Commands for Detecting Packet Loss

ICMP is a hint, not proof

Routers may rate-limit or de-prioritize ICMP while forwarding TCP normally. Use mtr or long-run ping for trends, then confirm with TCP-based tests (curl, iperf3) when loss is intermittent.

Tooling workflow

Layer	Command ideas	Interprets
End-to-end ICMP	`ping -c 100 -i 0.2 host`	Aggregate loss % and RTT jitter
Per-hop view	`mtr --report --report-cycles 50 host`	Where loss appears (watch for middlebox artifacts)
Local shaping	`tc -s qdisc show dev eth0`	Drops from fq_codel, HTB, or police rules
NIC errors	`ip -s link` / ethtool -S	CRC, collisions, buffer overrun

Sampling duration

One-second snapshots lie on Wi-Fi and cellular. Collect at least tens of seconds, ideally several minutes, and note concurrent uploads (bufferbloat).

Frequently Asked Questions

Q.Why does mtr show 100% loss on an intermediate hop but not at the destination?

That router may block ICMP time-exceeded replies while still forwarding traffic—classic artifact. Focus on the last responsive hop and end-to-end TCP behavior.

Q.Does ping loss always mean my TCP applications will fail?

Not necessarily—different QoS, ECN, and retransmit behavior apply. High sustained ping loss still warrants investigation, but confirm with application-layer tests.

Q.What sample size is enough to prove intermittent loss?

At least hundreds of probes or a multi-minute mtr report. Short runs miss bursts tied to Wi-Fi scans, microwave ovens, or ISP congestion windows.

Q.Why do tc qdisc counters show drops while ping is clean?

Traffic shaping may drop only large bursts or certain traffic classes. Check which child class accumulates drops and whether your test traffic matches that class.

Q.How do I separate Wi-Fi loss from ISP loss?

Repeat the same mtr/ping from a wired client on the same LAN. If wired is clean, focus on RF, driver power save, and AP placement rather than calling the ISP.

Q.Does UDP video game loss show up in ping?

Sometimes, but game UDP may traverse different queues or ports. Use game-specific server IPs and compare with iperf3 UDP if you need transport-level proof.

Q.Why must mtr sometimes run as root?

Raw socket modes for certain protocols or timing features require privileges. Use TCP mode or distribution packages that support unprivileged operation when possible.

Q.What should I log when opening a carrier ticket?

Timestamps, source/dest IPs, mtr --report output, interface error deltas, and whether the issue correlates with upload saturation—carriers dismiss one-packet anecdotes.