Packet Loss (Utrata pakietów)

Packet loss is when some of the packets sent across a network never reach their destination. It is given as the percentage of packets dropped relative to all packets sent over a given interval (for example, 1%). Together with latency and its variation (jitter), it is one of the three core metrics of network quality.

What causes packet loss?

A packet can be dropped at any point along its path. The most common causes are:

• Network congestion — when there is more traffic than the link can carry, router and switch buffers fill up and excess packets are dropped (tail drop) or deliberately discarded by queue-management schemes such as RED/WRED.
• Link and physical-layer errors — a damaged or noisy medium, weak Wi-Fi signal, frame CRC errors, faulty cabling or SFP modules. Corrupted frames are discarded.
• Hardware and configuration — an overloaded or faulty router, overheating devices, mismatched MTU settings and fragmentation, and firmware bugs.
• Misrouting and loops — packets whose TTL counter reaches zero are dropped.
• Security-related causes — a volumetric DDoS attack intentionally saturates a link or device buffers. The result is mass packet drops, including legitimate traffic.

How is packet loss measured?

Packet loss is the ratio of lost to sent packets, reported as a percentage. Common methods include:

• Ping (ICMP echo) — sending a series of requests and counting the missing replies. Larger samples give more reliable figures (e.g. ping -n 100 on Windows, ping -c 100 on Unix-like systems).
• iperf3 — generates a controlled stream (especially over UDP) and reports the loss percentage and jitter at a target throughput.
• Traceroute / MTR — helps point to the hop where loss builds up. Here you have to tell apart loss at an intermediate node itself (which deprioritizes ICMP) from loss that actually reaches the destination.
• Flow telemetry and passive probes — analyzing flow records and interface counters (queue drops, CRC errors) reveals loss without injecting test traffic.

How does packet loss affect TCP and VoIP?

The impact depends on the transport protocol. TCP is reliable: it detects a missing acknowledgment (ACK) or receives duplicate ACKs and retransmits the lost segments. The cost is that real latency goes up, and congestion control shrinks the send window. Throughput drops — even modest loss can badly slow large transfers.

UDP retransmits nothing, so real-time applications are especially sensitive to loss. In VoIP and video conferencing you can hear and see it: audio breaks up, voices sound robotic, and images show artifacts. As a rough guide, around 1–2% loss is already noticeable and above 5% quality degrades sharply. For file downloads (TCP) a few percent of loss is less disruptive, because retransmission recovers the data.

How is packet loss different from latency and jitter?

• Latency — the time a packet takes to travel from sender to receiver. It is a delay, not lost data.
• Jitter — variation in latency between consecutive packets. Uneven delivery degrades real-time streams.
• Packet loss — packets that never arrived at all.

These metrics are independent: you can have low latency with high loss and vice versa. Each also calls for different fixes, which is why they are monitored together.

Why does packet loss matter for security?

For network monitoring and SOC/NDR teams, packet loss is a signal, not just a performance problem. A sudden, time-correlated spike in drops together with link saturation is a typical symptom of a DDoS attack. Loss at probes and collectors (e.g. port mirroring, NetFlow/IPFIX) also creates visibility gaps — incomplete telemetry can hide malicious traffic from detection systems. So packet loss is measured continuously and compared against interface counters and flow data — to keep service quality up and to catch anomalies.

Learn more

• RTT (Round Trip Time) — Packet loss can increase RTT by triggering retransmissions and extra delay.
• NPM (Network Performance Monitoring) — NPM helps detect packet loss and measure its impact on network performance.
• TAPs — TAPs capture traffic without dropping packets, helping observe packet loss accurately.
• Probe (Sonda) — A probe monitors traffic and can reveal packet loss on links and devices.
• Scrubbing Center — Scrubbing centers filter attack traffic to reduce packet loss during DDoS events.