About Packet-Based Probes

Packet-based Test Procedure

Whenever InterMapper tests a packet-based device, it uses the following procedure:

  1. InterMapper sends the appropriate probe packet (ping, SNMP get-request, DNS query, etc.)
  2. InterMapper waits the timeout interval specified for the particular device.
  3. If a response arrives, InterMapper examines its contents and sets the device status based on that response
  4. However, if no response arrives, InterMapper sends another probe packet
  5. The above procedure is repeated until a response arrives or the specified number of probes has been sent
  6. If no response has arrived after the final timeout, InterMapper sets the device status to Down.
  7. In any event, the device is scheduled to be tested again at a time set by the map's (or the device's) poll interval.

The default timeout is three seconds, with a default probe count of three seconds. Consequently, InterMapper will take nine seconds to declare a device is down (three probes, waiting three seconds each). Both the timeout and the number of probes can be set for each device.

This often gives rise to 21 second or 51 second outages. What's happening here is that the device fails to respond to one set of probes (for example, after nine seconds), but responds immediately at the next poll 30 or 60 seconds later. This gives an outage duration to be (30-9=21) seconds or (60-9=51) seconds.

Shared Polling in Ping/Echo and SNMP Probes

You may have created different maps that poll the same device. For Ping/Echo and SNMP probes (built-in or custom), InterMapper polls a device only once if it is considered to be the same device, and shares the response among all the maps that poll that device.

This happens automatically, and there are no user-controllable parameters.

In order for two mapped devices to be considered the same and share the results of a single probe, the following characteristics of the mapped device must be identical:

For SNMP probes, the following flags in the probe file must be identical. (this is nearly always the case, as it is implied by the probe type, but is still checked explicitly):