What it measures, and what it refuses to claim.
Helix’s measurement engine is a separate crate with no I/O in it, so the statistical rules live in one place and the interface cannot quietly overstate them. Here is what it collects, what it concludes, and where it stops.
Continuous measurement, by a service — not by the window being open.
A privileged Windows service does all the probing and storage. The desktop app is a viewer that connects to it over a local named pipe and starts nothing. That is why the 2 a.m. outage is in your history: nobody was looking at the screen.
Loss, told as counts and runs
Per window Helix stores the loss count, the longest consecutive loss run, the leading and trailing run lengths and a run-open flag — so a burst spanning two windows stitches back together exactly instead of being smeared across both.
Loss is bursty. Ten singles and one ten-packet gap are the same percentage and completely different experiences; only one of them drops your call.
The 300-probe rule
Claiming loss under 1 % honestly needs roughly 300 clean probes, so the canonical loss window is five minutes at one packet per second. The one-minute window is shown, and labelled coarse — it has a floor of about 1.7 % and cannot resolve below it.
Insufficient data renders as its own state, hatched and named. It is never shown as a quiet pass.
Latency, jitter and percentiles
Min, median, p95, p99, max and mean per window, plus a histogram sketch — because percentiles survive downsampling and cannot be recovered from averages after the fact.
Stability is headlined as the p95 − p50 spread, not a bare standard deviation, and jitter uses the RFC 3550 smoothed estimator that feeds the voice-quality score.
DNS as a first-class signal
Every five minutes, against the resolvers your machine actually uses: timed lookups of cached names, a check that a name that cannot exist gets no address, and a comparison with reference resolvers. DNS broken while ICMP is clean is a distinctive signature — resolver outage, captive portal or hijack — and it gets diagnosed as such rather than reported as “internet down”.
An outage is a specific thing, not a bad moment.
The definition
Three or more consecutive losses on all internet targets at once — and the targets deliberately span three different operators. It clears after about five consecutive successes, so a single flap does not open and close an incident.
One dirty target while the others are clean is recorded as a target incident. It is not your internet going down and Helix will not tell you it was.
Whose fault, and how sure
Gateway unreachable points at your LAN, Wi-Fi or router. Gateway clean while the internet is dead points at the ISP access network. Both clean with one destination dirty points at the destination.
Gateway latency is treated as a hint only — routers deprioritise pings aimed at themselves when busy. Gateway loss is the stronger evidence, and Wi-Fi signal strength is captured alongside for corroboration.
Twelve stages from your network adapter to the far end — thirteen with the speed test.
Run it on demand. Each stage returns pass, warn, fail or skipped-with-a-reason — a stage that cannot run is never silently dropped, because a missing stage that looks like a passing stage is how a report lies.
| Stage | What it checks |
|---|---|
| Adapter & local stack | Link state, speed and duplex, driver age, IP configuration sanity (a 169.254 address means DHCP failed), interface error counters |
| Wi-Fi radio | Signal strength, PHY rate, band and channel, against weak-signal and low-rate thresholds. Skipped on wired connections, and says so |
| Gateway & LAN | ARP resolution, a 15-probe series to your router with loss and latency percentiles, gateway MAC stability |
| Addressing & NAT | Default route, DHCP lease sanity, and carrier-grade NAT detection — which changes what your ISP can even do for you |
| DNS health | Whether names resolve at all, with a cached and an uncached lookup timed against a public reference resolver. The resolvers your machine is configured to use are covered by the five-minute DNS check above |
| Captive portal | Whether something is intercepting your traffic, and where it redirects to |
| Identity | Public IP, ASN and ISP name, connection re-key context, and VPN detection — with a VPN up, verdicts are scoped accordingly rather than blamed on your ISP |
| Internet reachability | Multi-target ICMP across three operators, cross-checked against TCP on port 443 so an ICMP-filtering path is not read as loss |
| Path analysis | MTR to one destination with the final-hop-only loss rule applied, awareness of load-balanced paths, and every hop annotated with its network and country |
| MTU & fragmentation | A don’t-fragment sweep around the usual sizes to find the path MTU that actually works |
| CDN and transit | Whether popular content reaches you from nearby or from across the world: pings and HTTPS checks to content networks and public resolvers, compared with long-haul reference hosts rather than read on their own |
| Throughput & bufferbloat | A speed test that doubles as the bufferbloat test, with the idle-versus-loaded latency delta and a grade. Consent-gated, because it uses real data |
| Historical context | The last 24 hours of windows, loss runs, outages and IP-change events pulled from the local store into the report |
The verdict, and its counter-evidence
A deterministic rule tree walks device → Wi-Fi/LAN → router → ISP access → ISP upstream → destination and returns a fault domain with a confidence. It cites the stages that support the conclusion and the stages that argue against it; the confidence is the balance between them.
