Version 1.3.2 (114)

One sustained problem sends one alert

A network problem that persisted used to produce a fresh notification every few minutes, which trained people to dismiss the alerts without reading them. An impairment must now last a minute before Network Weather says anything. That sustained episode sends one notification, and a second one only if the problem becomes meaningfully worse. The affected part of your network has to recover before a new episode can alert you again.

Service traceroutes that label and end correctly

The path Network Weather draws to a service is only useful if the labels on it are right. Several ways they could be wrong are fixed.

• Your own gateway is labeled local on IPv6 networks. An IPv6 home network runs globally routable addresses, so your router's reply used to read as an ISP router sitting outside your home. A hop inside any prefix your interfaces hold is now local, with the prefix length read from the network rather than assumed, and IPv6 link-local and unique-local hops classify the way private IPv4 addresses do. This applies to the per-service trace and to topology discovery.
• ISP hops are no longer mislabeled as transit when a trace races startup. A trace requested before Network Weather had learned its own provider's network number compared every hop against nothing, and tagged the whole ISP segment as transit permanently. That number is now read as late as possible, and hops are re-checked when the trace finishes and again whenever the number arrives.
• The path ends at the destination. Probes sent past the destination's distance still reach it and reply, which drew the destination a second time as extra rows carrying a question-mark badge and a spinner that never resolved. Everything past the first hop that reaches the destination is now dropped.
• The address shown is the one actually traced. The header used to show the upfront DNS resolution, which can pick IPv4 while the trace itself runs over IPv6.

Your real internet provider stays visible through a VPN

When a VPN is connected, several things could stand in for your actual provider on the ISP card, and each of them is now handled.

• DNS resolver addresses no longer masquerade as your provider. With a VPN active, the card uses the last egress seen before the VPN connected, or the direct answer from a probe bound to the physical interface. A resolver's address is never treated as your address or your location.
• Tunnel gateways stay excluded after a route change. Logical tunnel gateways are dropped from hop monitoring the moment a VPN route changes and cannot be restored from stale path state, so a tunnel endpoint that does not answer pings cannot turn into false packet-loss evidence mid-transition.
• Logical VPN gateways are not treated as machines that should answer pings. They stay available as route information, but Network Weather no longer blames their silence for a VPN slowdown. Eligibility now comes from which interface a gateway actually lives on rather than from a list of vendor addresses.
• Tailscale returns to the map when an exit node is re-enabled. VPN detection results are tied to the route state that produced them, so a late physical-only lookup can no longer overwrite a current tunnel result with an hour-long negative cache entry. The daemon watcher also survives brief route changes.

Measurements that describe now, not forever

Three findings could be produced by counters that had nothing to do with the present moment.

• Old Ethernet errors no longer look like a current adapter fault. Lifetime driver totals set a baseline, and the wired path shows only errors that appeared after it. A counter rollback, a gateway change, or a recreated interface each establish a fresh baseline.
• Old app traffic no longer looks like a heavy upload in progress. Per-app traffic and TCP retransmissions are measured as counter changes across a monotonic interval. Idle flows, restarted processes, counter resets, and path changes cannot generate a finding, and a retransmission warning also requires meaningful sent traffic.
• Missing driver Wi-Fi measurements are no longer invented as zeroes. The underlying quality fields now record whether a value was actually supplied.

Traces that survive a bad moment

• A briefly full send buffer no longer destroys a whole traceroute, which was the most common traceroute failure in production telemetry. Genuine offline and permission errors still fail immediately.
• A broken DNS resolver can no longer stall a trace for minutes. Reverse DNS and public-address discovery run under their own time budgets. On very slow links, hop hostnames that used to arrive late may now appear as numeric addresses.
• Provider lookups use a bundled database rather than querying DNS during every trace, so they are fast and work offline, with DNS consulted only for addresses the database does not cover.
• A replaced tracer's in-flight traces are cancelled instead of running orphaned, so a flapping network no longer stacks abandoned traces competing with live measurements.

Every security check explains itself

On a UniFi network, a check that depended on the controller and could not run used to disappear from the report without saying so, which reads as a pass. Each audit-dependent check now carries either a real verdict or a visible reason it could not run. An audit that finds nothing renders explicit passes rather than silence, an input that never arrived is recorded as unavailable so nothing reading it can be reported as passing, and an expired controller session produces explained skips instead of quiet ones.

TP-Link Deco mesh support

Network Weather can now sign in to TP-Link Deco mesh systems, which use a different login handshake and a different telemetry shape from TP-Link's Archer routers, and read their status. Where a Deco firmware refuses a client listing, a fallback path retrieves what it will report rather than showing nothing.

Smaller fixes

• Telemetry events now carry the app version, so a production investigation can tell which build a client was running.
• Address membership tests throughout the hop classifier compare addresses as numbers under a mask rather than as text, so a malformed address can no longer be read as a private or carrier-grade one.
• Service trace targets are resolved in the order the system itself would use.