Copyright: Copyright © 1998, 2004 by Nessoft, LLC
Citation: http:


Command Line Arguments

You can have Ping Plotter do a few things automatically on startup by specifying command line parameters.  You can put these parameters in a shortcut - or enter them from a DOS command line window.

PingPlotter [File to Load] [/TRACE:[Address To Trace]] [/SAVE]

Loading a file at startup

If you enter a parameter without a / on it, PingPlotter will try and find a file by this name - and load it if it's found.

Example:

pingplotter www.pingplotter.com.pp2

/TRACE

This option will start tracing automatically when PingPlotter loads.  If use the option to load a save file on startup, then tracing will begin to this address.  Otherwise, Add a colon (:) and the IP Address or server name you want to trace to.

Example:

pingplotter www.pingplotter.com.pp2 /TRACE

or

pingplotter /TRACE:www.pingplotter.com

/SAVE

This option can only be used when you specify a file name on the command line.  If you use /SAVE, then any new traces (to the original address specified in the save file only) will be saved to that file on shutdown automatically (without asking you if you want to save).

Example:

pingplotter www.pingplotter.com.pp2 /TRACE /SAVE

/SINGLEINSTANCE

If Ping Plotter is run with this parameter, then it checks to see if another copy of the program is running.  If it is running, then it exits.

Also, if you passed in an address to trace (via the /TRACE:address option above), then this address will be passed to the currently running version.  The currently running one will start tracing to that address.

Example:

pingplotter /SINGLEINSTANCE /TRACE:www.pingplotter.com

/INIFILE

You may want to start Ping Plotter with a different set of parameters and setups.  This is particularly useful if you're auto-starting Ping Plotter and having it trace automatically.  In this situation, you may want to have different trace intervals, or graph times, or whatever.  Starting Ping Plotter with an alternate INI file allows you to save multiple setups and use these different setups as needed.

Example:

pingplotter /INIFILE:alternatesetup.ini

/?

Show this help screen.

Example:

PingPlotter ?


Features

Ping Plotter is a utility for tracing IP packets through a network. It graphically illustrates the route that a request takes, and the IP address of each server along the route. Ping Plotter was born out of a need by its author, who needed to find out why his broadband Internet connection was so erratic. Sometimes it was really fast, other times it was slow to the the point of being unusable and he had to use a dial-up. What he needed was a good way to prove the performance (or lack of performance) of his connection to his Internet service provider.

Ping Plotter is a trace route program on steroids. It uses the multithreading capabilities of Windows to check performance on all hops in the route at the same time. This has several advantages: 1) It's a lot faster. 2) All hops are tested at the same time, instead of seconds apart, so the comparison is better.

Another thing you can do with Ping Plotter is set it to continuous trace mode - in which it will test the same route over and over again (forever if you want). That way you can watch the performance over a period of time, without having to rerun the trace over and over again.

The graphing capabilities are where Ping Plotter really shines. Being able to see where problems are visually is invaluable. As they say, a picture is worth a thousand words (or if you're used to using the command line tracert...a whole bunch of text).

As one satisfied customer wrote once, "HMOs should reimburse for prescribing Ping Plotter to Internet-intense patients as a prophylactic against ulcers".

Version 2.50 has quite a few essential features that the freeware version doesn’t.  Version 1.1 is still freeware (and available on the Ping Plotter web site, but will have only limited enhancement in the future.

Version 2.50 features:

•	Easy to use! Ping Plotter's basic mode means you just type in the address you want information about and hit "Trace". It starts tracing and shows you a graph. Someone with no network experience can see where their packets are being dropped and contact their ISP with this information.

•	Fun to use! (OK, maybe this is stretching it a little, but ...). When I first developed Ping Plotter, I spent hours just typing in addresses and checking out the routes packets take, performance bottlenecks, etc.

•	Graphs the response time through the route of the packet from source to destination. This really highlights problem hops and lets you concentrate on trouble areas.

•	Uses multiple threads to increase performance and accuracy. This means that Ping Plotter doesn't wait for hop 1 to respond before sending out a request to hop 2. A complete 1 sample trace can be done in about 5-10% of the time it takes to do a trace with the Windows "TRACERT" command (usually less than 1 second for Ping Plotter vs 15-45 seconds for TraceRT).

•	Graphs any host over time - lets you scroll back and forth over time, and zoom in on any specific time to find out where problems occur. You can even graph multiple hops at the same time.

•	Ping Plotter's graph can be resized, rescaled, zoomed, dragged and manipulated to give you exactly the information you need to find a problem. Helps you identify whether a connectivity problem is your ISP or network, the host you're connecting to or somewhere on the internet between you and the remote host. Ping Plotter will even help you identify which network (Digex, Cable & Wireless, Alternet, MCI, Sprint, etc.) is the source of your problem down to the specific node.

•	Use ICMP *or* UDP packets, depending on your needs.  Some ISPs are now blocking ICMP packets, but not UDP packets.  This will allow you to continue to use Ping Plotter even though most Ping and Traceroute tools do not work.

•	Creates nice images (via clipboard copy, or saving as .BMP, .PNG or .GIF files) that can be sent via e-mail. Face it, text dumps of a bunch of numbers aren't always the most compelling evidence. Put a picture on that data that shows where the problem lies and let your network provider argue with you then!

•	Schedule automatic saving of images (in BMP, PNG or GIF format), or saving of the underlying raw data. Use this to collect data over a long period automatically.

•	Keep track of route changes. No other product tracks route changes like Ping Plotter - giving you the ability to see what route your data was taking at any time in your tracing session.

•	Exports any portion of your collected data to a text file for analysis by other software packages (e.g. Microsoft Excel). If Ping Plotter doesn't graph it the way you want it, use your favorite graphing software and do it yourself!

•	Built for long-term monitoring. Ping Plotter works GREAT for overnight or even multiple-day monitoring projects. Set your interval and let it run. Check back later and review the history to find out trends and problem times. Does the speed degrade at 9PM and improve at 1AM? Ping Plotter will make that VERY clear and give you all the data to present to your ISP.

•	Will save your accumulated data for a host to a file and then allow you to reload and continue. Some users have reported running Ping Plotter continuously for months, accumulating over 1 million sample sets!

•	You can save and load sample sets - and then resume the trace. This way you can have multiple sessions of data in the same graph.

•	High performance, low overhead. There is no trace route package available that returns results faster. Ping Plotter is FAST and it uses very little CPU to do its job. That means you can run it continuously without interfering with your other tasks.

•	Alerts! Alerts will allow you to set parameters where you want to be notified of the condition. If the conditions fire an alert, you can log that data to a text file, play a wave file, or send yourself e-mail with the pertinent information included.

•	Built-in Whois. You can query the Internic servers by name, or the ARIN servers by IP address (to see who owns and runs a particular IP address).


Frequently Asked Questions

(There are a lot more questions and answers online in the Ping Plotter tutorial: http://www.pingplotter.com/tutorial.  The questions in this help file are mostly limited to basic functionality where you might be trying to troubleshoot why you can't reach the internet.)

Troubleshooting Questions

Why doesn't Ping Plotter work on my machine?  It gives me some kind of error message and doesn't work!

The first thing to do in this situation is to try the Windows "TraceRT" command from a DOS command line.  Ping Plotter uses Windows API calls to do its tracing - and TraceRT uses exactly the same API calls.  If TraceRT doesn't work, it's extremely unlikely that Ping Plotter will work.  If TraceRT DOES work, then so should Ping Plotter.

Why do all hosts show up as "Destination Unreachable" on the 2nd (or 1st or 3rd) hop?

Are you connecting to the Internet via a firewall or proxy server?  Sometimes these services block ICMP echo requests (which Ping Plotter and all Windows trace route software use).  Try using the Windows "TraceRT" command to see if it gives you similar results.  Often, you'll need to reconfigure your router / firewall to make things work.  At other times, it may be that your network connection is just unavailable, and you need to get things working.

I'm using a proxy server. Why can't I see anything beyond the proxy server with Ping Plotter?