“Inconclusive” is a real answer the engine is allowed to give.
The report
Plain-language summary first, technician appendix after, and the version of the rule tree printed on it so a verdict can be re-read against the methodology that produced it.
Save it as a web page, send it to your account and publish it from there at an unguessable link you can revoke, or attach it to a ticket. A report names your provider and your public address, so read it before you share the link.
The number your ISP sells you is not the number that ruins your call.
Bufferbloat, graded A–F
The speed test keeps probing while it saturates the link, so you get the idle-versus-loaded latency delta — the reason a 500 Mbps connection can make a video call unusable the moment someone starts an upload.
A responsiveness figure is computed from HTTP-layer loaded timings, which capture transport-stack queuing that ICMP walks straight past. The parallel ICMP figure is shown as an approximation and is never labelled as the standard measure, because it is not one.
Scores you can read at a glance
A 0–100 score per connection with sub-scores for responsiveness, reliability, speed and bufferbloat. Stars are a rendering of the same number, never a second opinion.
Activity ratings for gaming, streaming and video calls are the minimum of their component scores, not the average — an average lets one catastrophic metric hide behind four good ones, which is exactly the case you needed to see.
Usage, by application
Bandwidth accounting from the adapter’s own counters, in decimal GB the way your plan is sold, with a year of history and a table of which programs used it — kept on your machine, never uploaded.
MTR Trace and Ping
Traces in their own tabs and ping boxes side by side, as many at once as you like, with every hop annotated with its network and country. Copy a trace as text laid out the way WinMTR lays it out, or save the whole of it as an image — every hop, even the ones scrolled out of view.
A connection is a chain, and one number hides which link is weak.
A single score is easy to print and useless to act on. These surfaces answer the question underneath it — which part of the chain, and how sure are we.
The Link Matrix
Five levels, ordered by blast radius: your own network, the ISP’s first edge, the resolvers you actually use, nearby content, and the long haul. Each is scored from its own measurements, so a weak level is named rather than averaged away. Nearby and far are decided by each host’s own median — under 80 ms is nearby content, over it is IP transit — with a margin so a host near the line keeps one identity.
A level is earned by a reply. A host that answers no ping at all cannot tell you anything about your line, so it is listed apart — probed, never scored — rather than counted as loss. And a level below its evidence floor is stated as absent: the overall reweights around it instead of diluting a real score with invented zeros.
The sites the Internet Metrics board already measures every second feed the matrix too, so it fills with no traffic of its own.
Every hop, by its address first
The route to a host, hop by hop, filling in as each probe lands rather than at the end of a round. Every row leads with the address a support desk will ask for; the name is one hover away, and the operator and its country sit beside it. Where several routers answer at the same distance — normal on an equal-cost path — all of them are listed, stacked, rather than the first with a count of the rest.
Loss is classified, not printed raw: loss that carries through to the destination is marked as real, loss that stops at one router is marked as that router rate-limiting its own replies. The destination’s own row is highlighted, and a walk that never reached it says so in its headline — it does not quote the furthest router’s latency as though it were the answer.
Reachable, silent, or filtering pings
A destination is reported by what it did in the latest round, in one of three states: answering; answered before and silent for a stated number of rounds since; or never answered. The moment it goes quiet, the service is asked directly over HTTPS and HTTP, and asked again every few rounds while it stays quiet — so “service up” is never an hour-old verdict, and a service that stops answering is seen stopping.
A host whose service answers while its pings do not is almost always filtering ICMP, and the headline says exactly that: answers no ping · service up (HTTPS 200). The pings keep going underneath; if they come back, the headline says the destination was reached.
The Web Checker, for hosts that ignore pings
Large services routinely answer no ping, which makes a path walk end in silence and says nothing about whether the service is up. The Web Checker asks the destination over HTTPS and HTTP every round and reports what it answered, with its response time, average, best and worst — on a line under the hop table, in the same columns. It switches itself on when a destination answers no ping, and says it did.
It is deliberately not a TCP traceroute. Windows makes per-hop TCP attribution impossible without bundling a driver that may not be redistributed, and a hop column that cannot say which hop stopped a connection would be a number with nothing behind it. This reports the service, and says so.
Which program used the line
Which programs used the network, how much, and which addresses they talked to — measured locally, kept locally, and never part of what an ISP can see. The table answers for six hours, a day, a week, a month or a year, records while the window is closed, and shows each program with its own icon beside a meter of its share.
It answers the question that ends most disputes before they start: what was actually saturating the line when the call broke up.
When the line changes hands
Switch to a phone’s hotspot, a second provider or a VPN that takes the route, and the provider behind your line has changed. Everything that was measuring stops, the running figures are cleared, and the base-case sweep runs again for the new line — and every screen that was showing the old line’s results says why they are gone.
