Jitter is the uneven pace at which data packets arrive across a network. Picture trains scheduled to run once a minute — but one shows up after 50 seconds, the next after 70, the one after that in 55. On average it’s still “every minute,” yet the gaps keep jumping around. That wobble in the spacing between packets is jitter. Formally it’s the packet delay variation, and it’s measured in milliseconds.
It helps to separate jitter from plain latency. Latency is how long a packet takes to travel from sender to receiver — the length of the trip. Jitter is how unpredictable that trip is — whether packets arrive in a steady rhythm or in uneven bursts. A link can be fast (low latency) and still have high jitter, and vice versa.
Why jitter is a problem
It mostly hurts things that happen live. On a voice call (VoIP) or a video meeting, audio and video need to flow in an even rhythm. When packets start arriving unevenly, you hear choppy speech, robotic stutter, or dropped bits of sentences. For ordinary web browsing or file downloads, jitter barely matters — rhythm isn’t important there, and TCP patiently reorders packets anyway.
Where does jitter come from? Most often from network congestion, when packets wait in line inside router buffers. Other causes include route changes (packets taking different paths), no priority for live traffic, Wi-Fi interference, and overloaded gear along the way.
How it’s measured and what counts as “good”
Simply put, jitter is the average of how much the gaps between consecutive arriving packets differ. For live connections, the RTP/RTCP standard (RFC 3550) defines it precisely: it computes the variation from packet timestamps and smooths the result so it reflects the current trend rather than a single spike. A few thresholds are worth remembering:
- Calls and video conferencing — comfortably below about
30 ms. - Video streaming — tolerates more, up to around
100 ms, because the player buffers content ahead of time. - Ordinary browsing and downloads — jitter is essentially irrelevant.
The simplest remedy is a jitter buffer on the receiving end. Think of it as a tiny waiting room for packets: the device deliberately holds them for a fraction of a second and releases them at an even pace, even though they arrived unevenly. The buffer can be fixed in size or tuned on the fly. It’s always a trade-off — a bigger buffer smooths things out better but adds delay. On top of that, QoS mechanisms (giving live traffic priority) cut jitter before it ever reaches the buffer.
Jitter in cybersecurity
Interestingly, in the security world the word jitter means something slightly different — here it’s about deliberately adding irregularity. Malware regularly “checks in” with its command-and-control (C2) server by sending short signals (beaconing). If it did this exactly every 60 seconds, that clockwork rhythm would be easy to catch. So attackers add jitter — randomly scattering the intervals (55 s here, 65 s there, 58 s next) — to hide the regularity and fool simple rules. The trick has been used by popular C2 frameworks and advanced campaigns such as SUNBURST, with its long, randomized delays.
The catch is that randomness doesn’t hide everything. For SOC teams and NDR systems, beaconing still leaves a statistical fingerprint: a recurring distribution of intervals, similar connection sizes, and stubbornly the same destination address. Analyzing those time series — often with machine learning — can spot the hidden pattern beneath the layer of injected jitter.
Learn more
- Packet Loss (Utrata pakietów) — Packet loss can increase jitter by causing uneven packet spacing and retransmissions.
- Baseline (Baselining) — Baseline comparisons help detect jitter when delay variation exceeds normal network behavior.
- NPM (Network Performance Monitoring) — NPM tools measure jitter to identify unstable network performance and timing variation.
- Probe (Sonda) — A probe can measure jitter by sending packets and checking variation in their arrival times.
- NOC (Network Operations Center) — A NOC monitors jitter to spot network issues that affect real-time traffic quality.
- Bandwidth — Limited bandwidth can contribute to jitter when congestion delays packet delivery.
- Throughput — Low or unstable throughput can be a symptom of jitter and other network delays.
- RTT (Round Trip Time) — Jitter is the variation in packet delay, which can cause RTT to fluctuate over time.