Proxy servers, in general, do not work with PING/TRACERT requests. This means that Ping Plotter doesn't work with a proxy server at all. The only way you can really measure network performance on the other side of the proxy server is to run Ping Plotter on the proxy server (or a machine that's not behind the proxy).
On the other hand, NAT (network address translation) works great in most cases.  Internet Connection Sharing, most DSL/Cable routers, and a whole bunch of consumer and commercial grade hardware work great with Ping Plotter.  Proxy servers as the primary mechanism to share internet connectivity is on the decline, as NAT is just such a better solution these days.

Why does a trace to some sites always return "Destination Host Unreachable" (an example of a site that does this is www.microsoft.com)?  I can connect to these sites fine with Internet Explorer or Netscape!

One of the routers used between you and the destination site are not passing through ICMP echo requests.  This isn't TOO common, but does happen sometimes.  If you feel you really need to trace to these sites, contact them to find out what you can do about it.

When I set up an alert, it never seems to fire - although the "Test" button sends me an e-mail just fine.

See our alert troubleshooting section in this help file for more information.

Other Questions

How much difference should I see between hops on a good connection?  If hop 5 is returning in 200 ms, and hop 6 is consistently returning in 300 ms, is that good or bad?

A good router in itself should really add no latency to your trace.  Something that does have a huge impact on latency, however, is the speed of light over a distance.  Moving your packet across the country (if your country is very big!) is likely to add some latency.

It's important to realize that sometimes a hop will report high numbers - and the hop right after it will report low numbers.  In this case, that hop is probably not the problem (see the prior question for more details).  If the server at hop 6 is consistently adding 100ms - and hop 7 is showing this as well (i.e. hop 7 is 300+ as well), then it's likely that there's a problem at hop 6 or between hop 5 and hop 6.  I hope to add some additional information on this topic soon (with examples) - Check the Ping Plotter web page.  If you have some particularity good examples that you wouldn't mind me posting, send me some mail.

When I stop a trace for some reason, I'd like Ping Plotter to automatically reset the graph instead of just "Resuming".

If you'd rather completely reset a running (or paused) trace, just right click on the "Stop" (or Resume - if you've already stopped it) button and then select the "Reset and Restart" option.  This will clear the current graph completely before it restarts the trace.

The ping times don't always seem to add up logically to me. For example, I commonly see the avg time for a single hop being longer than the total return trip number. This doesn't make sense to me. Can you explain this to me?

It appears that some routers just don't prioritize timed out ICMP requests very high (ICMP requests where the TTL equals 0 after reaching them). This often means that a specific site will take a lot longer to respond back to you than it does to send the packet on to the next host. If the hop right after consistently performs well, you can often just not use this hop in your troubleshooting equation. On the other hand, if you start dropping a lot of packets at this hop (that show up in later hops as well), this may indicate that the router is overloaded (i.e. - doesn't have enough processor time to do all it's tasks).


Introduction

Ping Plotter was inspired by the need to find out why its author’s internet connection was so erratic.  Sometimes it was really fast, other times terribly slow.  We wanted a way to find out (easily) where the problem was and then be able to use the information gathered to send to the person that could fix the problem (ie: ISP, etc.).

Basically, Ping Plotter is a trace route program - but adds some graphs, long term monitoring, plus some serious performance upgrades.

Graphs

The "old" way of troubleshooting internet problems is to look at a pile of data using the "traceroute" or "tracert" tools.  While this gave information that you can use, it was hard to read.  You really had to look over the data to determine where the problem was.

Ping Plotter takes all this great data that the trace route tools delivered, and puts it in a visual form that can really help you see where the problems lie.  The pieces of information shown on the graph are focused specifically to help you determine where the problems lie.  A quick look at a graph can help pinpoint a problem that would be really hard to find in text.

Long term monitoring

Ping Plotter can be run continuously, and collects the data it generates.  This data can then be graphed long-term (see the graph at the bottom of this page for an example of where 2 days worth of data can really show a problem), and massaged, twisted and graphed post-fact to help communicate the problem areas to those who can help correct the problem.  This was the goal of Ping Plotter when written - help communicate the problem to the people that can help solve it.  There are now many ISPs across the country that know how to read a Ping Plotter graph - because it makes their job much easier.

Multi-threading

Ping Plotter is fast.  Ping Plotter does many of its tasks in parallel - which allows it to deliver immediate results in less than a second in most cases.  There is no utility that can deliver the same data that Ping Plotter does any faster (and there are no utilities in its price range that allow you to graph data like Ping Plotter does).

Here's an example of a graph taken in fall of 2000 (we've since changed providers, and our source for data like this is no longer available.  Our current provider is rock-solid and the graphs are just not interesting any more).

Notice the jump in latency (from 94 avg to 203 avg) between hop 7 and hop 8 there?  Notice the big packet loss added at hop 9 (25 %!)?  Notice the "trending" in the lower graph - where performance and packet loss is pretty good in the morning hours (2am), but then deteriorates under load (afternoon/evening)?  All 3 of these point to a problem between rr.com (Roadrunner) and Alter.net.  Without the graph, this analysis would be hard to do, but with Ping Plotter, it's quite evident.


Introduction to trace route

At its heart, Ping Plotter is a trace route utility.  It's souped up and on steroids, but the basic concept is the same as any other trace route utility.

A ping packet is an IP packet requesting that a copy of its contents be echoed back to the sender. When you "ping" a site, you send over an echo request and that site responds back that it received it. The amount of time it takes for the packet to get to that site, and then return to you, is the ping time, or latency. In general, the lower this is, the better your connection to the site. This time is usually specified in milliseconds (1/1000 of a second).

One of the parameters on a ping packet (and any packet, but we're only talking about ping here) is something called "Time to live" (TTL).  TTL is an IP header field designed to keep packets from running in loops, essentially forever, throughout a network (this can happen when there is a route change, and the routers involved don't all know the same information as new information is being replicated out). Initially it's usually set to somewhere between 64 and 255, and is reduced by 1 every time it passes through a server.

If the TTL should ever reach zero, the packet has expired, and the router that it's passing through will send it back to the source.  Again, this happens so that packets don't get caught in an endless loop.

Traceroute plays with this TTL number on outgoing packets. It first sends out a packet with a TTL of 1. The first router that sees this decrements it to 0, and then sends it back. It also sends back its own IP address with the packet, and DNS is used to do a lookup for an actual domain name.

Ok, so next, traceroute sends out a packet with a TTL of 2 so it can find out what the next computer in the route is. Then it sends out a packet with a TTL of 3. This process is repeated until the final destination is reached. At that point, you know the entire path the packet has traversed to reach the destination computer/router. Each server in this chain is called a hop.

This method can help us determine the route a packet takes, but if we time each of these packets, we know how long it takes for a packet to make it from our source PC, to that router, and then back again.  This is called Latency.

The last hop in a (successful) trace route is actually the round-trip time to the destination server. This is an important concept to understand. You don't add up all the times between you and the destination host - as that time has already been added. The time to the last hop in the chain is exactly the same as is if you'd used a ping utility to that host. So a trace route utility is actually two utilities - ping AND trace route.

Ping Plotter speeds up this process by sending out packets to the first 35 servers in the route all at the same time.  This makes a HUGE difference in overall speed.  It also means that the network conditions for each hop are very similar - so the numbers are better compared.


Operation

Click inside a circle [image] to get more details about a feature.


Options

Click inside a circle [image] to get more details about a feature.


Auto-Save Options

Click inside a circle [image] to get more details about a feature.


Packet Options

Click inside a circle [image] to get more details about a feature.


Route Change Options

Click inside a circle [image] to get more details about a feature.


Purchasing

Please note that the most current ordering information can be found at: http://www.pingplotter.com/order.html

Ping Plotter is developed under the "trialware" (or shareware) concept. You're probably familiar with this, but in essence you can try out the software for a limited time (30 days) after which you need to pay for it.

Ping Plotter is a solid value at any price point, let alone the extremely low price we ask for it (see http://www.pingplotter.com/order.html for multi-copy discounts or site licenses).

You'll get the following advantages when you buy Ping Plotter:

•	You don’t have to deal with the annoying reminders.

•	We prioritize your support requests.

•	You get free upgrades to future upgrades of Version 2.

