What to Measure and Why
Understanding which metrics matter — and what they indicate when they deviate — is the core skill of NPM. Here is a practical reference:
| Metric | Normal Range | Deviation Indicates |
|---|---|---|
| RTT (Round-Trip Time) | Baseline ± 10% | Routing change, congestion, overloaded host |
| Jitter | < 10ms for VoIP | Congestion, QoS misconfiguration |
| Packet Loss | < 0.1% | Buffer overflow, faulty hardware, congestion |
| TCP Retransmissions | < 0.5% of segments | Packet loss, aggressive firewall timeouts |
| TCP Connection Time | Baseline ± 20% | DNS delay, server overload, firewall latency |
| DNS Resolution Time | < 50ms | DNS server overload, misconfiguration |
| Interface Utilization | < 70% sustained | Approaching saturation; plan capacity upgrade |
| Interface Drop Counters | 0 (or stable) | Micro-bursts, buffer overflow |
| TCP RST Rate | Near 0 | Firewall rules, application crashes, timeouts |
The Four Dimensions of Network Health
Every network problem falls into one of four categories. Training yourself to think in these dimensions speeds up diagnosis dramatically:
- Latency — How long does a packet take to travel from A to B? Caused by distance (speed of light), congestion (queuing delay), or processing (overloaded devices).
- Loss — Are packets disappearing? Caused by buffer overflow (micro-bursts), faulty hardware (bad cable, failing NIC), or deliberate drops (QoS policies, firewall rules).
- Jitter — Is latency consistent, or does it vary wildly? High jitter destroys real-time applications (VoIP, video conferencing) even when average latency is acceptable.
- Bandwidth — Is the pipe big enough? Sustained utilization above 70–80% causes queuing, which increases latency and jitter even before packets start dropping.