Hi Ben,
Do an nslookup for trps.trendmicro.com.
Non-authoritative answer:
Name: trps.trendmicro.com
Addresses: 216.104.8.100, 150.70.74.51
This should be DNS load balanced to your closest server. Try pinging 216.104.8.100 from your router to see if the RTT is lower.
What you really should be interested in is the RTT of the application, not of just ICMP. This can come out to be different because of server load, etc. In other words it's possible for the server application that provides this service to be completely down. Your URLFiltering requests will go unasnwered, but you'll still be able to ping the IP address...the box is still up but the service is down.
This is what I suggest you do. Try pointing to each one of those IP addresses manually in a trend-global parameter-map and watching the RTT to see if one is noticeably better than the other. To do this, create a parameter-map exactly like this:
! can be whatever you'd like
paramter-map type trend-global
server [216.104.8.100 | 150.70.74.51]
!
After you've chosen one, let it run for about a minute. Then check the output of:
"show policy-map type inspect zone-pair urlfilter | b Trend URL"
You should see something like this:
Trend URL Filtering is ENABLED
Trend server : 216.104.8.100(port: 80)
Current requests count: 0
Current packet buffer count(in use): 0
Maxever request count: 0
Maxever packet buffer count: 0
Total cache hit count: 0
Total requests sent to URL Filter Server
Total responses received from URL Filter Server
Total error responses received from URL Filter Server
Total requests allowed: 0
Total requests blocked: 0
1min/5min Avg Round trip time to URLF Server: 0/0 millisecs
1min/5min Minimum round trip time to URLF server: 0/0 millisecs
1min/5min Maximum round trip time to URLF server: 0/0 millisecs
Last req round trip time to URLF Server: 0 millisecs
(mine isn't enabled obviously)
Watch for the 1/5 Minute average/max/min/last RTTs. Compare one server vs the other and pick the one that's performing better.
***NOTE: These IP addresses can change from time to time and that you should configure a hostname and not hard-code a specific server. This isn't best practice and should only be done in the event that there is a notceable difference from one server to the other and DNS is putting you on the "slower" one. There are also some rare occasions where there may be a technical issue with one server or the other and bad luck has you going to the problem one - pointing to the other will keep you going until it's fixed and you can go back to the best-practice, hostname-lookup-method of choosing the server.
RTTs here in the US should average out to be below ~250ms. I can't really speak to what would be a reasonable RTT overseas or where these servers are actually located geographically...not sure.
HTH,
-jb