•	You'll be able to run any beta version that becomes available.

•	You and your relatives will all become rich and famous.  (This has yet to be proven conclusively).

If you don't think the full blown version of Ping Plotter is worth the money, Version 1.1 of Ping Plotter is freeware  and you can use it without buying it. You won't get any of the great features of Version 2.x though.

The easiest way to buy Ping Plotter is to go to the Ping Plotter order page (http://www.pingplotter.com/orders.html), and use your credit card. You'll get a license key immediately, and you won't have to wait for your order to be processed by hand (as other methods require).

You can also purchase by check or money order by following these steps:

•	Check http://www.pingplotter.com/order.html to get a printable order form.  This order form will have the latest address, ordering prices and information.

When mailing a check, please make it out to "Nessoft, LLC ".

•	Make sure you include your e-mail address on the check (this is required or we don’t know where to send the license key!).

•	Mail your check to:
Nessoft, LLC
967 E. Parkcenter Blvd. #273
Boise, ID 83706-6700
USA

When your check is received, you'll be sent an e-mail with your license key. Make sure you provide an e-mail address when sending a check.

These directions are all repeated on the http://www.pingplotter.com home page (and may have been updated since this file was made), so please check there before you order.

Thank you!


Reporting

Ping Plotter doesn't have any built-in printing options.  What it WILL do for you though is copy its data to the clipboard or text file and let you manipulate it in your favorite software package from there.

There are several ways to output your data.

1	The graph.  There are a few ways to get a picture as shown in the graph.  A quick way to do this is to select the Edit/Copy as Image option from the main menu to copy the graph and the legend to the clipboard.  The column and graph sizing will match what's on the screen, so make sure everything you want printed is displayed.  You can paste this into MS Paint or any other graphics application to print or save.  You can also go to the file menu and "Save as Image" in PNG, BMP or GIF format.  You can have Ping Plotter automatically create these images for you as well, by scheduling it in the Advanced Options menu.

2	Raw data - in TraceRT format.  Select the Edit/Copy as Text option to copy the raw data to the clipboard.  This is copied in a format that's similar to most text-based Trace route programs.  The difference here is that the "Samples to Include" option on the main screen is used to decide how many samples to include in this.  If you're sending a graph to someone trying to show them there's a problem in the network someplace, it's probably a good idea to include this data too.  Just paste this into your e-mail program or whatever.  For best results, use a fixed pitch font (Courier New) like you see here.

Note: If you have "Samples to Include" set to 10 or higher, this menu option will show "Copy as Summary Text" instead of "Copy as Text".  Holding down the shift key when you click on the "Edit" menu option will switch between the modes.

Target Name: pingplotter.com
         IP: 216.92.151.75
  Date/Time: 2/2/2003 7:24:27 PM

 1   46 ms   45 ms   47 ms   48 ms   48 ms  bigi2-f0-0.lan.spro.net [204.228.224.231]
 2   77 ms   77 ms   78 ms   80 ms   78 ms  boi-edge-02.inet.qwest.net [65.121.130.33]
 3   78 ms   77 ms   76 ms   80 ms   77 ms  boi-core-02.tamerica.net [205.171.155.5]
 4   78 ms   77 ms   78 ms   78 ms   85 ms  sea-core-03.tamerica.net [205.171.208.5]
 5   81 ms   79 ms   80 ms   94 ms   78 ms  [12.124.173.61]
 6  115 ms  115 ms  114 ms  113 ms  116 ms  tbr2-p012402.cgcil.ip.att.net [12.122.10.61]
 7   *      113 ms  114 ms  117 ms  113 ms  tbr1-p012501.cgcil.ip.att.net [12.122.9.133]
 8  127 ms  127 ms  128 ms  128 ms  127 ms  gar1-p360.phlpa.ip.att.net [12.123.137.21]
17  138 ms  138 ms  138 ms  140 ms  139 ms  [12.118.191.18]
18  138 ms  138 ms  143 ms  138 ms  138 ms  pingplotter.com [216.92.151.75]

Ping statistics for pingplotter.com
Packets: Sent = 5, Received = 5, Lost = 0 (0.0%)
Round Trip Times: Minimum = 138ms, Maximum = 143ms, Average = 139ms

3	Comma delimited text file.  This is especially built to import into a program like Microsoft Excel - so you can manipulate the numbers around and create output in different formats.
To export to a comma delimited text file, go to the File menu and select "Export to Text File".  From there, you can specify the file you want to export to and a couple of other options.  You can either export all samples in memory - or the range as specified on the main screen.
The option on this screen "Include sample times in export file" will specify whether or not to include the time each sample was taken at.  If you don't have this turned on, all the samples will be output, but you won't get corresponding times.  Turn this option on to include the times.


Support

Ping Plotter is supported under the model that most inexpensive software is: via e-mail. If you've licensed Ping Plotter, you're much more likely to have your feature requests incorporated into the new version.  We also go to extra efforts to help you interpret the data collected about the situation so can you figure out what's wrong with your internet connection based on the information provided by Ping Plotter.  That doesn't mean that unregistered users don't get support, you're just more likely to have time spent on you if you've paid a little money :).

Your first step in solving your problem should be to visit the support site on the Ping Plotter web site (http://www.pingplotter.com/support.html).  That site can be kept much more current than this static help file on your hard drive.  This site has links to our FAQ, Tutorial, Support forums, and other useful information.

If that doesn't help you, you're welcome to send an e-mail.  Also, if you have a feature request, send mail here.

Internet e-mail:

support@pingplotter.com

CompuServe

(this is a backup email, and is not a primary contact mechanism for us, so please use in case of emergency only – and don't expect an immediate response):

102347.710@compuserve.com

If you've had a good experience with Ping Plotter, send an e-mail on that too!  It's great to hear success stories!


Timeline Graphing

The timeline graph feature of Ping Plotter is specifically built for long-term monitoring projects.

Often, your ISP problems occur when you're not watching it.  The timeline graph feature of Ping Plotter allows you to trace over a long period of time - and then look back over this history to find when and where the problem occurs.

By default, Ping Plotter will automatically trace the last hop (the host you're tracing to) on a time-line graph.  You also trace any of the other hops by right clicking on that hop in the trace graph and then selecting "Show this Timeline Graph".  You can also turn off any graph by this same mechanism.

Once tracing, Ping Plotter will record each sample on the time-line graph.  The amount of data displayed on the graph can be changed by right-clicking on the timeline graph - then selecting the amount of time you want displayed.  This scale affects ALL timeline graphs and is saved when you shut down Ping Plotter.

If there is more data collected than you can show on the timeline graph with your selected scale, click on the graph and while holding down your mouse button, drag the graph.  This will allow you to move back in history and examine the samples.  You can also use the keyboard to scroll.  To scroll with the keyboard, select the timeline graph and use one of the following keys:

ALT-HOME	scroll to the beginning of the collected data
ALT-END	scroll to the end of the collected data
ALT-LEFT	scroll back in time (about 5% of the graph width)
ALT-RIGHT	scroll forward in time
ALT-PGUP	scroll back in time (about ½ of the graph width)
ALT-PGDN	scroll forward in time
If you find a time period that looks "interesting", you can double click on the timeline graph at that point.  The upper graph (the trace graph) will move to that time period.  This allows you to troubleshoot where the connection problem may have occurred.  Keep in mind that the upper graph always focuses in on the number of samples in "Samples to include".  If you have that set to ALL, then the upper graph can't zoom in on any piece of the graph.

It may be that you see a problem period in the 48 hour graph.  Double-click on that period, and the upper graph will focus on that period.  You can then change your timeline graph scale and the lower graphs will try to stay focused on the time period you selected.  This makes it easy to see details about a specific period.

When you're done zooming the graph, right-click on it and select "Reset focus to current".  This will return both graphs (the timeline and the trace graph) to the current time.

Because Ping Plotter takes so little CPU time when running, you can set it up to trace while you're doing something else.  One particularly interesting way to use it is to set it tracing to a site that is hosting a game you're playing, or server you're using (streaming stock quotes, for example).  If you notice your response slowing down, you can check out Ping Plotter and use it to quickly troubleshoot where the problem is coming from.


