Case study 03 / Network diagnostics

Network Diagnostics
Suite

A privacy-first connection-quality test that pairs browser measurements with an optional Windows 11 deep probe.

Launch tool View source

Role: Architecture and implementation
Web stack: React · TypeScript · Cloudflare Workers
Local probe: .NET 10 · Windows 11 x64
Status: 44 tests · Public source

The problem

A single download number can look healthy while calls stall, games spike, or uploads make the connection unusable.

This project measures the connection under three conditions: idle, saturated download, and saturated upload. It reports the distribution instead of hiding it behind one average.

The design also separates what a browser can honestly observe from what requires operating-system access. Browser timeouts remain request loss; only the local probe reports raw packet loss.

Two measurement layers

BaselineIdle distribution
Mean, median, minimum, maximum, 95th percentile, jitter, and browser request timeouts.
LoadThroughput + delay
Parallel transfers run while latency sampling continues in each direction.
ReachService battery
Optional, credential-free checks distinguish broad connectivity from one test edge.
ProbeOperating-system path
Internet Control Message Protocol loss, route, DNS, gateway, MTU, TCP, and TLS timing.

Test profiles

Quick

Core signal in about 15 seconds

Up to 100 MB down and 32 MB up, without contacting the optional common-service targets.

Full

Longer sampling and reachability

Up to 300 MB down and 96 MB up, followed by six clearly named service checks.

Stress

Fast-link sustained load

Higher caps expose longer queueing behavior and require explicit acknowledgement before starting.

Local

Importable deep report

The Windows probe writes JSON locally; the dashboard parses it in the tab without uploading the file.

Engineering decisions

Distributions over a headline

Mean, median, tails, jitter, and failures stay visible because each answers a different quality question.

Loaded latency in both directions

Download and upload saturation are tested separately so queueing pressure is attributable.

Labels match the observed layer

HTTP request loss is not called packet loss, and opaque browser reachability is not presented as server processing time.

Privacy through minimization

No accounts, analytics, cookies, result database, remote fonts, or deep-report upload path are present.

Validation

44automated tests

3load conditions

6service targets

0retained results

GitHub Actions type-checks and builds the web application, validates the Cloudflare Worker bundle, runs the .NET test suite, and publishes a self-contained Windows 11 x64 executable. The first complete run passed all three jobs.

Windows deep probe

Some network questions are deliberately kept outside the browser.

The local probe adds Internet Control Message Protocol (ICMP) packet loss, three samples per traceroute hop, default-gateway latency, direct Domain Name System (DNS) resolver timing, IPv4 path Maximum Transmission Unit (MTU), and separate DNS, Transmission Control Protocol (TCP), and Transport Layer Security (TLS) phases.

Private and link-local hops are redacted by default. Local interface, gateway, and resolver addresses appear only with an explicit command-line option.

Privacy and limits

No retained result does not mean invisible traffic.

Cloudflare still processes requests needed to serve the application. Full and Stress profiles contact the six named services, which may process those requests under their own policies. Quick mode avoids that battery.

Results describe one device, browser, route, edge, and moment. VPNs, Wi-Fi contention, endpoint security, browser scheduling, and test infrastructure can all affect a run, so repeated comparisons are more useful than treating one result as a permanent rating.

Next project

Reliability above UDP,
made visible.

Read UDP transport case study

Network DiagnosticsSuite