 100%.  For more details, click here.


Popup_Timeline_Graph_Scale
The timeline graph scale shown on the left of the graph is controlled by the scale in Advanced Options, or, if this is set to automatic, this is the highest latency in the graph.  Please note that the latencies in the lower graph can be average latencies - when more than one sample is displayed in a pixel.  See the information about packet loss lines for more details.


Popup_Trace_Count
This shows how many samples Ping Plotter has collected.  Please note that some of this data may have been dropped from memory already, but this is the number of samples taken to this host in this session.

Ping Plotter can keep a substantial amount of data in memory.  See the option for "Maximum Samples to hold in memory" for more details on this.


Popup_Displayed_Samples
The upper graph may not be displaying information about all data that is collected.  In the example we see here, we're zoomed in on only 20 samples - and this shows exactly which samples this is.  To change the focus of what the upper graph is displaying, just double-click the period you want more information about on the lower graph.

Keep in mind that "Samples to include" is a big variable in this - if you have samples to include set to 0, then it can't zoom in any more because 0 means "all".


Popup_Alert_Email_Subject
The alert e-mail subject can be edited so that it is easy to recognize.  This is especially useful when e-mailing a phone, for example - so you can see what alert has fired without actually opening that alert e-mail.  Including the text "$host" anywhere in the subject line will show the destination host name when the e-mail is actually sent.


Popup_Min_Max_Line
Show the Min/Max Line.  Hide this line to keep the scale of the upper graph in better range.


Popup_Packet_Loss_Percentage
Show/Hide the packet loss percentage in the upper and lower graphs.


Popup_Prompt_For_Save_On_Close
If there are 75 or more unsaved samples in memory when Ping Plotter is closed, do you want to be reminded to save your data?


Internet Options

Click inside a circle [image] to get more details about a feature.


Popup_Whois_Standard_Lookup
The "Standard Lookups" address is the WHOIS server to query for named lookups.  The default value in 2.30 is whois.networksolutions.com.


Popup_Whois_ARIN_Lookup
The "IP Block Lookups" address is the WHOIS server to query for IP block lookups.  This will look up who owns a particular IP address.  The default for this is whois.arin.net.


Popup_Option_Auto_Check_For_Update
Select this option to have Ping Plotter occasionally check on the PingPlotter.com servers to see if there's a new version available.  If there is an update available, the main window status bar will show the update message.  Double-clicking on this status bar will launch your web browser to the site where the new version is available.


Popup_Options_Check_For_Update
Hit this button to have Ping Plotter check on the PingPlotter.com servers to see if a new update is available.  The results of this check will show in the main window status bar (no dialog box will appear).


Popup_Options_Proxy_Setup
If you access the internet through a proxy server, you can set up this server here.  In the current version of Ping Plotter, this is not required (ie: Ping Plotter doesn't have any features that require the ability to access the internet via HTTP), although automatic version checking doesn't work if Ping Plotter can't access the internet via HTTP.


Popup_Use_High_Performance_Timers
Ping Plotter uses the same mechanism that PING and TRACERT do.  Under Windows NT and 2000, this mechanism is only accurate to 10ms, so you'll usually see times of 150, 160 and 170 instead of 153, 164 and 172.  Turn on this option to use a different timing mechanism under NT and 2000.  Note that this works very poorly on 95/98/ME because of a change in thread priority that's necessary to get accurate times.  This isn't necessary on 95/98/ME either - as those operating systems report accurate times without this option.