What it measures, and what it refuses to claim.

The Link Matrix

Five levels, ordered by blast radius: how much of your experience each one can ruin if it degrades. Your own network first, then the path out, then the far ends. Each is scored from its own measurements, so a weak level is named rather than averaged away.

A level below its evidence floor is stated as absent, and the overall score reweights around it. One perfectly measured level with three unmeasured reads as a score for what was measured, not that score diluted by invented zeros. Absence is reported in words, on the surface, where a reader can see which levels the verdict actually rests on.

Live Path

The route to a host, hop by hop, updating as it measures, with every individual probe listed beside it as it happens. A lost probe appears as itself — loss is an event with a time, not only a rate at the end of a minute.

It classifies each hop rather than printing raw percentages, which is the difference between a diagnosis and a table a support desk can dismiss. It captures no packets and inspects no traffic: it measures the path, never what you send over it.

Sweeps, by pack

Grouped destinations — video conferencing, gaming, the major CDNs, your DNS resolvers — walked together so a complaint like “Teams is bad but everything else is fine” becomes a comparison instead of an argument. Sweeps run in parallel with the wire rate held constant, because two uncontrolled sweeps measure each other and blame the result on the subscriber’s own ISP.

Two runs never walk the same host at once. Concurrent walks do not produce two readings; they produce two corrupted ones, each measuring the other’s queueing.

Per-application and per-address usage

Which programs used the network, how much, and which addresses they talked to — measured locally, kept locally, and never part of what an ISP can see. It answers the question that ends most disputes before they start: what was actually saturating the line when the call broke up. Kept for a month, so the card answers for the last six hours, a day, a week or a month rather than only for right now.

As many paths and pings as you want, side by side

Every trace and every ping is its own session with its own stop, so you can walk two hosts at once, or the same host at two frame sizes, and compare. Nothing queues behind anything else: a shared pacer spaces the probes leaving the machine, so the wire sees the same rate however many sessions are open. Hop tables fill hop by hop as each probe lands rather than after the round.

Every hop named, and every router that answered

Hops show what they are called, with the address one hover away. Where several routers answer at the same distance — normal on an equal-cost path — all of them are listed rather than the first with a count of the rest. Two addresses at one hop are often different line cards and occasionally different cities, and a reader can only see that if they are shown.

The Web Checker, for hosts that ignore pings

Large services routinely answer no ping at all, which makes a path walk end in silence and says nothing about whether the service is up. Tick the Web Checker on a trace and every round also asks the destination over HTTPS and HTTP, reporting what it answered with its response time, average, best and worst — on a line under the hop table, in the same columns.

It is deliberately not a TCP traceroute. Windows makes per-hop TCP attribution impossible without bundling a driver that may not be redistributed, and a hop column that cannot say which hop stopped a connection would be a number with nothing behind it. This reports the service, and says so.

What is on your network, discovered without scanning it

The devices on your own network, read from your machine’s neighbour table — nothing sweeps a subnet, sends an ARP request or touches a port, because an unrequested scan of somebody’s network is what a security product flags. Addresses, names and hardware identifiers never leave the machine; the manufacturer prefix may, because it names a product rather than a person, and where a model is guessed it is labelled as a guess.

How your line compares

Your median latency to common destinations beside the median for your country and for every Helix agent, each figure carrying the number of subscribers behind it. Below a minimum number of distinct contributors a cell is absent rather than shown thin or anonymised — a rating built from two people is not a rating of a network — and withheld cells are counted rather than hidden, so nobody can mistake “no data” for “no problem”.

Quantiles merge from histograms rather than by averaging other quantiles, and where that is impossible the field is named so on the wire. A median of medians is not a median, and calling it one would be a quiet lie in the one place this product cannot afford it.

Signed, silent updates

The service checks for its own updates and applies them, verified against a signature whose private half never touches the server. An attacker holding the entire cloud tier can serve any manifest they like and every agent refuses it.

Silent because the alternative is worse: an app-driven update means a permission prompt per release, and on an unsigned installer that prompt names an unknown publisher — which trains people to click through the one dialog protecting them. The installer’s own signing status is stated plainly on the download page rather than hidden.

Internet Metrics: how far away the internet is

A live board of the services most people actually use — resolvers, search, AI assistants, meetings, social, news, vendors — each with its round trip from your line, as a bar you can compare across the whole board at a glance, lowest first. Hovering one gives the current, average, lowest and highest reading and the number of probes behind them.

Beside each bar sits the same host’s figure from Helix’s own probe boxes, and that is the point of the board: slow in both places means the service is slow; slow only from here means the path is. It is the one figure on the row that is not also a fact about your connection, which is exactly what makes it useful.

Live support sessions

When a provider needs to watch a line while the fault is happening, the agent can grant a temporary observe-only session. Only the agent grants it — the cloud never dials your machine — and the samples live in a capped, expiring buffer rather than a recording. What is kept afterwards is an audit row saying a session happened, to whom and when, and nothing about the person watched.