Internet Options

Click inside a circle [image]  to get more details about a feature.


Email Setup

The email setup dialog is used to set up emailing for alerts.  If you're not using alerts, or you're not interested in having the alert system email you, then setting this up is not required.

Return Address

All outgoing emails will have a return address specified, and this is the address that is used.  Please make sure you specify a valid address here since this is where all the bounce messages will come from.  Some ISP SMTP servers only allow emails sent out with a "from" address of their domain as well, so if you're having problems getting the SMTP server to work, make sure you're using a valid return address.

Attach Ping Plotter Savefile (.pp2) on Email Alert

When an alert goes out, data will be attached.  The data that is attached encompasses all the alert period since the *last* similar alert was sent out.  This is a global setting for all email alerts.  Note that you'll need Ping Plotter installed on a machine to read the attached data.

Include "alert" samples in text message

If this option is checked, any outgoing alert emails will include text showing the samples that failed the alert.  As each alert email goes out, the past history is marked as being sent already so that you won't get duplicate data in reoccurring emails.

SMTP Server

The SMTP server is the server that your outgoing mails will go through.  This may have been given to you by your ISP or your mail administrator.

Server Port

The default port for most SMTP servers is 25.  If you connect to your SMTP server via a different port, then enter that port here.  Leaving this blank will use port 25.

SMTP Authentication

Some SMTP servers require a username and password to be able to deliver mail.  If this is the case with your server, turn on the "Use SMTP Authentication" checkbox, and then enter your username and password.  The password is saved in your MultiPing.ini file using a basic XOR encryption scheme – this will keep your password hidden, but this encryption method is relatively simple to "crack" if someone really wants to figure it out.


Troubleshooting Alerts

If alerts aren't working, there are a number of things you can do to troubleshoot.  Here are some suggestions - and feel free to check out our support pages for more information.

Make sure you're "Watching" a host with the alert.

By far, the most common reason that an alert isn't working is because it isn't tied to an IP address.  An alert won't just start working automatically – you need to tell it which host(s) you want that alert to watch.

To attach an alert to an IP, trace to the host you're interested in. Then, right-click on the hop you want to monitor and select "Watch this host (Alerts)…" from the menu.   Note: In previous versions of Ping Plotter, this was called "Monitoring".

Note that if you're tracing to a destination that doesn't respond, and you want to watch that destination (even though it's not on the upper graph), just right-click on the time-graph on the bottom and this same menu item should be on that menu.

From here, you can move an alert from the "Available" to the "Selected" list.  Any alerts on the "Selected" list will watch this host whenever this host is involved in any route (be it an intermediate host, or the final destination).

When a host is being watched by the alert system, there will be brackets around the hop number in the upper graph.  If those brackets aren't showing, then that host isn't being watched. This should put a [...] around the hop that's being monitored.

Set up an alert that will fire instantly, with an event that is very evident.

If you have an alert set up – and tied to a host (see above), but it seems like the alert isn't working, then changing your alert parameters (or create a new "test" alert).

Set up "Traces to Examine:" to 10.  Alert when "1" or more traces are over 1ms.

Unless your network is responding in 1ms or less, this alert will fire on the first collected sample with the alert enabled.

For an event type, use "Play a sound", or "Tray icon change/notification" as both of these events happen immediately with no wait.  In addition, for the "Play a sound", use "each time alert conditions are met (repeating)", as this will continuously make sound, rather than just when conditions start / stop.

Using this sequence, you should be able to tie an alert to just about any host and have the alert conditions fire immediately.  Now, add on another event type (ie: email).

You can leave multiple events tied to a single alert – that way you can continue to hear the sound while you're troubleshooting another event type.


Event - Play a Sound

One of the most simple event types is to play a sound (i.e.: .wav file) of some kind.

This event can happen based on the standard notification rules, and can play anything that Windows multimedia sound function wants to play.  If you want to launch a sound file that this event type doesn't support, use the "Launch an executable" option instead, as it will launch any file, including sound files.

Click the folder on the right side of the file name to browse for a file.  When browsing for files, you can right-click on any sound file to play it (this is an operating system feature, and may not be supported on all operating systems).

Enter "BEEP" (no quotes) here if you just want to beep the computer speaker instead of playing through the sound card.


Event - Notification

Many of the events share a notification mechanism.  Here is a list of the types.  Note that any alert can have multiple events of the same type, so you can set up a single alert to do something at any one or all of these times.

Each time alert conditions are met (repeating)

The event will happen every time conditions are met.  This means the event will happen over and over again – on each sample that causes the alert to fire.  In previous versions, this was the only supported notification type.

When alert conditions start (enters alert state)

The first time alert conditions occur, the event will happen.  As long as the conditions continue, though, the event won't be repeated.  This is a popular use – as you find out about new conditions when they happen, but don't have to be bothered again.  As soon as the alert stops happening, then as soon as it starts again, this event will happen again.

When alert conditions end (leaves alert state)

This happens when network conditions improve so that the alert is no longer firing.  As soon as the conditions move from bad to good (based on your settings), then this event will happen.  A use of this is to have Ping Plotter email you each time conditions go bad (see above), and then when they improve again – but not to tell you anything in between.

Each time alert conditions are *not* met

This is the exact opposite of the first notification type above.  As long as things are good on the network, this event will fire each time a sample is collected.


Event - Send Email

A very popular event type is the "Send Email" event.

Before you can create an event to send an email, you must configure your SMTP server and return email address.  Note that your SMTP server must be accessible on the network to be able to send emails, so it's possible a network failure may not be able to email you.  Ping Plotter will continue to try to send emails once a minute until it is able to get an email out.

Emails are a bit more complicated to set up than most Event types – as it is dependant on your SMTP server, and you don't want to be overwhelmed with emails when conditions are bad, but you *do* want to know what's going on.

First off, you can fire emails based on the standard Ping Plotter notification types.  See the associated documentation for more details.

Send e-mail to:

This can be an individual email address, or a list of addresses separated by either a , or a ; (both work equally well).  Please do not set this up to be someone at your ISP unless they have agreed that they want to see this information.  A huge portion of getting problems solved is playing the game right, and overwhelming people with automated emails is almost certainly going to work against you.

Email Subject:

This defaults to "Ping Plotter Auto-Alert!", but can be customized with a variety of variables / text.  The following list of variables applies:

$host	The monitored host – i.e.: the target that failed.
$year	Current 4 digit year (i.e.: 2003)
$month	Current 2 digit month (i.e.: 03)
$day	Current 2 digit day (i.e.: 08)
$date	Date, 4-2-2 format (i.e.: 2003-03-08) for March 8th.
$hour	24 hour format, (i.e.: 06)
$minute	2 digit minute (i.e.: 02)
For emails, the $host makes a huge amount of sense (i.e.: $host is down!), while the time/date aren't as useful because the email contains data about this in most cases.

Maximum email frequency and minutes to wait

The next two settings control the frequency at which you'll get e-mails during alert conditions. The first (Maximum e-mail frequency) is pretty self-explanatory - you'll only get e-mails that often.

The second (How long to wait for worse conditions) specifies how long Ping Plotter will wait after its first alert condition to send an e-mail. This option allows you to wait a few minutes to find out if it was a temporary or more permanent alert condition. You may not want one immediately - because you'll want to wait a bit more info to be included - so you may want to wait 5 minutes or so before that first e-mail gets sent off.

Testing and error messages

Once you have your e-mail set up, use the "test" button to see what the message will look like (and also to make sure all the settings are working).  Any errors should be displayed here.

Many of the errors that occur during testing can be attributed to incorrect email setup – so go there and validate your settings.  An 11004 Winsock error usually happens because of an invalid SMTP server, for example.


Event - Launch an executable

New to Ping Plotter 2.40 is the capability to launch any executable (file, really) on alert.  This gives all kinds of capabilities to do cool things when network conditions go south.

While this option is called "Launch an executable", it can actually launch any file.  It can launch documents, links, .mp3s, batch files, whatever – really anything with a file association that Windows will know what to do with.

Of course, you have the option of when you want to launch the executable.  See the associated documentation for more details.

