netsleuth/tests
Andrew Pimenov bc8482cc99 detect PMTUD blackholes via a DF-flag binary search (--pmtud)
Stayed unprivileged on both platforms deliberately. Windows: echo_once()
gained a df: bool param setting IP_FLAG_DF on the IP_OPTION_INFORMATION
struct's Flags field (present but unused until now), and classify_status()
learned IP_PACKET_TOO_BIG (11009) - the same unprivileged IcmpSendEcho2
API the rest of the ICMP tier already uses, no new capability needed.

Unix deliberately does not hand-roll raw ICMP echo requests - unprivileged
SOCK_DGRAM/IPPROTO_ICMP checksum and identifier handling varies enough
across kernel versions that shipping it without a Linux/macOS box to
verify on felt like the wrong risk to take. Shells out to system
ping -M do -s <size> (Linux) / ping -D -s <size> (macOS/BSD) instead,
the same subprocess-and-parse pattern traceroute.py's system tiers
already use. Matches "frag"/"too long" loosely in the output rather than
an exact phrase, since a locally-cached-PMTU failure and a genuine
on-path ICMP response word themselves differently across ping
implementations - same "parse by shape" principle traceparse.py already
established.

classify_pmtu() distinguishes a path that's just narrower (a frag-needed
signal was seen - PMTUD is working, normal behind a VPN) from an actual
blackhole (large packets vanish with no ICMP reply at all - the "SSH
connects then hangs" symptom). path.pmtu_below_iface_mtu flags separately
when the path MTU is narrower than the local NIC's own MTU, which is
exactly what makes this class of problem invisible locally.

Opt-in --pmtud, excluded from --full. Live-verified on Windows against
real cloudflare.com/google.com - found the full 1500-byte MTU in 11
probes each, matching the expected binary-search depth, correct probe
history in the JSON output.

Part of plans/zesty-zooming-wilkinson.md (gitignored).
2026-08-12 23:15:59 +03:00
..
fixtures add system DNS vs DoH comparison and transparent proxy detection 2026-08-09 17:45:33 +03:00
conftest.py project scaffold: uv packaging, config.yaml, package skeleton 2026-08-08 21:12:41 +03:00
test_alerting.py give --watch a per-tick verdict and optional webhook alerts 2026-08-12 22:26:31 +03:00
test_bgp.py extract NDT7 consent check into a helper function 2026-08-09 16:07:44 +03:00
test_bgp_path.py fix international-loop detection: drop dead ip_country parameter 2026-08-10 21:18:28 +03:00
test_captive_portal.py detect captive portals up front, flag off-country speedtest servers 2026-08-12 21:36:54 +03:00
test_cgnat_nat64.py detect CGNAT, NAT64, and first-hop-vs-path issues separately 2026-08-12 21:06:01 +03:00
test_cli_formats.py add Prometheus/CSV export, auto-diff vs previous run, and --trend 2026-08-12 22:10:21 +03:00
test_compare.py add Prometheus/CSV export, auto-diff vs previous run, and --trend 2026-08-12 22:10:21 +03:00
test_config.py detect PMTUD blackholes via a DF-flag binary search (--pmtud) 2026-08-12 23:15:59 +03:00
test_dns_advanced.py add system DNS vs DoH comparison and transparent proxy detection 2026-08-09 17:45:33 +03:00
test_dns_leak.py rename package netcheck to netsleuth (name taken on pypi) 2026-08-09 11:43:00 +03:00
test_dnsbl_decode.py add tests for decode_dnsbl fallback and mixed responses 2026-08-09 16:18:57 +03:00
test_dpi_check.py add single-host DPI/TCP-RST self-diagnostic probe 2026-08-09 17:45:27 +03:00
test_ecmp.py detect ECMP load balancing via N-run traceroute diff (--ecmp) 2026-08-12 22:42:38 +03:00
test_exporter.py detect PMTUD blackholes via a DF-flag binary search (--pmtud) 2026-08-12 23:15:59 +03:00
test_exporter_l7.py render TLS, DNS advanced, path diversity, prefix bench, DPI sections in reports 2026-08-09 17:56:07 +03:00
test_history.py add Prometheus/CSV export, auto-diff vs previous run, and --trend 2026-08-12 22:10:21 +03:00
test_hop_asn.py enrich traceroute hops with ASN, AS name, country and PTR fallback 2026-08-12 21:17:00 +03:00
test_icmp_win_parse.py detect PMTUD blackholes via a DF-flag binary search (--pmtud) 2026-08-12 23:15:59 +03:00
test_icmp_win_trace.py add --interface flag to force outbound probing through a specific adapter 2026-08-09 13:36:06 +03:00
test_iface.py add --interface flag to force outbound probing through a specific adapter 2026-08-09 13:36:06 +03:00
test_interpret.py measure IPv6 reference-host latency alongside IPv4 2026-08-12 22:55:51 +03:00
test_interpret_l7.py verify TLS certificates and fingerprint them for MITM detection 2026-08-12 21:48:36 +03:00
test_ip_geo_normalize.py expand classify_ip_type test coverage 2026-08-09 16:17:49 +03:00
test_metrics.py add Prometheus/CSV export, auto-diff vs previous run, and --trend 2026-08-12 22:10:21 +03:00
test_models.py add L4-L7 diagnostic models (TLS, DPI, DNS, anycast, prefix bench) 2026-08-09 17:35:37 +03:00
test_netinfo.py fix default gateway detection picking wrong route with multiple adapters 2026-08-09 13:00:24 +03:00
test_orchestration.py rename package netcheck to netsleuth (name taken on pypi) 2026-08-09 11:43:00 +03:00
test_pmtud.py detect PMTUD blackholes via a DF-flag binary search (--pmtud) 2026-08-12 23:15:59 +03:00
test_prefix_benchmark.py add AS prefix latency benchmark probe 2026-08-09 17:43:10 +03:00
test_prober_stats.py add jitter matrix (p95/p99/cv) to ping stats 2026-08-09 17:34:06 +03:00
test_reputation.py add test coverage for fetch_internetdb 2026-08-09 16:19:59 +03:00
test_speed_cloudflare.py add tests for tier_cloudflare 2026-08-09 16:14:55 +03:00
test_speed_fastcom.py detect captive portals up front, flag off-country speedtest servers 2026-08-12 21:36:54 +03:00
test_speed_math.py add test coverage for throughput_from_samples 2026-08-09 16:20:50 +03:00
test_stats.py add jitter matrix (p95/p99/cv) to ping stats 2026-08-09 17:34:06 +03:00
test_tls_rtt.py verify TLS certificates and fingerprint them for MITM detection 2026-08-12 21:48:36 +03:00
test_traceparse.py add specific unit tests for parse_traceroute 2026-08-09 16:21:23 +03:00
test_traceroute_cascade.py add --interface flag to force outbound probing through a specific adapter 2026-08-09 13:36:06 +03:00
test_trend.py add Prometheus/CSV export, auto-diff vs previous run, and --trend 2026-08-12 22:10:21 +03:00
test_watch.py give --watch a per-tick verdict and optional webhook alerts 2026-08-12 22:26:31 +03:00