← How It Works

Probes — how WiFi Monitor measures your connection

One capture runs two kinds of probe at once. Continuous probes (ICMP, UDP, QUIC, DNS…) tick the whole time — lightweight, meant to overlap everything and catch every latency spike and outage. Scheduled probes (speed tests, video quality) are bandwidth-intensive, so the wave scheduler spaces them into non-overlapping rounds that never contend for the link. This page is generated from the shipping scheduler (scheduler.py) — every number below is what the tool actually runs.

Link type
Profile

30-minute measurement cycle

Two tiers, moderated differently

Scheduled probes split into flood (speed tests — they saturate the link, so they're kept sparse and spaced to leave the latency probes clean unloaded windows) and user interaction (video / CDN traffic — dense is fine because it mimics a real passenger and doesn't saturate). The link tier is the continuous probes running underneath everything.

What a 5 / 10 / 30-minute capture gets

Whenever a capture ends, has it collected the most useful set? Short captures drop rounds from the end, so a longer capture is a strict superset. GEO probes cost more, so the same capture length collects fewer rounds on satellite than on a fast terrestrial link.

CaptureGEO satelliteTerrestrial / LEO

The probes in detail

Scheduled probes — bandwidth-intensive, run in rounds

Speed test (Cloudflare)

Download and upload speed via multi-stream HTTP transfers — it saturates the link (like Ookla) to measure true capacity. The primary backend is our self-hosted Cloudflare Worker (zero egress cost, no rate limiting); it falls back to speed.cloudflare.com, then to Akamai when shared satellite NAT IPs trip per-IP rate limits. On GEO the test runs longer (~15 s) so the high-latency link has time to reach steady state.

Akamai speed test

A second speed test on a different CDN (dash.akamaized.net). Running it alongside the Cloudflare test cross-validates capacity and exposes per-CDN shaping — an airline may cap one CDN while another runs clear on the same link, which a single backend would never reveal.

Netflix OCA

Download throughput from the same Netflix Open Connect servers that serve real Netflix video, mapped to a streaming resolution tier — so it answers a question users actually have: would Netflix play in HD here? It surfaces per-CDN rate limiting directly: Netflix may be capped at 2.3 Mbps on GEO while Cloudflare sees 10+ Mbps on the same link.

YouTube segment

yt-dlp resolves a video's DASH/HLS manifest, then downloads four real media segments and times each — reporting achievable bitrate, time-to-first-byte, CDN host, codec, and a recommended resolution. Fast and dependency-free, it runs on every YouTube slot (no Chromium needed) and is the data behind the "Recommended quality" chip on the results page.

YouTube ABR

When Chromium is installed, this launches a real headless YouTube player in two phases: AUTO (let YouTube's own algorithm pick the quality on this link) and FORCED (ask for the resolution the segment probe said should work, and see what actually happens). It captures real startup latency no throughput test can — and when the segment probe says 1080p but ABR locks to 480p, the platform is throttling the player itself.

YouTube Shorts

Drives a real headless Shorts feed — swiping through short-form clips and reading comments — to measure the rebuffering and quality a passenger sees on the format they actually use most. Two flavors: a standard ~3-min session, and a Deep ~6-min round ( on GEO; varying swipe cadence, comments read twice) that stress-tests sustained short-form playback. The stall-based quality verdict is withheld until it's validated on a real flight.

Continuous probes — lightweight, run the whole capture

ICMP ping

Base round-trip time and packet loss — the most fundamental measurement, an echo request/reply with no application-layer overhead. A gateway ping runs alongside to separate a local Wi-Fi problem from an internet-path one, and two internet targets guard against one being rate-limited.

UDP / DNS

A real UDP round-trip via a minimal DNS query — a second latency and loss signal independent of ICMP. PEPs don't repair UDP loss, so this stays honest on GEO where TCP and ICMP loss are masked. UDP loss, RTT, and jitter feed the Voice MOS estimate.

TCP connect

Times a TCP three-way handshake to port 443. This is the key detector for TCP Performance Enhancing Proxies: airlines deploy transparent proxies that answer with a local SYN-ACK, making TCP look far faster than the real satellite round-trip. A large ICMP-vs-TCP gap is the PEP signature.

QUIC handshake

A full UDP + TLS 1.3 / HTTP-3 handshake. Because QUIC is UDP, a TCP PEP can't intercept it — so QUIC RTT reveals the true path latency the proxy hides. It's also increasingly the protocol passengers actually use: YouTube, Google, and Cloudflare all default to HTTP/3.

The iPhone and Android apps run QUIC on its own timer at the Active cadence shown here (the apps have no separate Passive/background profile). On a degraded satellite link some UDP:443 handshakes genuinely time out, so QUIC keeps a minimum attempt floor (about one sweep every ~15s) rather than backing off — coverage thins but never stops.

HTTP HEAD

Full-stack latency — DNS + TCP + TLS + request/response — which is what you actually feel loading a page. Canary targets and response-header inspection also expose intercepting proxies along the path.

DNS resolve

End-to-end resolution time as applications experience it, via the system resolver — so it includes real OS DNS-cache effects rather than a synthetic lookup.

Traceroute

The full network path — every router hop with per-hop latency. Path changes correlate with performance changes; on satellite a path change can flag a beam handover or gateway switch, and the hop count itself is informative (satellite links show few hops).

Wi-Fi signal

RF and PHY-layer metrics from the adapter — RSSI, noise floor, SNR, channel, width, band, PHY mode, TX rate. Correlating signal with performance separates RF problems from network problems: a latency spike with an RSSI drop is local; one without points upstream.

Observed bytes

Passively reads the network interface's byte counters to track how much real traffic is flowing over the link. It sends nothing itself — it's context for how loaded the link was when each active probe ran.

Advanced — round composition & drop-from-end trimming

Round composition & cost

Each round's duration is the sum of its probe durations for the selected link. The heaviest round is tagged on GEO (the binding link).

RoundProbesDuration

Rounds that fit, by capture length

Drop-from-end trimming: a capture keeps as many leading rounds as fit its budget (after one-time calibration), then stops.

CaptureGEOTerrestrial / LEO