A measurement taken on one provider is not evidence about another, and a sweep that started on one and finished on the other would blame the second for the first’s faults.
Sweeps, by pack
Grouped services — work accounts, meetings and chat, vendor support, public resolvers, streaming, gaming — pinged together, 100 echoes each, so a complaint like “Teams is bad but everything else is fine” becomes a comparison instead of an argument. A service that answers no ping is asked over HTTPS and HTTP instead, at most ten times in a sweep, and while it serves pages its missing echoes are not counted as loss.
A sweep says whether each service answers and how many echoes were lost on the way; it does not walk the route, so it does not say where. A service that loses echoes or does not answer offers Trace this host, which opens MTR Trace at it to find where the trouble starts. Sweeps run in parallel, each host’s echoes starting a moment apart, and a host one sweep is already pinging is not pinged again by another: the second says it is covered by the first.
As many paths and pings as you want, side by side
Every trace and every ping is its own session with its own stop, so you can walk two hosts at once, or the same host at two frame sizes, and compare. Nothing queues behind anything else: a shared pacer spaces when each trace starts and every echo a ping box sends, so opening several at once never lands them on the routers near you in one burst.
What is on your network, discovered without scanning it
The devices on your own network, read from your machine’s neighbour table — nothing sweeps a subnet, sends an ARP request or touches a port, because an unrequested scan of somebody’s network is what a security product flags. Addresses, names and hardware identifiers never leave the machine; the manufacturer prefix may, because it names a product rather than a person, and where a model is guessed it is labelled as a guess.
Your line, in context — and kept current without asking you.
How your line compares
Your median latency to common destinations beside the median for your country and for every Helix agent, each figure carrying the number of subscribers behind it. Below a minimum number of distinct contributors a cell is absent rather than shown thin or anonymised — a rating built from two people is not a rating of a network — and withheld cells are counted rather than hidden, so nobody can mistake “no data” for “no problem”.
Quantiles merge from histograms rather than by averaging other quantiles, and where that is impossible the field is named so on the wire. A median of medians is not a median, and calling it one would be a quiet lie in the one place this product cannot afford it.
Signed, silent updates
The service checks for its own updates and applies them, verified against a signature whose private half never touches the server. An attacker holding the entire cloud tier can serve any manifest they like and every agent refuses it.
Silent because the alternative is worse: an app-driven update means a permission prompt per release, and on an unsigned installer that prompt names an unknown publisher — which trains people to click through the one dialog protecting them. The installer’s own signing status is stated plainly on the download page rather than hidden.
Problems reported before you have to call
When something goes wrong inside the agent — a lookup that keeps failing, an update that did not finish, a crash — the service reports it, so it can be fixed in the next release rather than discovered in a support call. Addresses and domain names are replaced by placeholders on your machine before anything is sent, and a problem that repeats is sent once with a count.
With each report goes a description of the machine: the Windows build, the edition, the processor, the memory, the maker and model. Facts about the product, never its name, its user or its serial number. The privacy page lists every field.
Internet Metrics: how far away the internet is
A live board of the services most people actually use — resolvers, search, AI assistants, meetings, social, news, vendors — each with its round trip from your line, as a bar you can compare across the whole board at a glance, lowest first. Hovering one gives the current, average, lowest and highest reading and the number of probes behind them.
Beside each bar sits the same host’s figure from Helix’s own probe boxes, and that is the point of the board: slow in both places means the service is slow; slow only from here means the path is. It is the one figure on the row that is not also a fact about your connection, which is exactly what makes it useful.
Live support sessions
When a provider needs to watch a line while the fault is happening, the agent can grant a temporary observe-only session. Only the agent grants it — the cloud never dials your machine — and the samples live in a capped, expiring buffer rather than a recording. What is kept afterwards is an audit row saying a session happened, to whom and when, and nothing about the person watched.
Published on purpose.
When the FCC ended its consumer broadband measurement partnership in 2023, the neutral reference panel went with it. A measurement product asking to be believed should show its work, so the rules above are documented rather than described, and the ones that constrain what Helix may claim are the ones stated hardest.
Rules that cost us claims
- No loss rate is quoted below 300 probes — it is labelled coarse instead.
- No verdict ships without its contradicting evidence rendered beside it.
- Per-hop loss that does not persist to the final hop is not blamed on that hop.
- A maintenance window only suppresses fault attribution if it was declared at least 15 minutes before the fault — otherwise it would be a retroactive amnesty.
Where it stops today
- Windows 10/11 on x64 only. macOS, Linux and ARM64 are not built yet.
- The v1.32.1 installer is not code-signed.
- No Wi-Fi roaming telemetry, and no PDF export without a rendering service configured.