The following variables can be used.  Note that these are always parsed – and there is no way to cause these to be passed as literals.  If you need to have one of these strings as literals passed to an executable, then you'll need to set up an intermediate link, batch file, or similar.

$host	The monitored host – i.e.: the target that failed.
$dest	The destination for Ping Plotter.  This may or may not be the same as $host – it will match if you're monitoring the final destination, but won't match for intermediate hops.
$year	Current 4 digit year (i.e.: 2003)
$month	Current 2 digit month (i.e.: 03)
$day	Current 2 digit day (i.e.: 08)
$date	Date, 4-2-2 format (i.e.: 2003-03-08) for March 8th.
$hour	24 hour format, (i.e.: 06)
$minute	2 digit minute, (i.e.: 02)
The launching program isn't closed – it's just launched.  You'll need to configure your setup to close whatever you need here.


Event - Log to file

The "Log to file" alert writes data to a text file whenever alert conditions are met.

Log times for entire route?

This option specifies if you want to write data to the text file just for the monitored host, or the entire route.  Leaving this off means that for each time alert conditions are met, one data item will be written to the file – for the monitored host.  If the switch is turned on, then data for the entire route will be written.

Filename:

The filename is *required* to have the $host variable in it.  If it is missing, then the file will be nonsensical if you attach this alert to more than one host.  The following variables can be used as part of the filename.  Note there is no way to "escape" the following sequences, so these are always parsed and can't be specified as literals in the filename.

$host	The monitored host – i.e.: the target that failed.
$dest	The destination for Ping Plotter.  This may or may not be the same as $host – it will match if you're monitoring the final destination, but won't match for intermediate hops.
$year	Current 4 digit year (i.e.: 2003)
$month	Current 2 digit month (i.e.: 03)
$day	Current 2 digit day (i.e.: 08)
$date	Date, 4-2-2 format (i.e.: 2003-03-08) for March 8th.
$hour	24 hour format, (i.e.: 06)
$minute	2 digit minute, (i.e.: 02)
Note that one directory level of depth will be created automatically if it doesn't already exist, so you can specify c:\ppdata\$host\filename.txt and the $host directory will be created as needed.  Only one directory of depth will be created, however, so if the c:\ppdata directory didn't already exist, an error would occur.


Event - Tray Icon Change

This is a great event to add to most of your alerts.  It's great to be able to see if there's an alert condition under way, and a quick glance at the tray can let you know by using the event.

The Tray Icon Change notification will do one or both of the following:

Change default icon to red during alert conditions

If you already have Ping Plotter showing in the tray, this will change the existing green icon and add red to indicate that an alert has fired.  If you don't have Ping Plotter in the tray already, then a red icon will be added to the tray.  When the alert condition(s) are over, the icon will change back to green.

Popup message in tray

This shows a "balloon" message coming out of the tray.  Not all versions of Windows support this message (ie: some versions of Windows 95), in which case no balloon will show.  Only one balloon can be shown at a time, so the newest balloon always wins (a new balloon message will replace an older one).

The following commands can be used in your message text:

$host	The monitored host – i.e.: the target that failed.
$year	Current 4 digit year (i.e.: 2003)
$month	Current 2 digit month (i.e.: 03)
$day	Current 2 digit day (i.e.: 08)
$date	Date, 4-2-2 format (i.e.: 2003-03-08) for March 8th.
$hour	24 hour format, (i.e.: 06)
$minute	2 digit minute, (i.e.: 02)

One of our favorite messages is:  Alert on $host, $date $time.

This is a great message because it stays up until you acknowledge it, so when you come back to a PC, you can see what alert fired, what host it happened on, and what time it *last* happened.  This may be over a weekend, but the message will still be there telling you that an alert happened.


Time Graph Annotation

When using Ping Plotter to monitor long-term connectivity/latency, you sometimes run across a situation where your network was affected by something you know about (power outage, reboot of router, big file download, etc.). These incidents show up in Ping Plotter. Also, you may run into a situation that you don't control - but you know what's causing it. You want to take notes about this kind of thing and tie it to your data.

Ping Plotter now allows you to make notes on your time graph. These notes show up on the graph as triangles, and when you float over them, the notes appear. When you save data as an image from Ping Plotter, these notes get attached to the image, along with the times they happened. This is especially valuable when you want to send an image to a network provider and there are events on the data you're sending them that need to be explained. You can mark these on the time graph and when you create the image, the notes will be included.

To create a note, just right-click the lower time-graph at the point you want to create a note and select "Create Comment" from the popup menu. Ping Plotter will prompt you for the note, and then draw a red triangle on the lower edge of the time graph. You can float your mouse over this triangle to see the note, or you can right-click on the triangle to edit or delete it.


New in version 2.50
New in version 2.51

Changes in Version 2.51  (since 2.50)

New Features

•	Allow configuration of SMTP server port, in addition to validated username / password logins to the SMTP server for sending alert emails.

•	Targets that are associated with an alert are now listed on the alert configuration screen.

•	Multi-selecting routes in the route-change window now highlights the hops that have changed in the upper graph area. This makes it a lot easier to find which hops are oscillating so a route change mask can be added.

•	All errors now use an error dialog with a "Details" option, which shows more details (primarily, the stack trace) about an error that can be emailed to support. Additionally, the support email address and support page URL are listed.

Bugs Fixed

•	Test sending an alert email would leave a thread attempting to redeliver that email if the initial test failed.

•	List Index Out of Bounds error could happen during "aggressive" route changes.

•	Access Violations could sometimes occur if right-clicking a hop just when a route change made that hop obsolete.

•	Route discovery logic was too aggressive when high packet loss was on the final destination. Route would lengthen on some occasions and show lower packet loss than it should.

•	Route wouldn't "shorten" once it was lengthened due to a poorly responding final destination. This could leave one or more blank hops before the final destination, and the final destination would never recover these hops.

•	Errors were not being logged to the PingPlotter.rip file correctly, making bugs much harder to track down.

•	Automatically generated filenames (alerts, auto-save names) didn't allow non US characters.

•	$host and $dest in alerts would always used the same name, even if the alert wasn't targeted at the final destination.

•	Some .pp2 save files would not be reloadable if the save file had more hops than the current configuration allowed.

•	Resuming PingPlotter when data was sent from MultiPing didn't always correctly trace the full route - very specific instances only (it's unlikely that anyone was significantly impacted by this).

•	Log to file alert always wrote the current time rather than the actual sample time.

Other Changes

•	Changed the way alerts are associated with targets when saved and reloaded. This means you'll need to re associate your alerts to the targets they should be watching. The alerts configuration is all saved, you'll just need to re-tell PingPlotter which targets you want to watch.

•	Some shared engine code changes made in MultiPing was merged back in to PingPlotter.

•	Minor "tweaks" to better accommodate users running large fonts (primarily in the options dialog).

For changes from previous versions, see the Ping Plotter web site's history page.


Alert Setup

What is an alert?

Alerts basically monitor the conditions of a specific IP address, and then do something when those conditions exceed a specific range. The things you can do with an alert are:

·	Send an email

·	Play a .WAV file

·	Log to a text file

·	Change the tray icon / show a message

·	Launch an executable

So let's say you have a machine that you want to know when it stops responding. You can attach an alert to that IP address that sends you an e-mail alert if the last 10 of 10 sample requests are lost.

Another possible alert condition to check for is if the average for the last 10 samples is > 500 (or any other number). You can send an email alert, maybe play a .WAV file (if you're usually within hearing distance) or both. Also, if you're trying to show your ISP there's a problem, you might log the data to a file so you have records of every time it happened over a time period.

One Ping Plotter user had hardware problems with his cable modem, and he launched an executable that communicated with a device attached to his computer to reboot the cable modem if certain conditions happened.  There are a whole variety of things you can do with alerts and events.

Alert setup can at first seem confusing. Basically it involves three steps 1) Setting the Alert Name, 2) Setting up the Condition that will trigger the alert and 3) the Events, or what you want Ping Plotter to do when your alerts are triggered.

What is an event?

