By Manny Fernandez

October 27, 2026

Network Performance Metrics Explained: Latency, Jitter, Packet Loss, and Throughput

InfoSecMonkey | Networking

What each metric means, how it is actually calculated, and a plain-English analogy so it finally sticks

No fluff. Just the config that works.

Executive Summary

Every network complaint (“it’s slow”, “the call broke up”, “the game lagged”) traces back to a small set of network performance metrics. Four of them do most of the work: latency, jitter, packet loss, and throughput. Learn what each one measures, how it is calculated, and how they interact, and you can turn a vague complaint into a number you can test and fix.

This post defines each metric, shows the formula, and then explains it with one running analogy: a highway between your house and your office. Bandwidth is how many lanes the highway has, latency is how long your drive takes, and so on. By the end the whole dashboard should read like a traffic report.

Metric Measures Good target (general)
Latency (RTT) Round-trip delay for a packet < 50 ms on the open internet, < 1 ms on a LAN
Jitter Variation in latency between packets < 30 ms for voice and video
Packet loss Percentage of packets that never arrive < 1% general, < 0.1% for voice
Throughput Actual data delivered per second As close to provisioned bandwidth as possible

Pro tip: The one analogy for the whole post

Picture a highway from your house (the client) to your office (the server). Every car is a packet. We will use this same highway to explain every metric below.

Highway analogy mapping bandwidth to lanes, latency to trip time, jitter to car spacing, and packet loss to cars that never arrive
The highway: one picture for all four metrics

Latency

What it means

Latency is the time it takes for data to travel from source to destination. Most tools report round-trip time (RTT), the there-and-back time, because that is what a sender can measure without a perfectly synchronized clock at the far end. One-way latency is half of RTT only when the two directions are symmetric, which on the internet they often are not.

Latency has four components, and only one of them is about distance:

Component What causes it Can you fix it?
Propagation delay Distance divided by the speed of signal in the medium (about 2/3 c in fiber) Only by moving closer. Physics sets a floor.
Transmission (serialization) delay Time to clock the bits onto the wire: packet size / link rate Faster links, smaller packets
Processing delay Routers and firewalls inspecting and forwarding Better hardware, fewer hops, less deep inspection
Queuing delay Packets waiting in buffers behind other packets QoS, less congestion, smaller buffers (bufferbloat)

How it is calculated

RTT is simply the timestamp when a reply arrives minus the timestamp when the probe was sent:

RTT = t_reply_received  -  t_probe_sent

One-way delay = propagation + transmission + processing + queuing
             = (distance / signal_speed)
             + (packet_bits / link_rate_bps)
             + processing
             + queuing

A worked propagation example: fiber from New York to Los Angeles is roughly 4,500 km of cable. Light in fiber travels about 200,000 km/s. That is 4,500 / 200,000 = 22.5 ms one way, or about 45 ms RTT, before you add a single router. No upgrade will ever beat that number; it is the speed of light in glass.

The analogy

Latency is how long your car takes to drive from your house to the office and back. It does not matter how many lanes the road has: one car still takes the same time to make the trip. Propagation delay is the length of the road. Queuing delay is sitting at red lights and in traffic. Processing delay is slowing down for every toll booth. A wider road (more bandwidth) does not make your single trip any faster, which is why a gigabit link to a server on another continent still feels slow.

Jitter

What it means

Jitter is the variation in latency from one packet to the next. If every packet takes exactly 40 ms, latency is 40 ms and jitter is zero. If packets arrive at 40, 55, 38, and 60 ms, the average latency is fine but the jitter is high, and that is what wrecks a voice or video call. Real-time apps hide jitter with a jitter buffer: they hold incoming packets for a few milliseconds so they can play them out at a steady rate. When jitter exceeds the buffer, packets arrive too late to use and are discarded, which shows up as choppy audio.

How it is calculated

The simple version is the mean absolute difference between consecutive one-way delays. RFC 3550 (RTP) defines the running estimate that most VoIP systems actually use, which smooths each new sample into the estimate:

Simple jitter = average( | delay[i]  -  delay[i-1] | )

RFC 3550 running estimate:
  D       = (R[i] - R[i-1]) - (S[i] - S[i-1])
  J[i]    = J[i-1] + ( |D| - J[i-1] ) / 16

where S = sender timestamp, R = receiver timestamp,
and 1/16 is the smoothing gain.

Worked example of the simple form: delays of 40, 55, 38, 60 ms give consecutive differences of 15, 17, 22. The mean is 18 ms of jitter, right at the edge of acceptable for a call.

The analogy

You and your coworkers all leave home at perfectly even five-minute intervals. Jitter is whether you arrive at the office evenly spaced or in clumps. If traffic bunches some of you together and strings others out, people show up at random, and the receptionist (the jitter buffer) has to hold early arrivals in the lobby to send everyone in at a steady pace. If someone is so late they miss the meeting entirely, that is a packet dropped by the jitter buffer.

