Reading the desktop app.

Overview

The screen you open the app to see. It answers three questions in order: who you are paying, what the line is good for right now, and the figures behind that verdict.

• Your network — the provider’s name, their AS number and the country that AS is registered in. That country is the network’s registration, not where you are; a Kenyan subscriber on a network registered elsewhere is an ordinary arrangement.
• Mean rating — the average of the calls, gaming and streaming ratings, with the number of windows it was computed across. Speed is deliberately not in it.
• Responsiveness — a separate 0–100 score folded from the latency, jitter and loss tiles beside it. Two different scores on one screen is deliberate: one is what the line is good for, the other is how fast it answers.
• The tiles — Latency, Jitter, Loss, Slow tail, Call quality and Probes, read from the last 10 minutes of closed one-minute windows. Each of the first five carries a sparkline of its last hour so you can tell “bad” from “normal for this line”; Probes says how many probes the figures stand on.

A loss tile reading 0/120 with a hatched background is not a failure — the hatch means the sample is below the 300-probe floor, so a rate is being withheld while the counts are shown.

Your line right now

While the line is dropping or down, a strip under your network says where the loss is — at your own router or beyond it — with the counts that produced it. It is an observation, not a verdict, and it goes away when the line is healthy again. The full diagnosis, with evidence for and against, lives under Diagnose → Line diagnosis.

The Day map

Twenty-four hours as a grid: one row per hour, one cell per minute, shaded against this line’s own day.

• Stronger colour is slower — relative to your normal, never an absolute scale. A satellite link is not painted permanently red for being satellite.
• A hatched cell is a hole, not a good minute. Nothing was measured — Helix was not running, or the computer was off or asleep — and the map does not guess which. Absence is shown as absence.
• Loss draws its own mark on top of the shade, because a quick minute that dropped packets is not a good minute.

What to look for: horizontal bands. Each row is an hour, so congestion at peak shows as stronger cells across the evening rows, which is a provisioning conversation. Scattered stronger cells with no pattern are usually your own Wi-Fi. One day cannot show that it happens every evening; the console’s Weekly pattern card, which lines up the same hour across weeks, can.

What changed

A list of the moments worth explaining — stretches where loss appeared or latency ran at twice the day’s own typical value — each with its exact counts and time range. This is the section to quote in a support ticket, because every line in it is a specific claim with a timestamp.

Link Matrix

Your connection scored at five levels, ordered by blast radius — how much of your experience each one can ruin. It answers “which part of the chain is weak?” rather than producing a single number that hides the answer.

A level below its floor is stated as absent, and the overall score reweights around it. This matters: one perfect stream with three levels unmeasured reads as 100, not as a lower score padded with invented zeros. Absence is reported in words.

A host earns its place by answering. Some hosts never reply to a ping by policy; counting their silence as loss would charge your line for somebody else’s firewall. So a host that has not answered scores nothing and is listed separately as “answers no echo — not scored”. Hosts that answer within 80 ms count as nearby content; those further out count as IP transit. The sites on the Internet Metrics board feed the matrix too, so it fills without sending any extra traffic.

Live Path

Whatever path walk is running — a trace you started on MTR Trace, or one the app runs on its own schedule — hop by hop as it measures, with every individual probe listed beside it as it happens. It has no host box of its own: it follows what is already running. An agent pings its services rather than walking a path to them, so a sweep draws nothing here.

The value is the classification per hop, not the raw percentages. A hop marked cosmetic is a router deprioritising Helix’s questions while forwarding your traffic perfectly; a hop marked propagating is real loss that everything downstream inherits. Only the first propagating hop is named as the culprit.

What this is not: it captures no packets and inspects no traffic. It measures the path, not what you send over it.

MTR Trace

Type a host and investigate it directly: a path walk, a name and service check, and a comparison of your resolver against two independent references.

A refused connection is a good sign and is painted neutrally rather than as an error. It means the packet arrived and the host answered — the network worked. Only “no answer at all” is a finding.

Every hop shows its address. The name it answers to is one hover away, apart from the destination, whose name is printed under its address. A hop that answers from several routers lists every address, stacked. If the walk never reaches the destination, the headline says unreached in words, and the silent hops beyond the last reply are folded into a single row. The latency of the last router that answered is not dressed up as the destination’s.

Three states, never two. A destination is answering, silent for N rounds after answering, or never answered. When it stops answering pings, the Web Checker turns itself on and asks the service over HTTPS and HTTP, so a host that blocks pings but serves pages reads as “answers no ping · service up (HTTPS 200)” rather than as 100% loss.

Save image keeps the whole trace as a picture — every hop, including the ones scrolled out of view — as a PNG, or a JPG if you choose it, in the theme you are using. The picture is stamped with the host, the date and time it was taken and the app’s version, and a trace that is still running is marked “In progress” with the round it had reached, so it cannot pass for a finished one. It is the trace as the screen shows it: names that appear only when you hover are not in it. Copy as text gives the same table as plain text, laid out the way WinMTR lays it out. Images go to Helix Output.

Ping

Independent ping boxes, each with its own host, count or continuous mode, interval, payload size and a don’t-fragment switch. Two boxes aimed at one host with different frame sizes is the normal way to find the largest packet your path carries whole. Loss is shown as counts until 300 echoes have been sent, and only then as a rate.

Diagnose

Four tabs: Agents, where the page opens; Custom packs; Line diagnosis; and History.

Agents

Each agent is a pack of well-known services, ordered work first and play last: work accounts, meetings and chat, hardware and vendor support, the shared infrastructure, then social, streaming and gaming. Running one pings every service in it, 100 echoes each, so a slow game or a bad call can be set against the rest of your connection. The Run a sweep card runs several agents together — a Quick sweep, a Standard sweep or every service — and, when the last one finishes, writes one report of them all.