Events go hand in hand with alerts (the concept of "Events" is new to Ping Plotter 2.40).  Any number of events can be created with an alert – so that when some conditions occur, something happens.  The "Alert" part specifies the conditions and serves as a container for the events.  The "Events" specify what action(s) will happen.  You can have any number of events tied to an alert, and any number of alerts tied to a host.  Note: You must have an alert tied to an IP address before it will work.  Keep reading for more details.

Setting up an alert.

So, let's set up the alert to play a sound when packet loss goes about 40%.  Packet loss is a big bad thing, and in many cases is more important than latency.  We run a similar alert at Ping Plotter HQ pretty much continuously.

Run Ping Plotter and go to the "Edit/Alert Setup" menu. If you've never set up an alert, you won't have any listed here. Hit the "New" button (near the bottom left). Enter a name for the alert (We’re using "Server is Down") in the "Alert Name" section. In traces to examine, use "10".  Set it to alert when 4 or more samples are over 9999.  (Note: 9999 is not a magic number.  A lost packet is always greater than any number entered, so you can use 1000, or 20000 here and a dropped packet will exceed either of those numbers).  That setting will alert when 40% packet loss is achieved.  The 40% comes from saying to alert if 4 of the last 10 samples were dropped.  You might want to do 40 of 100, or 2 of 5 – it depends on the period of time you want it to look at.  You probably *don't* want to notify if only one sample is lost, but maybe 2 in a row (which would be examining 2, and alerting if 2 or more traces over 9999).  Lots of things you can do here.

Picking an event

Next, select what you want to happen when the alert fires. We're going to "Play a sound" (This is in the Event 1 area).  Notice that as soon as you change the "Event type" to "Play a sound", that "Event 2" will appear, with "(.. no additional notification ..)".  You can have as many events as you like – and to delete an event, just change it's type to "(.. no additional notification ..)".

As soon as you pick an event type, a set of options relating to that event type will come up.  The "Notify" dropdown is described in more detail elsewhere.  For more details on how to set up a sound event, click here.

Tying an alert to an IP.

Once you've got your alert set up, you need to tell it which IPs to "watch" for those conditions. To do this, trace to a destination just like you normally would. Once the path has listed, pick the router/destination from the list you want to monitor - and right-click on the hop number. From the popup, select "Watch this host (Alerts)...".  If you want to monitor a destination that isn't responding for some reason, just right-click on the lower time-graph for that host, and you'll have a similar popup menu.

You'll get a dialog that shows the DNS name (if there is one) and the IP address you selected - and then a list of available and selected alerts. Move the alerts you want applied to this IP address into the "Selected" list - and then close the dialog. Monitoring will start immediately.When a hop is being monitored for an alert, the hop number will have brackets around it (i.e.: [9]). You can stop monitoring by right clicking on the hop number and selecting "Watch this host (Alerts)..." and then removing any alerts from the selected list.

A note about "average" response times.

Before version 2.30, Ping Plotter used to support alerting on average response times.  The real problem with averages is when a server stops responding - what is the average of the last 10 samples if the last 10 were timeouts?  Because of the problem with this, version 2.30 changed the alerts so you always have to do "when X or more samples is > Y".  You can still get your alert to work like an average - by saying "when 5 or 10 samples exceeds 300 ms" (this would be like an average over 300ms, but would also fire when there were lost packets).


Packet Type
There are three separate (but somewhat similar) packet types that Ping Plotter can use.

•	ICMP using Windows DLL.  The default method is the standard Windows ICMP.DLL.  This is reliable with the least CPU usage (on most operating systems).  This method will automatically do manual timings on less-than-accurate operating systems to attempt to get accuracy to 1ms.  This method does not require administrative rights, and should be the first choice for most users.

•	ICMP using Raw Sockets (advanced use only).  In some rare cases, the standard Windows method doesn't work.  Ping Plotter can compose its own ICMP packets – although in most cases this is no more reliable or better than ICMP.DLL.  This requires administrative rights on Windows NT, 2000, XP and 2003.

•	UDP Packets (Unix-Style).  This method will sometimes allow you to trace to a destination that isn’t reachable via ICMP, or might allow you to reach the internet even if your ISP is blocking ICMP echo requests.  Though not the cure-all for "Destination Unreachable" issues, this is worth a try, especially if you’re getting erratic packet loss or unreachable destination.  This requires administrative rights on Windows NT, 2000, XP and 2003.


Popup_Options_Proxy_Setup
If you access the internet through a proxy server, you can set up this server here.  In the current version of Ping Plotter, this is not required (ie: Ping Plotter doesn't have any features that require the ability to access the internet via HTTP), although automatic version checking doesn't work if Ping Plotter can't access the internet via HTTP.


Popup_Whois_Standard_Lookup
The "Standard Lookups" address is the WHOIS server to query for named lookups.  The default value in 2.40 is whois.crsnic.net.  This whois server is a central area which doesn't actually give whois information directly, instead it tells us which domain registrar handles the selected domain.  Ping Plotter then uses this information to go to the registrar and do a whois lookup again.  Note that whois.networksolutions.com is another whois server that works – and will tell which registrar is responsible for a domain in most cases.


Popup_Whois_ARIN_Lookup
The "IP Block Lookups" address is the WHOIS server to query for IP block lookups.  This will look up who owns a particular IP address.  The default for this is whois.arin.net.


Popup_Option_Auto_Check_For_Update
Select this option to have Ping Plotter occasionally check on the PingPlotter.com servers to see if there's a new version available.  If there is an update available, the main window status bar will show the update message.  Double-clicking on this status bar will launch your web browser to the site where the new version is available.


Popup_Options_Check_For_Update
Hit this button to have Ping Plotter check on the PingPlotter.com servers to see if a new update is available.  The results of this check will show in the main window status bar (no dialog box will appear).


Popup_Packet_Loss_Scale
The red number on the right of the timeline graph is the scale of the packet loss numbers.  Depending on the number of samples included in the timeline graph, all timeouts may show 100%.  For more details, click here.


Popup_Timeline_Graph_Scale
The timeline graph scale shown on the left of the graph is controlled by the scale in Advanced Options, or, if this is set to automatic, this is the highest latency in the graph.  Please note that the latencies in the lower graph can be average latencies - when more than one sample is displayed in a pixel.  See the information about packet loss lines for more details.


Popup_Trace_Count
This shows how many samples Ping Plotter has in memory currently.  Please note that some data may be dropped from memory – if Ping Plotter is configured to drop data from memory after it reaches a certain sample count.

Ping Plotter can keep a substantial amount of data in memory.  See the option for "Maximum Samples to hold in memory" for more details on this.


Popup_Displayed_Samples
The upper graph may not be displaying information about all data that is collected.  In the example we see here, we're zoomed in on only 20 samples - and this "focus rectangle" shows exactly which samples this is.  To change the focus of what the upper graph is displaying, just double-click the period you want more information about on the lower graph.

Keep in mind that "Samples to include" is a big variable in this - if you have samples to include set to 0, then it can't zoom in any more because 0 means "all".


Popup_Min_Max_Line
Show the Min/Max Line.  Hide this line to keep the scale of the upper graph in better range.  This line can be useful to understand how a specific hop is responding – for example, if hop 8's minimum point is significantly greater than hop 7's maximum point, then you may need to investigate what's happening between hops 7 and 8.  It may be distance (ie: speed of light latency), or it may be a problem with one router, or the connection between those routers.


Popup_Packet_Loss_Percentage
Show/Hide the packet loss percentage in the upper and lower graphs.


Popup_Prompt_For_Save_On_Close
If there are 75 or more unsaved samples in memory when Ping Plotter is closed, do you want to be reminded to save your data?


Popup_Underline
Any hop that is underlined means that it's being traced on a time-line graph (in the bottom portion). The underline makes it easy to find the hops that should be de-selected to remove their lower time-line graphs.  Double-clicking on a hop in the upper graph will show (or hide, if it's already showing) that graph in the lower time-graph region.


Popup_Route Change
The "Route Change" pane is used to show the history of route changes.  Any time any hop in the route changes, Ping Plotter stores the old and new route data and adds the time of the change to this list box.  Double-clicking on any time will show the route as of that time.  This is the starting time for the change.

Double-clicking on the time-line graph will refocus the upper graph on the period you double-clicked on the lower time-line graph.  The route window will also follow this - to show the route that was current at the time you selected.

