What it measures, and what it refuses to claim.
Helix's measurement engine is a separate crate with no I/O in it, so the statistical rules live in one place and the interface cannot quietly overstate them. Here is what it collects, what it concludes, and where it stops.
Continuous measurement, by a service — not by the window being open.
A privileged Windows service does all the probing and storage. The desktop app is a viewer that connects to it over a local named pipe and starts nothing. That is why the 2 a.m. outage is in your history: nobody was looking at the screen.
Loss, told as counts and runs
Per window Helix stores the loss count, the longest consecutive loss run, the leading and trailing run lengths and a run-open flag — so a burst spanning two windows stitches back together exactly instead of being smeared across both.
Loss is bursty. Ten singles and one ten-packet gap are the same percentage and completely different experiences; only one of them drops your call.
The 300-probe rule
Claiming loss under 1 % honestly needs roughly 300 clean probes, so the canonical loss window is five minutes at one packet per second. The one-minute window is shown, and labelled coarse — it has a floor of about 1.7 % and cannot resolve below it.
Insufficient data renders as its own state, hatched and named. It is never shown as a quiet pass.
Latency, jitter and percentiles
Min, median, p95, p99, max and mean per window, plus a histogram sketch — because percentiles survive downsampling and cannot be recovered from averages after the fact.
Stability is headlined as the p95 − p50 spread, not a bare standard deviation, and jitter uses the RFC 3550 smoothed estimator that feeds the voice-quality score.
DNS as a first-class signal
Every 60 seconds: a cached popular name to time your resolver, and a random subdomain that forces full recursion. DNS broken while ICMP is clean is a distinctive signature — resolver outage, captive portal or hijack — and it gets diagnosed as such rather than reported as “internet down”.
An outage is a specific thing, not a bad moment.
The definition
Three or more consecutive losses on all internet targets at once — and the targets deliberately span three different operators. It clears after about five consecutive successes, so a single flap does not open and close an incident.
One dirty target while the others are clean is recorded as a target incident. It is not your internet going down and Helix will not tell you it was.
Whose fault, and how sure
Gateway unreachable points at your LAN, Wi-Fi or router. Gateway clean while the internet is dead points at the ISP access network. Both clean with one destination dirty points at the destination.
Gateway latency is treated as a hint only — routers deprioritise pings aimed at themselves when busy. Gateway loss is the stronger evidence, and Wi-Fi signal strength is captured alongside for corroboration.
Twelve stages from your network adapter to the far end.
Run it on demand, and it is offered automatically after an outage clears. Each stage returns pass, warn, fail or skipped-with-a-reason — a stage that cannot run is never silently dropped, because a missing stage that looks like a passing stage is how a report lies.
| Stage | What it checks |
|---|---|
| Adapter & local stack | Link state, speed and duplex, driver age, IP configuration sanity (a 169.254 address means DHCP failed), interface error counters |
| Wi-Fi radio | Signal strength, PHY rate, band and channel, against weak-signal and low-rate thresholds. Skipped on wired connections, and says so |
| Gateway & LAN | ARP resolution, a 15-probe series to your router with loss and latency percentiles, gateway MAC stability |
| Addressing & NAT | Default route, DHCP lease sanity, and carrier-grade NAT detection — which changes what your ISP can even do for you |
| DNS health | Resolver reachability, cached versus full-recursion timing, a known-answer check for hijacking, and a comparison against public resolvers |
| Captive portal | Whether something is intercepting your traffic, and where it redirects to |
| Identity | Public IP, ASN and ISP name, connection re-key context, and VPN detection — with a VPN up, verdicts are scoped accordingly rather than blamed on your ISP |
| Internet reachability | Multi-target ICMP across three operators, cross-checked against TCP on port 443 so an ICMP-filtering path is not read as loss |
| Path analysis | MTR to two targets with the final-hop-only loss rule applied, awareness of load-balanced paths, and every hop annotated with its network and country |
| MTU & fragmentation | A don't-fragment sweep around the usual sizes to find the path MTU that actually works |
| Throughput & bufferbloat | A speed test that doubles as the bufferbloat test, with the idle-versus-loaded latency delta and a grade. Consent-gated, because it uses real data |
| Historical context | The last 24 hours of windows, loss runs, outages and IP-change events pulled from the local store into the report |
The verdict, and its counter-evidence
A deterministic rule tree walks device → Wi-Fi/LAN → router → ISP access → ISP upstream → destination and returns a fault domain with a confidence. It cites the stages that support the conclusion and the stages that argue against it; the confidence is the balance between them.
“Inconclusive” is a real answer the engine is allowed to give.
The report
Plain-language summary first, technician appendix after, and the version of the rule tree printed on it so a verdict can be re-read against the methodology that produced it.
Save it as HTML, publish it at an unguessable link you can revoke, or attach it to a ticket. Publishing itemises what is in it first, and you can mask your public IP and hide hostnames before anything is uploaded.
The number your ISP sells you is not the number that ruins your call.
Bufferbloat, graded A–F
The speed test keeps probing while it saturates the link, so you get the idle-versus-loaded latency delta — the reason a 500 Mbps connection can make a video call unusable the moment someone starts an upload.
A responsiveness figure is computed from HTTP-layer loaded timings, which capture transport-stack queuing that ICMP walks straight past. The parallel ICMP figure is shown as an approximation and is never labelled as the standard measure, because it is not one.
Scores you can read at a glance
A 0–100 score per connection with sub-scores for responsiveness, reliability, speed and bufferbloat. Stars are a rendering of the same number, never a second opinion.
Activity ratings for gaming, streaming and video calls are the minimum of their component scores, not the average — an average lets one catastrophic metric hide behind four good ones, which is exactly the case you needed to see.
Usage and quotas
Per-connection bandwidth accounting with quota tracking and alerts, in decimal GB with a binary toggle, on your local timezone for the billing period and UTC in storage.
The workbench
Ping, traceroute and MTR in their own tabs, automated and manual, with per-hop timelines and network annotation. Export to JSON, CSV or WinMTR format for anyone who wants the raw thing.
Published on purpose.
When the FCC ended its consumer broadband measurement partnership in 2023, the neutral reference panel went with it. A measurement product asking to be believed should show its work, so the rules above are documented rather than described, and the ones that constrain what Helix may claim are the ones stated hardest.
Rules that cost us claims
- No loss rate is quoted below 300 probes — it is labelled coarse instead.
- No verdict ships without its contradicting evidence rendered beside it.
- Per-hop loss that does not persist to the final hop is not blamed on that hop.
- A maintenance window only suppresses fault attribution if it was declared at least 15 minutes before the fault — otherwise it would be a retroactive amnesty.
Where it stops today
- Windows 10/11 on x64 only. macOS, Linux and ARM64 are not built yet.
- The v1.0.0 installer is not code-signed.
- Per-application traffic monitoring is not in this release.
- No Wi-Fi roaming telemetry, and no PDF export without a rendering service configured.