Log Ping Results Over Time

How to Log Ping Results Over Time and Graph Them in Excel

The internet drops out for a minute, a video call freezes, a game lags, and by the time you open a Command Prompt it is fine again. You ring your ISP and they run a line test, which passes, because the line is working while they test it. What you need is a record: every few seconds, for hours, how long a reply took and whether one came back at all, with the time against each one.

This article shows how to collect that record with a ping logger, what to ping so the log tells you where the problem is, and how to turn the log into a graph in Excel. It also looks at the Windows API doing the pinging, because two of its defaults are not what the documentation says.

Checked on Windows 10 Pro 22H2 in November 2026.

Why ping -t Is Not Enough

ping -t 8.8.8.8 pings until you stop it, but each line has no time on it, so a burst of Request timed out cannot be matched to the moment the call dropped. Redirecting it to a file with > does not add times either, and the totals only appear when you press Ctrl+C. It is fine for watching a connection while you fiddle with it, not for leaving overnight.

If you want a quick log with nothing to download, Windows PowerShell 5.1 can do it in one line. It writes the time and the reply in milliseconds every 15 seconds, and leaves the reply blank when nothing came back:

while ($true) { $r = Test-Connection 8.8.8.8 -Count 1 -ErrorAction SilentlyContinue
  '{0:yyyy-MM-dd HH:mm:ss},{1}' -f (Get-Date), $r.ResponseTime | Add-Content ping.csv
  Start-Sleep 15 }

That covers the basic case. A dedicated tool earns its place when you want several pings per sample averaged, a count of how many were lost, a fixed schedule however long the pings take, a larger packet size, or a run that stops by itself after a set number of hours.

Ping_Log

Ping_Log is our free command line tool for exactly this. It sends a cluster of pings at a fixed interval and writes one line per cluster to a CSV file:

Ping_Log [Options] Address

/Cnn  = Ping nn times in a Cluster (default 1)
/CAnn = Ping nn times in a Cluster and log the Average
/Rnn  = Start a Cluster every nn seconds (default 5)
/Fnn  = For nn hours (default until Enter is pressed)
/Bnn  = Buffer Size in bytes (default 32)
/S    = Silent Mode (default Verbose)
/Oxx  = Output to File xx (default none)

The log has a header row and three columns:

Time,Response_Ms,Lost
"2026-11-07 09:14:47",31,0
"2026-11-07 09:15:02",22,0
"2026-11-07 09:15:17",,4

• Time - the PC's local time when the cluster finished
• Response_Ms - the average reply time with /CA, otherwise the last reply in the cluster. It is blank when every ping in the cluster was lost
• Lost - how many pings in the cluster got no reply

A 0 is a real reply in under a millisecond, which is normal for a router on your own network, so a blank and a zero never mean the same thing. Each line is written as soon as its cluster finishes, so the log survives a crash or a power cut up to the last sample.

Ping Your Router and the Internet at the Same Time

A single log tells you the connection dropped. Two logs side by side tell you which part of it dropped. Run one against your own router and one against a reliable address out on the internet, at the same time:

1. Find your router's address. Run ipconfig and look for Default Gateway, usually something like 192.168.1.1.
2. Open two Command Prompts in the folder holding Ping_Log, and run one command in each:

   Ping_Log /ca4 /r15 /f12 /oRouter.csv 192.168.1.1
   Ping_Log /ca4 /r15 /f12 /oInternet.csv 8.8.8.8

   Each sends 4 pings every 15 seconds for 12 hours and logs their average and how many were lost.
3. Stop the PC sleeping while it runs. In Settings, System, Power & sleep, set Sleep to Never when plugged in. A sleeping PC logs a gap that looks exactly like an outage.

Then read them together:

• Both logs lose pings at the same moments - the problem is between the PC and the router: Wi-Fi interference, a weak signal, a bad cable or the router itself. Your ISP is not the cause. Try a cable instead of Wi-Fi to confirm.
• Only the internet log loses pings - the router answered, so the local network is fine. The problem is the router's connection to the ISP or the ISP itself. This is the log to send them.
• No losses, but the internet times climb in the evening - congestion, either on your connection because someone is uploading or streaming, or in the ISP's network at peak time.
• Spikes at the same minute every hour - something scheduled: a backup, a cloud sync, or an update check on the same PC.

Pinging a single address can mislead if that address has a problem of its own, so for a long dispute with an ISP run a third log against a different provider, such as 1.1.1.1. Busy public servers may also answer pings at a lower priority than real traffic, so an occasional single lost ping is not a fault; what matters is several in a row.

