Port 861 carries OWAMP-Control, the control channel for the One-Way Active Measurement Protocol. While most network measurement tools tell you round-trip time, OWAMP measures something more precise: how long it actually takes for a packet to travel from point A to point B, one direction at a time.
What OWAMP Does
OWAMP consists of two parts:1
- OWAMP-Control (TCP port 861) — Negotiates measurement sessions, configures test parameters, and retrieves results
- OWAMP-Test (UDP port 861) — Sends the actual measurement packets along the path being tested
The control protocol handles the setup. The initiator connects to port 861 on the target host and negotiates:2
- Sender and receiver addresses and ports
- Session start time and duration
- Test packet size
- Sampling interval (how often to send test packets)
- Security mode (unauthenticated, authenticated, or encrypted)
Once configured, the OWAMP-Test protocol sends measurement packets and the control connection retrieves the results.
Why One-Way Measurement Matters
Ping and most network tools measure round-trip time—how long it takes for a packet to go from your computer to a server and back. That's useful, but it hides something important: the Internet is asymmetric.
Packets traveling from A to B might take a completely different path than packets traveling from B to A. One direction might be fast. The other might be slow. Round-trip measurements average these together, obscuring what's actually happening.
OWAMP measures each direction independently. It tells you: this direction took 15 milliseconds, that direction took 47 milliseconds. Now you know where the problem is.
This matters for:
- Diagnosing asymmetric routing — When upload and download speeds feel different
- Measuring jitter and packet loss per direction — Video calls care about one-way delay
- Service level agreements — ISPs promise performance in both directions, not just round-trip
- Understanding differentiated services — Some traffic gets priority treatment in one direction but not the other
The History
OWAMP was developed because network operators needed better tools. RFC 3763 laid out the requirements in 2004.3 RFC 4656 published the full protocol specification in 2006.1
The protocol borrowed ideas from earlier measurement tools but formalized something crucial: synchronized clocks. To measure one-way delay accurately, both endpoints need to agree on what time it is. OWAMP handles clock synchronization as part of the protocol, typically using NTP (Network Time Protocol) or GPS.
In 2019, RFC 8545 clarified the port assignments,4 ensuring OWAMP-Control and OWAMP-Test both use port 861 (TCP for control, UDP for test packets).
OWAMP later inspired TWAMP (Two-Way Active Measurement Protocol), which measures in both directions simultaneously and uses ports 862 and 863.
Security
OWAMP supports three modes:1
- Unauthenticated — No security, useful for public measurement beacons
- Authenticated — Verifies identity, prevents spoofing
- Encrypted — Full encryption of control and test traffic
The control connection on port 861 negotiates which mode to use at the start of the session. This lets OWAMP work in public Internet measurement scenarios (like PerfSONAR nodes) while still supporting secure deployments inside corporate networks.
Related Ports
- Port 862 — TWAMP-Control, the two-way measurement protocol
- Port 862/UDP — OWAMP-Test can use this as an alternate port
- Port 123 — NTP, critical for the clock synchronization OWAMP depends on
Common Uses
You'll find OWAMP running on:
- PerfSONAR nodes — The Internet2 network measurement infrastructure
- Research networks — Universities and national research networks measuring performance
- ISP monitoring systems — Service providers tracking SLA compliance
- Data center operators — Measuring asymmetric latency between facilities
If you see port 861 open on a host, it's likely part of a network performance monitoring deployment.
Checking What's Listening
On Linux or macOS:
On Windows:
To test if a host is running OWAMP-Control:
If the connection succeeds, an OWAMP server is listening. The protocol has a specific handshake, so you won't see readable text—just the initial connection.
Frequently Asked Questions
Esta página foi útil?