If your route regularly changes, you may want to add a route change mask to exclude normal changes from the route change log.  This is particularly true if the route change is limited to a single oscillating router – that is changing between two similar IP addresses constantly.


Popup_Options_Auto_Save_Data
Ping Plotter can be set to automatically create a .PP2 save file at a specified interval.  This can be coupled with "Maximum samples to hold in memory" to minimize the amount of memory used on long monitoring projects.  The "Save Interval" must have elapsed before the first save happens (this is so short-term tests don’t auto-save data).  A suggested number for this is 30 minutes.

The file name defaults to the current path.  The following variables can be used in the name:

	$host	Host name (or IP address)
	$year	Current Year
	$month	Current Month
	$day	Current day of month
	$hour	Current hour
	$minute	Current minute
	$second	Current second
	$date	Same as $year-$month-$day.
Make sure your file name will resolve to a valid file name.  Remember that a colon (:) should only be used with a drive letter, and the / isn’t a valid character.

A good example of a file name is:  $host $date $hour00

If the file already exists, it will be overwritten.  This means you can combine a pretty fast save interval, and couple that with a longer time file name (ie:  $host) and save your data often without creating a lot of extra files.

Also, if you specify a directory that doesn't exist, then Ping Plotter will try to create that directory (this is useful if you want to save data about a specific host in a directory that matches that host name – you can use "$host\$host $date" (or something similar) for your filename.


Popup_Options_Auto_Save_Image
Ping Plotter can be set to automatically create an image of the current data (as seen on the graph).  Using this, one could auto-save for a time period, then create some kind of "album" to post for proof of a problem.  The "Save Interval" must have elapsed before the first save happens (this is so short-term tests don’t automatically create images).

Note that the image that is saved is the same as the image on the Ping Plotter display at the time the period elapses.  If you've changed the focus of the Ping Plotter display, then the current image saved rather than the current data at the time of save.

See the "Auto-save date" section / settings for file name variables and tips.


Popup_Options_Maximum_Memory_Sample_Count
This is the maximum number of samples that will be held in memory at any one time.  Older samples are purged from memory.  This can be coupled with auto-saving of data to keep your memory images small, but still have access to all the data collected.

Ping Plotter averages about 44 bytes per sample (this can be more or less, but this is the memory for a 20 hop route), so 20,000 samples is still less than 1 megabyte of memory.


Autosave Image Type
Select BMP, GIF or PNG as the file format to save in.  PNG and GIF are both compressed formats, and as such are much smaller than BMP.  GIF is relatively universal, while PNG is now supported by most software, and is slightly smaller than GIF.


Popup_Options_Cargo
Note:  This is an advanced option that should probably not be changed.  This is used to diagnose network problems when specific *data* is sent - which is a highly unlikely problem for most networks.

By default, Ping Plotter (basically) pads the outgoing packet with repeating string representing the current Ping Plotter version and name.  An example of this is PingPlotter250, repeated over and over to fill the cargo.  If you suspect that your network may be having problems when you send specific byte codes, you can enter the hex code that you want repeated, OR a link to a file to read the byte string from.  The cargo space for the packet will be padded with this data.  Use this in conjunction with the packet size to create the network scenario you're looking to duplicate.


Popup Options Show Route Change Indicator
Normally, the route change window is hidden on the main screen.  If this is the case, then a "notification" will pop up whenever there is a route change - which you can click on to show the route change window.

If you're getting a lot of route thrashing that you don't want to know about, you can turn off this indicator here.  This is *on* by default.


Popup Options Route Change Exclusions
By default, any route change is recorded and noted by Ping Plotter.  In some cases, this may not be desired behavior - an example of this is if something in your regular trace route oscillates between 2 (or more) routers based on load.

If you're seeing route oscillation (where a specific hop regularly changes between 2 or 3 different IP addresses, but the rest of the route doesn't change), then you can add a mask to this list to suppress route change notifications when this happens.

To do this, hit "Add IP Mask" and enter the first IP address.  Once it's in the list, select it, and then hit the next button down (Or with XX.XXX.XXX.XXX).  In the popup, enter the next IP address of the oscillating set.  Repeat this if there's a third one (or more).


Popup_ERR_Col
The PL% Column indicates the percentage of packets lost (number lost divided by the samples to include that have been sent out)

If you're only including the last 10 samples, then only the number of packets lost in the last 10 samples is shown here. If you want to find out packet loss over the entire session, change the "Samples to Include" number to 0 (which includes ALL samples).

The number of packets lost can be shown by enabling the ERR column by right-clicking the graph.


Popup_AddressToTrace
The "Address to Trace" edit box allows you to pick a new host to trace to. You can either type in an address or select one from the list below (double clicking will make it start tracing as well).

Ideally, the address doesn't have a protocol specifier, or sub-directory. If you're trying to find out why http://www.pingplotter.com/orders.html isn't responding, just enter www.pingplotter.com.

Any time you successfully trace to a host, that host is added to the list below.

To delete a host, right-click it in the list and then select "Delete".

If you enter an IP address, then a space, and then a name, Ping Plotter will keep track of the name that you enter.  This is handy if you enter a bunch of IP addresses and can't remember what they're for.


Popup_Alert_Name
The alert name is used to identify the alert when attaching to a host.  Make sure you name this something besides "New Alert 7" or it's going to be hard to figure out what it does later... :)  Of course you can always change the name later, too...


Popup_Alert_Out_Of_Range_Count
Select how many out of range samples you want to have to happen before the alert fires.  Also, select here what "out of range" means.  Note that a timeout is always out of range, so you can select any reasonably high number (ie: 9999) to mean timeouts.


Popup_Alert_TraceCount
This specifies the number of samples to examine.  This does NOT have to match the "number of samples to include" from the main screen - so you can set up whatever conditions you want.  Ping Plotter uses this number when determining if the alert should fire.


Popup_Average
The Avg column shows the average response time of the last N samples (where N is the samples to include).  Any timeouts are not included in this sample.


Popup_Avg Line
The red line on the graph shows the average response times for the route. Lost packets are not included in this average.


Popup_Brackets
Any hop number surrounded by brackets (like [12]) means that that hop is being monitored for an alert (see alerts for details on setting up an alert). Multiple alerts can be configured for the same IP, and alerts don't work unless some IP in your current route is being monitored (ie: has brackets around it).


Popup_CurrGraph
The blue X on the graph is the graph of the current (or most recent) sample taken.


Popup_Current
This column shows the individual sample time of the most recent sample included in the set.  If a number is displayed as ERR, that means that the packet was lost - a packet was sent out but was never returned.


Popup_Err Column
The PL% Column indicates the percentage of packets lost (number lost divided by the samples to include that have been sent out)

If you're only including the last 10 samples, then only the number of packets lost in the last 10 samples are shown here. If you want to find out packet loss over the entire session, change the "Samples to Include" number to 0 (which includes ALL samples).

The number of packets lost can be shown by enabling the ERR column by right-clicking the graph.


Popup_Graph Scale
The number shown here indicates the graph scale.

If a dynamic scale is being used, then this number is the maximum response time of any of the included sample set.  This number can change (and WILL change) as new samples are received.

If a fixed scale is being used, this number will always equal that scale.  You can change to a fixed scale by going to Advanced Options.


Popup_Option_Color Background
The background of the graph uses colors that don't display well unless your video drivers are set for more than 256 color.  Turn off this option if you're having problems seeing the graph (ie:  It has little speckled dots instead of a solid color).


Popup_Option_Color Hop
This option can probably be left on all the time - it marks whether or not the red/yellow/red is painted onto the background of the HOP column.  The colors used should work fine on a 16 color screen, though, so you're probably going to be OK leaving it on.  If you want a "Copy as Image" to show up without color, turn this off.


Popup_Options_Color Speeds
These boxes control the point at which the colors change.  By default, all response 200 ms and below will paint green.  From 201 to 500 will paint yellow, and over 500 will paint red.  These numbers apply to both the HOP column and the graph background.  In addition, the legend on the graph screen will be updated with these number.