What each row says. A service is answering, or answering, 3 of 100 lost when more than 2 in every 100 echoes did not come back. A service that misses three echoes in a row is asked over HTTPS and HTTP, at most ten times in a sweep. If none of its echoes came back, the row says what the service answered. It reads answers no ping · service up (HTTPS 200) for a host that ignores pings by its own policy but serves pages, and its missing echoes are not counted as loss. It reads no ping reply · no service answered when nothing answered at all. A name that would not resolve reads not reached. A service another sweep was already pinging reads covered by another run, and one a Stop reached first reads stopped before it was checked. Loss is shown as counts, because 100 echoes is under the 300 a rate needs. Open a row for the rest: the best and worst round trip, the jitter, and what each web check found.

A sweep does not say where on the way echoes were lost — it pings each service and does not walk the route to it. When a row says a service lost echoes, or that it did not answer, Trace this host opens it in MTR Trace, which walks the route and finds where the trouble starts. The button appears once that service’s echoes are done, so the trace does not start on top of them, and the trace runs until you stop it. For a host that answers no ping, its Web Checker is already ticked.

Sweeps start at once and run side by side, each with its own Stop, and Resume runs the same agents again from the start. A service another sweep is already pinging is not pinged twice: its row says it is covered by the other run. A Quick sweep also runs by itself half a minute after the service starts. Agents never count towards whether your line is reported as down — a Discord outage is not your connection failing.

The report that card writes is kept on this computer and, while the box on the card is ticked, in your Helix account as well. Any recent run of a single agent can be turned into a report too. Save a report as a PDF whenever you want a file to send; it goes to Helix Output.

Custom packs, on their own tab, are the one place you name your own hosts. Each host is checked when you save, so a typo shows up in the editor rather than halfway through a sweep, and a custom pack is swept the same way as the others.

Line diagnosis

The full twelve-stage diagnosis (thirteen with the speed test), from your network adapter to the far end, producing a verdict.

Read the counter-evidence. Every verdict renders what supports it and what argues against it, both always visible. A diagnosis engine that cannot populate the second column is not shipped here. If you are taking this to a support desk, the contradicting column is what stops the conversation ending at “your test is wrong”.

The result is kept on this computer as a report. Save it as a web page, which goes to Helix Output, or send it to your account. From the console you can then publish it as a link, or attach it to a ticket with your provider.

Usage

Which applications used the network and how much, with the addresses they talked to and each program’s own icon, plus a live throughput chart. The history reaches back six hours, a day, a week, a month or a year.

Which applications used the network, and the exact addresses they talked to, stay on your computer. It answers “what was saturating the line at 9pm?” — frequently the real explanation for a call that broke up. What leaves is a daily list of the services this computer uses most: a name where one is known, otherwise only the address’s network block, with nothing attached. It is on by default and has its own switch under Settings → Privacy & sharing.

System

What the service knows about itself: version, uptime, the targets in its plan, sync state. It is assembled from the answers the service already gives, so it cannot disagree with the rest of the app.

LAN devices

System’s second view: the devices your computer can already see on your network, read from Windows. Their names, and every address but your router’s, stay on this computer; your router’s address is the first hop of the path traces uploaded with your measurements, and of any report you send. Nothing scans your network to find them. Ask the app to name a device and only its maker’s three-byte prefix is looked up.

NETStats

The hosts people reach most, and how well each one serves them, with a second tab ranking the providers people pay. It is about the internet at large rather than your line, and opening it sends nothing about your computer. The order is by use: #1 is the host the most computers reach, whatever it scores. A host with too few measurements shows its figures and the reason it is unscored, never an invented rank. The same figures are on the NETStats page.

Settings

At the foot of the rail. Account is where this computer signs in to your account. Privacy & sharing lists everything that leaves this computer, what each one is, and the switch for each. The other sections cover the window’s appearance, notifications, your own monitored services, your plan and data budget, startup, what is kept on this computer, public resolvers you could use, versions and updates, and help.

Where saved files go

Everything the app saves on this computer goes to one folder: Helix Output, inside your Documents folder. That covers an MTR Trace image, an assessment or sweep report saved as a PDF or a web page, a line diagnosis, and the Overview’s “Your line, on the record”. It is the Documents folder Windows itself names, so if your Documents are kept in OneDrive, Helix Output is there too and syncs with them. If Windows cannot say where your Documents folder is, nothing is saved and the app tells you so, rather than guessing a place you would never look.

Each file is named for what it is and when it was measured, such as MTR Trace - google.com - 2026-10-03 14.05.22.png or Service check (Quick sweep) - 2026-10-03 14.05.pdf. Saving again never overwrites a file: the second copy gets “(2)” in its name. After a save, Show in folder opens the folder with the file selected.

When your provider changes

When your upstream moves to a different network — a failover to a backup line, or a new provider — every live figure, sweep and path walk is reset and started again on the new line. A number measured on one supplier is never carried over and credited to another. A lookup that fails for a moment is not treated as a switch: the change has to be confirmed by an answer naming a different network.

When a figure is missing

A blank where a number should be is a deliberate statement, not a bug. Across every screen the rules are the same:

• A loss rate is withheld below 300 probes; the counts are shown instead.
• A progress bar is only determinate when something real is being counted — otherwise it is hatched rather than animated to look busy.
• Not measured is never drawn as zero, and never as a soft “OK”. It carries its own mark and its own word.

Terms defined in the glossary. For the console side, see reading your account online.