mirror of
https://github.com/Horizontal42/netsleuth.git
synced 2026-11-10 15:42:10 +03:00
bc8482cc99
Stayed unprivileged on both platforms deliberately. Windows: echo_once() gained a df: bool param setting IP_FLAG_DF on the IP_OPTION_INFORMATION struct's Flags field (present but unused until now), and classify_status() learned IP_PACKET_TOO_BIG (11009) - the same unprivileged IcmpSendEcho2 API the rest of the ICMP tier already uses, no new capability needed. Unix deliberately does not hand-roll raw ICMP echo requests - unprivileged SOCK_DGRAM/IPPROTO_ICMP checksum and identifier handling varies enough across kernel versions that shipping it without a Linux/macOS box to verify on felt like the wrong risk to take. Shells out to system ping -M do -s <size> (Linux) / ping -D -s <size> (macOS/BSD) instead, the same subprocess-and-parse pattern traceroute.py's system tiers already use. Matches "frag"/"too long" loosely in the output rather than an exact phrase, since a locally-cached-PMTU failure and a genuine on-path ICMP response word themselves differently across ping implementations - same "parse by shape" principle traceparse.py already established. classify_pmtu() distinguishes a path that's just narrower (a frag-needed signal was seen - PMTUD is working, normal behind a VPN) from an actual blackhole (large packets vanish with no ICMP reply at all - the "SSH connects then hangs" symptom). path.pmtu_below_iface_mtu flags separately when the path MTU is narrower than the local NIC's own MTU, which is exactly what makes this class of problem invisible locally. Opt-in --pmtud, excluded from --full. Live-verified on Windows against real cloudflare.com/google.com - found the full 1500-byte MTU in 11 probes each, matching the expected binary-search depth, correct probe history in the JSON output. Part of plans/zesty-zooming-wilkinson.md (gitignored).
186 lines
6.7 KiB
YAML
186 lines
6.7 KiB
YAML
timeouts:
|
|
http_seconds: 8.0
|
|
module_seconds: 30.0
|
|
speedtest_seconds: 90.0
|
|
dns_seconds: 4.0
|
|
subprocess_seconds: 60.0
|
|
|
|
probing:
|
|
reference_hosts:
|
|
- { label: "cloudflare-dns", host: "1.1.1.1" }
|
|
- { label: "google-dns", host: "8.8.8.8" }
|
|
- { label: "quad9-dns", host: "9.9.9.9" }
|
|
# Only probed when the host is dual-stack (auto), always (on), or never (off).
|
|
# Latency to these is measured alongside the IPv4 reference hosts, labeled
|
|
# "<label>-v6", so a report can compare the two stacks side by side.
|
|
reference_hosts_v6:
|
|
- { label: "cloudflare-dns", host: "2606:4700:4700::1111" }
|
|
- { label: "google-dns", host: "2001:4860:4860::8888" }
|
|
- { label: "quad9-dns", host: "2620:fe::fe" }
|
|
ipv6: "auto"
|
|
service_hosts:
|
|
- { label: "cloudflare", host: "cloudflare.com" }
|
|
- { label: "google", host: "google.com" }
|
|
- { label: "github", host: "github.com" }
|
|
ping_count: 20
|
|
quick_ping_count: 5
|
|
ping_interval_seconds: 0.25
|
|
ping_timeout_seconds: 2.0
|
|
mtr_cycles: 10
|
|
quick_mtr_cycles: 1
|
|
max_hops: 30
|
|
trace_concurrency: 2
|
|
|
|
speedtest:
|
|
enabled_tiers: ["ookla_bin", "cloudflare", "fastcom"]
|
|
download_sizes_bytes: [1000000, 10000000, 25000000]
|
|
upload_sizes_bytes: [1000000, 5000000]
|
|
cloudflare_base_url: "https://speed.cloudflare.com"
|
|
fastcom_api_url: "https://api.fast.com/netflix/speedtest/v2"
|
|
ndt7_locate_url: "https://locate.measurementlab.net/v2/nearest/ndt/ndt7"
|
|
bufferbloat_probe_interval_seconds: 0.2
|
|
|
|
providers:
|
|
cf_trace_url: "https://www.cloudflare.com/cdn-cgi/trace"
|
|
ip_api_url: "http://ip-api.com/json/"
|
|
freeipapi_url: "https://freeipapi.com/api/json/"
|
|
ipinfo_url: "https://ipinfo.io/"
|
|
ipwhois_url: "https://ipwho.is/"
|
|
ripestat_base_url: "https://stat.ripe.net/data"
|
|
asrank_url: "https://api.asrank.caida.org/v2/graphql"
|
|
peeringdb_base_url: "https://www.peeringdb.com/api"
|
|
internetdb_url: "https://internetdb.shodan.io/"
|
|
abuseipdb_url: "https://api.abuseipdb.com/api/v2/check"
|
|
cymru_origin_zone: "origin.asn.cymru.com"
|
|
cymru_origin6_zone: "origin6.asn.cymru.com"
|
|
cymru_asn_zone: "asn.cymru.com"
|
|
ripestat_max_rows: 200
|
|
ripestat_timeframe_days: 14
|
|
peeringdb_cache_hours: 24
|
|
firehol_refresh_hours: 24
|
|
firehol_netsets:
|
|
- "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset"
|
|
- "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset"
|
|
- "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_30d.netset"
|
|
|
|
dnsbl:
|
|
zones:
|
|
- "zen.spamhaus.org"
|
|
- "bl.spamcop.net"
|
|
- "b.barracudacentral.org"
|
|
- "dnsbl.dronebl.org"
|
|
|
|
thresholds:
|
|
latency_ms: { good: 40.0, warn: 100.0 }
|
|
jitter_ms: { good: 5.0, warn: 20.0 }
|
|
loss_pct: { good: 0.0, warn: 2.0 }
|
|
bufferbloat_ms: { a: 5.0, b: 30.0, c: 60.0, d: 200.0, e: 400.0 }
|
|
vpn_confidence: { likely: 0.40, confirmed: 0.75 }
|
|
tls_handshake_ms: { good: 100.0, warn: 300.0 }
|
|
ttfb_ms: { good: 200.0, warn: 800.0 }
|
|
dns_resolve_ms: { good: 30.0, warn: 120.0 }
|
|
prefix_spread_ms: { good: 20.0, warn: 80.0 }
|
|
tls_cpu_bound_ratio: 2.0
|
|
first_hop_ms: { good: 5.0, warn: 25.0 }
|
|
|
|
tls:
|
|
targets:
|
|
- { label: "cloudflare", host: "cloudflare.com" }
|
|
- { label: "google", host: "google.com" }
|
|
port: 443
|
|
concurrency: 4
|
|
ttfb_path: "/"