If the connection drops only under load, or a VPN or game misbehaves while ordinary web pages work, repeat the run with larger packets, for example /b1400. A link that handles 32-byte pings but loses big ones points to a marginal line or a packet size problem.

Graph the Log in Excel

1. Double-click the .csv file. Excel opens it and recognises the date column.
2. Select columns A and B, then Insert, Charts, Line.
3. Right-click the chart, choose Select Data, then Hidden and Empty Cells, and make sure Gaps is chosen. Every outage now shows as a break in the line.
4. To show the losses too, copy column C into the chart, right-click the new series, choose Change Series Chart Type and make it a Clustered Column on the Secondary Axis.
5. To graph two logs together, paste the second log's Response_Ms column next to the first and add it as another series. Both were started together with the same interval, so the rows line up closely enough to compare.

For the numbers your ISP will ask for, =AVERAGE(B:B) and =MAX(B:B) give the average and worst reply times, =SUM(C:C) the pings lost, and =COUNTBLANK(B2:B2881) the samples where nothing came back at all.

How Ping_Log Pings - Win32_PingStatus

Ping_Log does not run ping.exe or open a raw socket. It asks Windows Management Instrumentation (WMI) to do the ping, through the Win32_PingStatus class. A ping is a WQL query, and the reply comes back as the single row it returns:

SELECT * FROM Win32_PingStatus
 WHERE Address='8.8.8.8' AND BufferSize=32 AND Timeout=4000

In Delphi that is a few lines of COM, connecting once at the start and running the query once for every ping:

Locator     := CreateOleObject ('WbemScripting.SWbemLocator');
WMI_Service := Locator.ConnectServer ('localhost', 'root\CIMV2', '', '');

Replies := WMI_Service.ExecQuery (Format (fmt_WMI_Query,
             [QuotedStr (Address), Buffer_Size, Ping_Timeout_Ms]), 'WQL', 0);
Enum    := IUnknown (Replies._NewEnum) as IEnumVariant;
if Enum.Next (1, Reply, Fetched) = S_OK
then if Reply.StatusCode = 0
     then Record_Reply (Reply.ResponseTime);

The properties that matter are:

• StatusCode - 0 for a reply. Anything else is a failure, such as 11010 Request Timed Out or 11003 Destination Host Unreachable. It is null when the ping could not be sent at all, for example when the host name does not resolve
• ResponseTime - the round trip in milliseconds
• ReplySize and ProtocolAddress - the size of the reply and the address that sent it
• ResponseTimeToLive - the TTL of the reply, the figure ping.exe shows

Two details are easy to get wrong:

• TimeToLive is not the reply's TTL. It is the TTL of the ping you sent, and on the Windows 10 PC we tested it read 128. The reply's TTL is ResponseTimeToLive. Against 8.8.8.8 the two came back as 128 and 115.
• The default timeout is not 1 second. Microsoft's documentation gives the default Timeout as 1000 milliseconds, but on Windows 10 an unanswered ping took 3.8 seconds to fail and the returned row reported a Timeout of 4000, the same as ping.exe. With Timeout=1000 in the query it failed in 1.0 seconds. Ping_Log sets 4000 explicitly, so the behaviour does not depend on which you get.

Why use WMI rather than IcmpSendEcho from iphlpapi.dll, the API ping.exe itself uses? WMI needs no administrator rights, takes a host name, an IPv4 or an IPv6 address in the same field, and is available from any language that can talk to COM, including a script. The cost is overhead: each ping is a query through the WMI service, a few milliseconds of extra work for the PC, though not added to the reply time. At one cluster every few seconds that does not matter; for hundreds of pings a second, IcmpSendEcho is the better choice.

It is also what Windows PowerShell 5.1 uses. Test-Connection there is a wrapper around Win32_PingStatus and hands back the same objects, which is why the one-liner earlier reads ResponseTime. PowerShell 7 rewrote Test-Connection on the .NET Ping class, so the property names differ there.

Summary

• Log - time, reply in ms and pings lost, every 15 seconds, for hours
• Ping two places - the router and the internet together, so the log shows whether the fault is at home or at the ISP
• Keep the PC awake - a sleeping PC looks like an outage
• Graph it - a line chart with empty cells shown as gaps, losses as columns on a second axis
• Underneath - WMI's Win32_PingStatus, where the reply's TTL is ResponseTimeToLive and the timeout is best set explicitly

Download Ping_Log

Useful References

• Microsoft - Win32_PingStatus class
• Microsoft - IcmpSendEcho function
• Microsoft - Test-Connection (Windows PowerShell 5.1)
• Microsoft - ping command