Latency is the time delay between sending data and its arrival at the other end of a network path, usually expressed in milliseconds (ms). In network monitoring, latency is one of the core health metrics alongside packet loss, jitter and throughput, and it is measured either as one-way delay or, far more commonly, as round-trip time (RTT), the time for a packet to reach a destination and for the reply to return.
Latency is not the same as bandwidth. A link can carry many gigabits per second and still feel slow if every exchange waits tens of milliseconds, because interactive applications and TCP itself are bound by round trips, not only by capacity.
The four components of network latency
End-to-end latency is the sum of four delay types that accumulate at every hop. Understanding which component dominates tells an engineer whether a problem can be fixed by configuration, by hardware or not at all.
| Component | Cause | Typical magnitude | Can it be reduced |
|---|---|---|---|
| Propagation delay | Signal travel time through the medium | About 5 µs per km in fiber | Only with a shorter path |
| Serialization delay | Time to put bits on the wire | 12 µs for 1500 bytes at 1 Gb/s | With faster links |
| Processing delay | Lookup, filtering and encryption in devices | Microseconds per hop | With better hardware or simpler rules |
| Queuing delay | Waiting in buffers during congestion | Zero to hundreds of ms | With capacity, QoS and queue management |
Propagation delay sets a hard floor: light in fiber travels at roughly two thirds of its speed in vacuum, so a 1,000 km route adds about 5 ms one way and 10 ms round trip before any device touches the packet. Queuing delay is the variable part, and it is the component that monitoring most often catches changing during incidents.
How latency is measured
Latency monitoring uses active probes, passive observation or both. Active methods send test traffic and time the replies; passive methods derive timing from real traffic, such as packet captures or flow records. Each method sees a different slice of the truth.
| Method | What it measures | Strength | Limitation |
|---|---|---|---|
| ICMP ping | Round-trip time to a host | Simple and universal | ICMP may be deprioritized or blocked |
| TCP connect timing | Time to complete the TCP handshake | Reflects real service ports | Includes server accept time |
| Traceroute | RTT to each hop on the path | Locates where delay is added | Router replies are slow-path traffic |
| Packet capture analysis | Timing of real request and response packets | Exact application view | Needs capture points and storage |
| One-way delay probes | Delay in each direction separately | Reveals asymmetric paths | Requires tightly synchronized clocks |
One-way measurements need clock synchronization better than the delay itself, typically through PTP or well-disciplined NTP, which is why most tools report RTT. Tools such as Wireshark can calculate RTT from TCP acknowledgments in a packet capture, while SNMP-based systems usually poll devices for counters rather than latency directly.
Averages hide problems. Good monitoring reports percentiles such as p50, p95 and p99 and the minimum RTT, which approximates the propagation floor. The difference between the minimum and the higher percentiles shows how much delay comes from queuing.
Latency compared with jitter, packet loss and throughput
Latency is closely tied to the other network monitoring metrics, but each answers a different question. Jitter describes how much latency varies, packet loss describes how many packets never arrive, and throughput describes how much data moves per second.
| Metric | Question it answers | Unit | Main effect on users |
|---|---|---|---|
| Latency | How long does one exchange take | ms | Slow response and lag |
| Jitter | How much does delay vary | ms | Choppy voice and video |
| Packet loss | How many packets are lost | Percent | Retransmissions and gaps |
| Throughput | How much data arrives per second | Mb/s or Gb/s | Slow downloads and uploads |
The metrics interact. A single TCP flow cannot exceed its window size divided by RTT, so a 64 KB window over a 100 ms path caps throughput near 5 Mb/s regardless of link capacity. Rising latency under load, often called bufferbloat, also signals that buffers are filling before packets are dropped.
Acceptable latency by application
There is no single good latency value; the threshold depends on how interactive the application is. The ranges below are widely used planning targets for one-way or round-trip delay, as noted.
| Application | Target | What happens above it |
|---|---|---|
| Voice over IP | Under 150 ms one way | Speakers talk over each other |
| Online gaming | Under 50-100 ms round trip | Visible lag and missed actions |
| Interactive web pages | Under 100 ms round trip per exchange | Pages feel sluggish |
| Storage replication | Often under 5-10 ms round trip | Synchronous writes slow down |
| Same data center | Under 1 ms round trip | Microservice calls become costly |
Thresholds for alerts should come from a measured baseline for each path. A transatlantic link with a normal 80 ms RTT is healthy, while 80 ms inside a campus network indicates a serious fault. Alert on deviation from the baseline, not on a universal number.
Common causes of high latency and misconceptions
When latency rises, the cause is usually congestion, a route change or an overloaded device. Typical findings during troubleshooting include:
- Congested uplinks that fill buffers and add queuing delay during peak hours.
- Route changes that send traffic over a longer path, visible as a step change in minimum RTT.
- Wi-Fi contention and retries, which add variable delay on the last hop.
- VPN hairpinning, where traffic travels to a distant concentrator before reaching a nearby service.
- Overloaded hosts that respond slowly, which looks like network latency in simple tests.
A common misconception is that a high ping to a router proves a network problem. Routers answer ICMP in their control plane with low priority, so a single slow hop in traceroute is meaningless unless the delay persists for every hop after it.
The simple explanation
Latency is the waiting time on a network. It is how long a message needs to get from one computer to another, and usually how long it takes for the answer to come back.
Think of the difference between a wide highway and a short trip. Bandwidth is how many lanes the highway has; latency is how long the drive takes. A wide road does not help if the destination is far away or the traffic is stuck, which is why video calls and games depend so much on low latency.
How it is used in practice
A retail company runs its point-of-sale systems against a central database in a regional data center. The monitoring system sends TCP probes every 30 seconds from each store and records p50 and p95 round-trip times. The normal baseline for one store is 18 ms at p50 and 25 ms at p95.
On a Saturday afternoon, the p95 value for that store climbs to 240 ms while the minimum RTT stays at 17 ms. The unchanged minimum rules out a route change and points to queuing delay. Flow data shows a backup job saturating the store’s uplink.
The team moves the backup to night hours and applies a QoS policy that prioritizes payment traffic. Checkout latency returns to its baseline, and the alert rule is refined to trigger when p95 exceeds twice the baseline for five minutes.