You'll probably want to change the numbers based on your internet connection speed.  If you've got a T1 or a cable modem, the listed numbers are probably pretty good (you might move them down a little if you're tracing to a fast site).  If you have a modem, you probably want to crank these numbers up a bit.

A reasonable number for a modem would be 350 for Warning and 600 for Critical.  You might want to play around a little with these, though.


Popup_Options_Hop Interval
This can be an interesting number to manipulate.  It's really meant for "advanced" users, so you don't NEED to change it.

Ping Plotter sends out multiple packets at the same time and times everything at once.  Actually, it leaves a tiny interval between each packet so as not to completely saturate your bandwidth when it sends out 30 packets.  This time interval is adjusted by this parameter.  Most of the time, 25ms is good.  This falls within realm of what a 28.8 modem can perform.  If you've adjusted your packet size, or your connection to the internet is really slow, you might want to crank this number up a little.  If you have just oodles of bandwidth, you can crank it down a little.  Be aware that a too-small number can adversely affect your data.


Popup_Options_Non-threaded lookups
NT 3.51 in particular doesn't like to have multiple IP addresses resolved into names at the same time.  NT 4.0 and Windows 95/98 work fine with this check mark turned off.  Performance is best with this turned off.

When this switch is on, Ping Plotter will still uses multiple threads to do tracing, but the looking up of names is done one at a time.  When installing onto a machine running NT 3.51, this option is turned on by default.

A symptom of having this switch off under NT 3.51 is that Ping Plotter stays in memory - even after you close Ping Plotter.  When you close Windows NT, it notifies you that Ping Plotter is still running.  If you run into this problem, turn this switch on.


Popup_Options_Packet Size
This adjusts the size of the packet that Ping Plotter sends out to the host.  Sometimes routers in the path can be adversely affected by packet size.  You can play with the packet size if you suspect that one of the routers is incorrectly configured or is likely to cause problems with larger (or smaller) packets.

Having this number too high will HUGELY affect your performance.  It's best to leave this pretty small.  Valid ranges are from 28-512 bytes.  Actually, anything up to 32K will be accepted, but using a packet size over 512 bytes is just asking for trouble (fragmentation, and other problems).  Keep this number relatively small unless you know that you need a bigger number..

Note that setting this too high can cause the FINAL hop in the trace to appear to be responding poorly.  This is because all hops before the final one are timing out and returning a small "Timeout" packet, but the final destination will be returning the full data that was sent.  Keep this number small for the most consistent response times.

The size set here includes the header bytes, so this is the total packet size.  In versions of PingPlotter before 2.50, this was actually the cargo size, so with 2.50, the default packet size is actually 28 bytes less than it was in previous versions (using the same number).  A 56 byte setting here actually creates a 56 byte packet – 28 bytes of header and 28 bytes of "cargo".


Popup_Options_Scale
By default, Ping Plotter will automatically adjust the scale of the graphs to fit the data you're collection.  Sometimes, if one of the hops in your trace has really bad performance, this can cause the graph to become almost unreadable.  If this happens, you can fix the scale of the graph so it doesn't change.  Both the trace graph - and the time-line graph are fixed by this number when set.


Popup_Options_Show X
To watch "trending", it's sometimes nice to see what the most recent sample is.  This option will enable that.  A little blue X will be drawn on the graph that represents the most recent sample.  You might want to turn this off when submitting a picture to an ISP so as not to confuse them or add anything they can question.


Popup_Options_Timeout Speed
This option allows you to fine-tune your performance a little.  By default, Ping Plotter will wait for 10 seconds for any packet to return.  If the packet doesn't return in 10 seconds, then it is counted as a lost packet.  If patience isn't one of your virtues, you can turn this down somewhat.  No matter what your value is here, timed out packet will show with the time "9999".

Because of the performance enhancements offered by Ping Plotter, it's unlikely that this option needs to be changed.  If it's set too low, it can cause misleading data to be generated.  For best results, leave this at 9999.


Popup_Querying
When the word "Querying" is displayed here, Ping Plotter is waiting on the internet for something - either a trace packet to return or a name lookup to return.  When nothing is displayed here, Ping Plotter is just waiting for you to hit "Trace" or "Resume" - or it's waiting for the specified time interval to elapse so it can get its next sample.


Popup_Round Trip
The round trip line is optional (it can be removed from the "View" Menu).  This shows exactly the same as the last server in the chain, but it's sometimes nice to have this number re-announced for ease of reading.  This line shows the time it takes to get from your computer to the destination server and back again.


Popup_Samples To Include
It’s somewhat important to understand how "Samples to Include" works.

When running a trace, Ping Plotter can look at just the most current samples.  This is great to watch "trending" (where the response changes over time).  If you include ALL samples (type 0 in this field), then after a bunch of samples, new samples don't affect the graph very much.  Setting this to something like 10 allows you to see how the response times are right now.  All numbers in the trace (upper) graph are affected by this.  When zooming in on the timeline graph, it’s important to not have this set to "ALL".


Popup_TimeGraphTimeIndicator
The time under the graph shows what time these samples were taken.  If you have more samples than can be displayed on the graph, you can either change the scale (by right-clicking the graph) or scroll the graph (by clicking on the graph and then dragging left or right).


Popup_TimeGraphTimout
A red line in the time-line graph indicates a timeout in this time period. You move the focus of the upper graph to this time by double-clicking it - to find out where the timeout first occurred (in the upper graph).

The height of the red line indicates the percentage of packet loss in the time period being represented by the pixel.  Keep in mind that based on the number of samples you collect and the scale of the lower graph you're showing, all timeouts may show up as 100%, or there may be multiple samples in any pixel.

If you're doing a trace every 10 seconds, and you're showing 10 minutes of samples, this is only 60 samples - and any one sample is going to take multiple pixels to display.  On the other hand, if you're doing that same thing and showing 48 hours, that's 17280 samples - and some averaging of samples needs to be done to display all the data.  This is where the packet loss percentage really makes sense in the lower graph.  In this case, you're probably going to have about 35 samples being averaged in any one pixel width, so the line height of the latency is going to be an average number, and the packet loss is going to be a percentage - based on how many failed and how many succeeded.  If there were no successful samples in a pixel width, then there will be no black line showing the latency, but instead a full-height red line to show 100% packet loss.


Popup_Trace Interval
The Trace Interval is the amount of time Ping Plotter will wait between each sample set.  If you're doing a long term monitoring project, you may want to set this to 1 minute (or more).  If you're just doing a quick set, you might want to set this to something lower (5 seconds or 10 second).  If the up/down arrow doesn't have the amount of time you want, just type in the time interval you want (e.g. 3.5 seconds).


Popup_TraceCount
The "# of times to trace" allows you to stop tracing after a certain number of traces.  If you're only interested in a set trace count, you can save some bandwidth usage by not allowing Ping Plotter to trace forever.


Popup_Variation
The black line on the graph indicates the range of times received.  The leftmost side of the line is the minimum response time - the rightmost being the maximum response time.

This is great for showing clear network bottlenecks. If the best response time of a hop is higher than the worst of the previous hop, you're pretty sure there's some problem between these two hops.


Almost Simultaniously
So that your network bandwidth doesn't get saturated, Ping Plotter waits a tiny amount of time (configurable - but defaults to about 1/50th of a second) between sending out each hop.


Alert Events
Any alert can fire one or more "Events" based on the conditions of the alert.  Each of these events have different parameters and options.  The possible event types are: Send an email, Play a sound, Log to a file, Change the tray icon, and Launch an executable.


Popup_Options_DSCP
The DSCP byte is often used by network providers to determine packet priority and sometimes make other decisions about the data.  There may be an occasion where you want to manipulate this byte and test network performance.  VoIP data, for example, is often characterized by a value in the DSCP byte.

This byte can be edited as Decimal, Hex, or Binary by hitting the button beside the edit field.  The display on the button shows the current format this value is displayed in.

Note that under Windows XP and newer operating systems, a registry setting needs to be modified to allow this byte to be used.  This is a system-wide setting that allows applications to write their own values into this byte.  If your system needs to have this value set, PingPlotter will prompt to see if you want this setting changed (and a reboot will be required) as soon as you modify the value in this field.