Welcome to another article in our series about ThousandEyes!
ThousandEyes is a powerful SaaS platform that gives a digital picture of enterprise infrastructure, formed by test views, alerts, dashboards, and other components.
In this article, we will delve deeper into the ThousandEyes network agent-to-agent test. We'll examine its phases, analyze packet captures taken during the test, and identify the stages of packet flow throughout the process.
What is ThousandEyes Network Agent-to-Agent test: The agent-to-agent network test enables ThousandEyes users to deploy ThousandEyes agents at both ends of a monitored network path. This setup allows for testing the path in one or both directions: from source to target, target to source, or bidirectionally. By having agents at both endpoints, users can measure true one-way metrics, visualize asymmetric paths, and obtain more precise performance data compared to traditional agent-to-server tests.
In this article, we will focus on the following key parameters for the ThousandEyes Network Agent-to-Agent test:
Test Settings
- Type: Network - Agent to Agent
- Target Agent: Cloud Agent
- Direction: Source to Target
- Protocol: TCP
- Server Port: 49153 (default)
- Maximum Segment Size (MSS): Manually set to 200 bytes for easier analysis of packet captures
Let's initiate the ThousandEyes Network Agent-to-Agent test, ensuring that packet capture is enabled and configured to collect data during the test round. After running the test, here are the results:
Now, let's analyze the packet flow captured during the ThousandEyes Network Agent-to-Agent test. At the beginning of the packet capture, we observe the TCP three-way handshake between the source and destination agents:
In a ThousandEyes Agent-to-Agent TCP test, the TCP three-way handshake initiates the communication between the source and target agents. By default, the source agent establishes this connection with the target agent using port 49153. However, this port number can be modified in the 'Advanced Settings' section of the Agent-to-Agent test configuration.
It's important to note how the Maximum Segment Size (MSS) or Payload Size is determined in ThousandEyes Agent-to-Agent tests. When set to 'Auto', the system first conducts a path MTU discovery test, using the lowest threshold found to run the end-to-end metrics test. If the MSS/Payload size is manually specified, as in our case where we've set it to 200 bytes, the system bypasses the MTU discovery and proceeds directly to the end-to-end metrics test. This manual setting allows for more predictable packet sizes, which can be beneficial for detailed analysis of packet captures.
According to ThousandEyes documentation, after establishing a standard TCP connection, the source and target agents initiate the measurement process by exchanging a series of packets to synchronize their internal clocks. This phase is referred to as the "clock sync preamble" and consists of 5 packets sent in each direction. The process works as follows:
- The source agent sends 5 PSH,ACK packets to the target agent on port 49153.
- These packets have increasing sequence numbers, starting from 2 and progressing as follows:
- 1st packet: Sequence number 2, length 30
- 2nd packet: Sequence number 33
- 3rd packet: Sequence number 64
- 4th packet: Sequence number 95
- 5th packet: Sequence number 126
- In the packet capture visualization, arrows pointing from left to right represent packets sent from the source to the target agent.
- Arrows pointing from right to left indicate acknowledgments sent from the target back to the source agent.
It's important to note that the clock synchronization process is critical for obtaining end-to-end metrics. If the source agent receives fewer than three acknowledgments during the clock sync preamble, the synchronization dialogue is terminated. In such cases, the test will still produce path visualization results, but it won't be able to generate end-to-end metrics data due to insufficient clock synchronization between the agents.
The next stage of the test involves sending the actual measurement probes. This phase always consists of 50 packets transmitted in a single direction. In our packet capture, we observe that the sequence numbers of these probes start at 157. Due to our test configuration specifying a payload size of 200 bytes, each subsequent packet's sequence number increases by 201 (200 bytes of payload plus 1 byte for the TCP header). Thus, we see sequence numbers progressing as 157, 358, 559, and so on. This consistent payload size allows for precise measurements and easier analysis of the packet flow throughout the test:
As anticipated, the final packet in the measurement probe sequence has a sequence number of 10006. This can be verified through a simple calculation:
- The initial sequence number is 157
- There are 49 subsequent packets (for a total of 50)
- Each packet after the first increases the sequence number by 201 (200 bytes of payload + 1 byte for the TCP header)
Consequently, the final packet number at which this part of the dialogue should conclude is: 157 + (49 * 201) = 10006:
After the target agent receives the measurement probe packets, it transmits this data to the ThousandEyes controllers. These controllers then process the information to calculate the End-to-End Metrics. For instance, if the target agent reports receiving only 45 packets, the controllers would calculate a 10% packet loss rate.
After this stage, the test will determine the path trace. We won't delve into the theoretical aspects of path trace logic; instead, we can refer to the ThousandEyes documentation page titled “How Path Trace Works.” Our focus will be on analyzing the packets. Using the filter icmp.type == 11, we can observe how the path trace is constructed:
The traceroute-style output displays the same hop sequence but in a more user-friendly format:
In upcoming articles, we will conduct the same tests using UDP and examine the differences when MSS is set to Auto.
If you are an existing customer (or use a trial license of ThousandEyes) - and need any assistance with ThosuandEyes Network tests, you can always contact our expert engineers and get almost instant support using ThousandEyes chat.
Other useful ThousandEyes & knowledge resources:
ThousandEyes Agent-to-Agent Measurements
ThousandEyes main web Application page