Packet Loss

What it means

Packet loss is the percentage of packets sent that never arrive. Causes include congestion (a full buffer has nowhere to put the packet, so it is dropped), bit errors on a bad link or optic, and policing that deliberately drops traffic over a rate. How much it hurts depends entirely on the protocol. TCP treats loss as a congestion signal, retransmits the data, and slows down, so a file transfer survives loss but gets slower. UDP voice and video have no retransmit, so a lost packet is simply gone, heard as a glitch.

How it is calculated

Packet loss %  =  ( packets_sent - packets_received )
                  / packets_sent  x  100

Example: 1000 sent, 985 received
       = (1000 - 985) / 1000 x 100
       = 1.5% loss

One subtlety: loss is rarely spread evenly. Ten lost packets in a row (a burst, often from a buffer overflowing all at once) sound far worse on a call than ten single losses spread across a minute, even though both report the same percentage. This is why loss alone never tells the whole story; you want the pattern too.

The analogy

Some cars leave your house and never reach the office. They ran out of gas, took a wrong turn, or the highway patrol pulled them over at a checkpoint (policing). For a file transfer (TCP), the office notices a car is missing and phones you to send a duplicate, so the data still gets there, just later. For a live phone call (UDP), there is no callback: whatever was in that car is lost, and you hear a gap in the conversation.

Throughput, Bandwidth, and Goodput

What they mean

These three get used interchangeably and they should not be. Bandwidth is the theoretical maximum capacity of the link, what you provisioned. Throughput is how much data actually gets through per second under real conditions. Goodput is throughput minus all the overhead: protocol headers, retransmissions, and acknowledgements, so it is the useful application data only. You always have bandwidth >= throughput >= goodput.

How it is calculated

Throughput (bps) = bits_transferred / seconds

Goodput (bps)    = application_bytes x 8 / seconds
                   (headers and retransmits excluded)

TCP's throughput ceiling is also bounded by latency:
  Max throughput  <=  TCP_window_size / RTT

That last formula is the one people forget. A single TCP flow cannot send more than one window of data per round trip. With a 64 KB window and 100 ms RTT, the ceiling is about 5.2 Mbps no matter how much bandwidth you bought. This is the bandwidth-delay product, and it is why long-distance transfers need large TCP windows to go fast.

The analogy

Bandwidth is the number of lanes on the highway. Throughput is how many cars actually reach the office each hour. Goodput is how many of those cars were carrying real passengers rather than paperwork and empty escort vehicles. You can have a ten-lane highway (high bandwidth) that still moves few passengers per hour because everyone is stuck at a red light far away (high latency throttling TCP), or because half the vehicles are overhead.

One More for Voice: MOS

For voice specifically, latency, jitter, and loss get rolled into a single score called MOS (Mean Opinion Score), from 1 (unusable) to 5 (perfect). It was originally humans rating call quality; now tools estimate it from the metrics using the ITU E-model (which produces an R-factor that maps to MOS). A MOS of 4.0 or above is good, 3.5 is the floor most people tolerate, and below 3.0 users start complaining. It is a handy single number to alert on, but when it drops you still go back to the three metrics underneath it to find out why.

MOS Quality User reaction
4.3 to 5.0 Excellent Sounds like a landline
4.0 to 4.3 Good Normal business call
3.5 to 4.0 Fair Noticeable but usable
3.0 to 3.5 Poor People ask you to repeat
< 3.0 Bad “You’re breaking up”

Measuring Them Yourself

You do not need expensive gear to see all four. These are the quick ones.

Latency and loss: ping

ping -c 100 8.8.8.8
--- 8.8.8.8 ping statistics ---
100 packets transmitted, 99 received, 1% packet loss
rtt min/avg/max/mdev = 11.4/14.2/28.9/2.7 ms

Read it like this: avg is your latency, 1% packet loss is your loss, and mdev (mean deviation) is a rough stand-in for jitter. One command, three metrics.

Jitter and MOS: a real stream

Ping‘s mdev is only an approximation. For true jitter you need a UDP stream that timestamps every packet, which is what iperf3 does:

# On the server
iperf3 -s

# On the client: 60s UDP test at 5 Mbps
iperf3 -c 10.0.20.10 -u -b 5M -t 60
[ ID] Interval      Transfer  Bitrate    Jitter   Lost/Total
[  5] 0.00-60.00 s  35.8 MBytes 5.00 Mbps 0.412 ms  3/25600 (0.012%)

Throughput: iperf3 over TCP

iperf3 -c 10.0.20.10 -t 30

The final receiver line is your real throughput. Compare it to what you provisioned; a big gap points at latency (check the bandwidth-delay product), loss, or a duplex mismatch.

On a FortiGate

# Latency and loss per SD-WAN member, continuously
diagnose sys sdwan health-check status

# One-off reachability and RTT from the firewall itself
execute ping-options repeat-count 20
execute ping 8.8.8.8

FortiGate SD-WAN health-checks measure latency, jitter, and packet loss on every member link on a schedule, which is exactly these metrics turned into link-selection decisions. That is the whole point of an SLA rule: send voice down the member whose jitter and loss are inside the threshold.