|
|
verify: true
|
|
# host -> expected SHA-256 of the full DER certificate (openssl x509 -outform DER
|
|
# | sha256sum). Colons/case are normalized. Capped at 32 entries in code.
|
|
pinned_fingerprints: {}
|
|
|
|
# Opt-in via --prefix-bench. Pings the first host of a handful of your own AS's
|
|
# announced prefixes to find the lowest-latency PoP. max_prefixes is capped at 256
|
|
# in code: this benchmarks a sample of your own network, not a mass scan of it.
|
|
prefix_bench:
|
|
max_prefixes: 32
|
|
ping_count: 3
|
|
concurrency: 8
|
|
host_offset: 1
|
|
family: 4
|
|
|
|
# Opt-in via --my-server <host>. Single-host self-diagnostic for provider port
|
|
# blocking/TCP RST injection. ports/concurrency are capped in code so this cannot
|
|
# become a range scanner: never point it at infrastructure you don't own.
|
|
dpi_check:
|
|
ports: [80, 443, 8443, 2083, 2096, 53]
|
|
connect_timeout_seconds: 3.0
|
|
delay_between_ports_seconds: 0.25
|
|
concurrency: 2
|
|
|
|
dns_advanced:
|
|
control_names: ["cloudflare.com", "example.com"]
|
|
doh_endpoints:
|
|
- { name: "cloudflare", url: "https://cloudflare-dns.com/dns-query" }
|
|
- { name: "google", url: "https://dns.google/resolve" }
|
|
- { name: "quad9", url: "https://dns.quad9.net:5053/dns-query" }
|
|
bogus_resolver_ip: "192.0.2.1"
|
|
bogus_probe_name: "cloudflare.com"
|
|
|
|
path_diversity:
|
|
targets:
|
|
- { label: "cloudflare", host: "cloudflare.com" }
|
|
- { label: "discord", host: "discord.com" }
|
|
max_targets: 3
|
|
|
|
# Runs first, before any other probe. Checks a handful of known generate_204-style
|
|
# endpoints for a redirect/tampered response, the classic signature of a public-wifi
|
|
# login wall. check_urls is capped at 4 in code.
|
|
# Opt-in via --pmtud. Binary-searches for the largest DF-set packet that gets
|
|
# through to each target, to catch a VPN/PPPoE-style PMTUD blackhole. targets is
|
|
# capped at 2 in code: this is a path-MTU sweep, not a scan.
|
|
pmtud:
|
|
targets:
|
|
- { label: "cloudflare", host: "cloudflare.com" }
|
|
- { label: "google", host: "google.com" }
|
|
min_bytes: 576
|
|
max_bytes: 1500
|
|
probe_timeout_seconds: 2.0
|
|
|
|
# Opt-in via --ecmp. Traces the first few reference hosts multiple times to spot
|
|
# per-TTL load balancing (different next hops across runs). runs/max_targets are
|
|
# capped in code: this diffs a handful of runs, not a path-sampling campaign.
|
|
ecmp:
|
|
runs: 3
|
|
max_targets: 2
|
|
|
|
captive_portal:
|
|
enabled: true
|
|
check_urls:
|
|
- "http://cp.cloudflare.com/generate_204"
|
|
- "http://connectivitycheck.gstatic.com/generate_204"
|
|
- "http://clients3.google.com/generate_204"
|
|
expected_status: 204
|
|
|
|
output:
|
|
logs_dir: "./logs"
|
|
cache_dir: "./.cache"
|
|
emoji: true
|
|
# Which report artifacts a run writes by default: md, ru-md, json, prom, csv, or all.
|
|
# Overridden per run by --format/--ru/--json.
|
|
formats: ["md"]
|
|
|
|
# auto_diff prints a compact vs-previous-run summary after every run that writes JSON
|
|
# for the same network (silent if there is no prior JSON report to compare against).
|
|
# trend_default_reports is the N used by --trend when no explicit count is given,
|
|
# capped at 200 in code (reading 200 multi-MB JSON reports is the real cost).
|
|
history:
|
|
auto_diff: true
|
|
trend_default_reports: 10
|
|
|
|
watch:
|
|
interval_seconds: 60
|
|
speedtest_every_n_cycles: 10
|
|
dashboard_refresh_hz: 4
|
|
# Optional: POST a JSON alert on a verdict transition during --watch. Overridable
|
|
# per run with --webhook. min_interval_seconds is floored at 30 in code so a
|
|
# flapping link cannot fire the webhook every tick.
|
|
webhook_url: null
|
|
webhook_min_interval_seconds: 300
|
|
webhook_on: ["warn", "crit"]
|