Sending Your Own Packets
Active monitoring — also called synthetic monitoring — works by deliberately injecting test traffic into the network and measuring what comes back. You are not waiting for real users to generate traffic; you are creating controlled, repeatable probes so you always have a signal, even at 3 AM when no one is online.
The simplest example is ping: it sends an ICMP Echo Request to a target and measures the round-trip time (RTT). More sophisticated tools like iperf3 can saturate a link with TCP or UDP traffic to measure maximum throughput. Enterprise platforms like Cisco ThousandEyes deploy agents in cloud regions, ISPs, and branch offices to continuously probe paths between them.
How It Works in Practice
A typical active monitoring setup looks like this:
- Deploy agents at strategic points — your data center, each cloud region, key office locations.
- Configure probes — each agent sends packets to defined targets every N seconds (commonly 5–60 seconds).
- Record metrics — latency (RTT), jitter (variance in RTT), packet loss percentage, and path (traceroute hops).
- Alert on thresholds — if latency from the London agent to the US-East VPC exceeds 120ms, page the on-call engineer.
A basic latency probe sends a batch of ICMP packets and reports round-trip statistics. Measuring throughput instead means running iperf3 in server mode on the target and pointing a client at it with multiple parallel streams to simulate realistic multi-connection traffic. Identifying which specific hop along a path is adding latency means running a traceroute, which reports per-hop round-trip time.
Pros and Cons
Pros:
- Baseline visibility at all times. You know what "normal" looks like even when no users are active. This is critical for detecting degradation before users notice.
- Controlled and repeatable. Packet size, frequency, and protocol are fixed, so you can compare measurements over time without confounding variables.
- Tests paths users haven't taken yet. You can probe your failover link before you need it, verifying it actually works.
Cons:
- Doesn't reflect real user behavior. A 64-byte ICMP ping succeeding doesn't mean a user uploading a 500MB file will succeed. Different packet sizes, TCP window scaling, and application-layer behavior all matter.
- Adds traffic. In bandwidth-constrained environments (satellite links, metered connections), synthetic probes consume real capacity.
- Can be blocked. Many firewalls block ICMP. A failed ping might mean "ICMP is filtered," not "the host is down." Always use application-layer probes (HTTP, TCP connect) in addition to ICMP.
Interviewers often ask: "How do you know if a network problem is affecting real users vs. just your monitoring?" The answer is to correlate synthetic probe results with passive signals (flow logs, TCP retransmission rates, application error rates). If your synthetic probe shows 0% loss but users report timeouts, the probe is likely testing a different path or protocol than the user traffic. This is a common gap in synthetic-only monitoring strategies.