How They Interact (the Gotchas)

1. Low latency does not mean low jitter

A link can average a healthy 20 ms and still ruin calls if that 20 ms swings between 5 and 90. Averages hide variation. Always look at jitter and the max, not just the average latency.

2. Bandwidth does not fix latency

The most common mistake: a user complains that something is slow, so someone buys more bandwidth, and nothing changes. If the bottleneck is latency (a distant server, or TCP capped by the bandwidth-delay product), extra lanes on the highway do nothing for a single car’s trip time. Measure first.

3. A little loss plus TCP equals a lot of slow

Because TCP backs off hard on loss, even 1 to 2% loss can cut throughput dramatically over a high-latency path. The loss number looks small, the throughput impact is huge. This is why a “1% loss” link can feel broken for large transfers while a voice call on the same link sounds only slightly rough.

4. Bufferbloat: the hidden latency under load

A link can ping at 15 ms when idle and 300 ms the moment you start an upload, because oversized buffers queue packets instead of dropping them. Test latency while the link is busy, not just when it is quiet, or you will miss it entirely.

Warning: Measure under load, not at rest

Every one of these metrics changes when the link is busy. A test on an idle link tells you the best case, not the case your users actually hit at 10 a.m.

Quick Reference

Metric Formula Measure with Good target
Latency (RTT) t_reply – t_sent ping, execute ping < 50 ms WAN, < 1 ms LAN
Jitter avg |delay[i] – delay[i-1]| iperf3 -u, RTP stats < 30 ms
Packet loss (sent – recv) / sent x 100 ping, iperf3 < 1%, < 0.1% voice
Throughput bits / seconds iperf3 Near provisioned
MOS E-model from the three above VoIP monitor, probe >= 4.0

Related Links

Recent posts

  • If you've spent any time configuring user authentication on... Full Story

  • DNS is one of those technologies that quietly underpins... Full Story

  • BGP issues on FortiGate firewalls usually trace back to... Full Story

  • Every time your laptop talks to your router, a... Full Story

  • If you've spent any time configuring NAT on a... Full Story

  • If you have spent any time configuring firewall policies... Full Story

  • High availability on FortiGate is one of those features... Full Story

  • If you've configured SD-WAN on a FortiGate, you've almost... Full Story

  • FortiLink is the management protocol that turns a FortiSwitch... Full Story

  • FortiSwitches are pretty rock solid from Mean Time Between... Full Story

  • This is a quicky tip.  Have you ever gone... Full Story

  • DNS is one of those quiet pieces of internet... Full Story

  • This article is an updated version of the previous... Full Story

  • You will add ns2 as a secondary (slave) BIND9... Full Story

  • In the process of deploying my lab, I needed... Full Story

  • RFC 8805, used to be known as Self-Correcting IP... Full Story

  • Years back, I wrote an article about certificate pinning. ... Full Story

  • FortiGates have the ability to send alerts to Microsoft... Full Story

  • In this post, I am going to walk through... Full Story

  • Troubleshooting VoIP on a FortiGate can feel like trying... Full Story

  • Prior to FortiOS 7.0, there were three commands to... Full Story

  • In this post, I am going to go over... Full Story

  • What we are going to do:  We are going... Full Story

  • Choosing between FGCP (FortiGate Clustering Protocol) and FGSP (FortiGate... Full Story

  • Creating a VLAN on macOS (The "Pro" Move) A... Full Story

  • This blog post explores the logic behind how macOS... Full Story

  • Pretty Fly for a Wi-Fi Tell My Wi-Fi Love... Full Story

  • Part of my daily gig is creating BoMs (Bill-of-Materials)... Full Story

  • ICMP introduces several security risks, but careful filtering, rate... Full Story

  • The command diag debug application dhcps -1 enables full... Full Story

  • In the world of FortiOS, execute tac report is... Full Story

  • LLDP; What is it The Link Layer Discovery Protocol... Full Story

  • What it actually does When you run diagnose fdsm... Full Story

  • Monkey Bites are bite-sized, high-impact security insights designed for... Full Story

  • I have run macOS in macOS with Parallels but... Full Story

  • Don't be confused with my other FortiNAC posts where... Full Story

  • This is the third session in a multi-part article... Full Story

  • Today I was configuring key-based authentication on a FortiGate... Full Story

  • Netcat, often called the "Swiss Army knife" of networking,... Full Story

  • At its core, IEEE 802.1X is a network layer... Full Story

  • In case you did not see the previous FortiNAC... Full Story

  • This is our 5th session where we are going... Full Story

  • Now that we have Wireshark installed and somewhat configured,... Full Story

  • The Philosophy of Packet Analysis Troubleshooting isn't about looking... Full Story

  • No fluff. Just the config that works. The /31... Full Story

  • A practitioner guide to arp-scan network discovery on Linux... Full Story

  • CVE-2026-0322 PAN-OS Management Interface RCE: Patch, Lock Down, Hunt... Full Story