Case study 02 / Network diagnostics

Network Diagnostics
Suite

A privacy-first measurement system spanning the browser, a cross-platform desktop application, and a scriptable command-line probe.

Launch tool Technical report

View source on GitHub

Role: Architecture and implementation
Clients: Browser · Desktop · CLI
Native stack: .NET 10 · Photino + React
Status: Active · Public source

The problem

A single download number can look healthy while calls stall, games spike, or uploads make the connection unusable.

The browser measures idle and loaded latency, request failures, throughput stability, and the difference between one connection and several parallel connections.

Native clients add evidence a webpage cannot collect honestly: ICMP packet loss, gateway latency, traceroute, resolver timing, path MTU, interfaces, routes, Wi-Fi, protocol phases, and isolated LAN throughput.

Three clients, one model

BrowserImmediate measurement
First-party transfer, responsiveness under load, request loss, connection scaling, and endpoint evidence.
DesktopNative workbench
Connection Check, Quick, Full, and Stress with passive monitoring and deep operating-system and local-network views.
CLIScriptable probe
Repeatable diagnostics, optional Internet transfer, interface selection, and two-machine LAN testing.
ReportCompatible evidence
Schema 2.0 combines plans, context, measurements, findings, and optional native or LAN sections.

Measurement plans

Check

Low-data first diagnosis

A native 15-second path with a 28 MB maximum combined transfer and no deep operating-system diagnostics.

Quick / Full

Known scope before starting

Each profile exposes its time estimate, transfer ceiling, connection count, and optional checks.

Compare

Independent transfer methods

Single and aggregate stages run separately so their results do not compete with one another.

Stress

Connection scaling, not one peak

Download stages at 1, 2, 4, 8, and 10 connections show how the path responds to parallelism.

Engineering decisions

Labels match the observed layer

Browser request loss is not called packet loss, and unavailable native evidence is not guessed.

Steady behavior stays visible

Whole-phase rate, steady rate, stability, ramp behavior, lifecycle counts, and loaded delay remain separate.

The endpoint is part of the result

Candidate selection, edge, network, protocol, TLS, IP version, and interface scope accompany throughput.

Privacy through minimization

No accounts, analytics, advertising, telemetry, project result database, or native-report upload path.

M-Lab benchmark investigation

A large gap with Google’s M-Lab test became an investigation into the project’s own delivery path.

Upload results were already close, but early browser downloads could report roughly half the M-Lab result. Research into NDT7 showed a single long-lived WebSocket flow to a nearby measurement server with BBR where available and server-side TCP instrumentation.

A direct R2-versus-Worker A/B test then showed the project’s Worker stream materially limiting download delivery. The browser adopted validated direct range delivery, retained the Worker as a fallback and comparison, and expanded transport evidence rather than adding connections merely to produce a larger number.

Read the full investigation

Evidence over feature count

~½early browser download vs M-Lab

3compatible clients

5native build targets

0project-retained results

The useful result was not hiding the initial discrepancy. The project isolated a delivery-path bottleneck, changed the architecture based on an A/B test, and preserved the comparison path so future measurements can distinguish endpoint delivery from the access network being measured. Shared contracts and TypeScript/C# parity fixtures keep findings aligned across clients.

Native core

Deeper evidence belongs in a native engine, not behind browser-shaped approximations.

NetworkDiagnostics.Core owns planning, endpoint selection, Internet transfer, ICMP, routes, DNS, MTU, TLS, interfaces, Wi-Fi, LAN testing, findings, capability reporting, and serialization.

Photino.NET hosts a React + TypeScript workbench on Windows, macOS, and Linux and bridges it to the shared .NET engine. The command-line probe preserves scriptable deep diagnostics and can opt into the same Internet-transfer plans when needed.

Privacy and limits

No retained result does not mean invisible traffic.

Cloudflare still processes requests sent to the default endpoints. Full and Stress service checks contact the named providers. User-supplied endpoints and LAN targets remain outside the project’s trust boundary.

Every result describes one device, software stack, route, endpoint, and moment. VPNs, Wi-Fi contention, security software, power saving, browser scheduling, and background traffic can all affect a run. Repeated comparisons are more useful than one permanent rating.

Next project

Routing failure,
measured.

Read OSPF resiliency case study

Network DiagnosticsSuite