ISP PathCheck

Collect repeatable evidence for slow, flaky, or inconsistent home internet connections.

Important

The included Windows .bat files are examples. Before running them, edit the --router and --first-hop values so they match your own network. The sample first-hop address is not universal and will be wrong for most users.

isp_evening_diagnostics.py is a no-dependency Python diagnostic script that samples your local router, your ISP path, DNS lookups, and HTTPS connection setup over time. It writes an ISP-ready evidence package with raw CSV data, Markdown summaries, traceroutes, network snapshots, and timeline charts.

The tool is especially useful for problems that feel like this:

• Web pages, apps, games, or streaming services are slow to start.
• Speed tests eventually look fine, but new connections stall, reset, or time out.
• The issue is worse at certain times of day, such as evening peak hours.
• You need evidence that separates local Wi-Fi/router issues from ISP-side or upstream issues.

Before using the Windows .bat launchers

The batch files are convenience launchers for Windows users. They are not auto-configuring scripts. Open each .bat file in a text editor and replace these example values before use:

--router 192.168.1.1
--first-hop 62.166.136.1

Use ipconfig to find your local Default Gateway for --router. Use tracert -4 8.8.8.8 to identify the first ISP-side hop for --first-hop; this is often hop 2, after your router. When in doubt, run the Python command manually instead of the batch file.

Do not assume the sample first-hop address is correct for your network. It is only an example.

Safety and authorized use

Use this only on networks you own, manage, or have permission to test.

This script is intended for personal network diagnostics. It does not scan port ranges, exploit services, bypass access controls, or perform intrusive testing. It does send repeated pings, DNS lookups, and HTTPS requests to configured targets, so keep intervals reasonable and only choose targets you are allowed to contact.

Before sharing the output publicly or with an ISP, review it for private information. Reports and raw snapshots can include your computer name, local IP configuration, DNS configuration, gateway addresses, route tables, router log excerpts, and timing data.

Repository contents

File	Purpose
isp_evening_diagnostics.py	Main diagnostic collector and report generator.
run_evening_diagnostics.bat	Windows convenience launcher for a shorter evening run. Edit the router and first-hop values before use.
run_overnight_until_7am.bat	Windows convenience launcher for an overnight run ending at the next local 07:00. Edit the router and first-hop values before use.
README.md	This documentation.

What it measures

The script runs a mix of continuous and one-time checks:

• Ping to your local router or default gateway.
• Ping to the first ISP hop, when you provide one.
• Repeated HTTPS timing with curl, split into:
  • DNS lookup time
  • TCP connect time
  • TLS/appconnect time
  • first byte time
  • total request time
  • HTTP errors, resets, and timeouts
• Repeated DNS lookups using Python.
• MTU probes to help spot path MTU or MSS problems.
• Forced IPv6 HTTPS check.
• Initial and final traceroute.
• Windows network snapshots using built-in tools.
• Optional router log extraction for DHCP, WAN, lease, internet, and IPTV-related lines.
• Time-window summaries, by default in 15-minute buckets.
• SVG timeline charts showing when degradation starts, peaks, and recovers.

Requirements

Best-supported platform

Windows 10 or Windows 11 is the best-supported platform.

Required tools on Windows:

• Python 3.9 or newer
• Built-in Windows commands: ping, tracert, ipconfig, route, netsh
• curl.exe, included with modern Windows 10/11 installations

No third-party Python packages are required.

macOS and Linux

The Python script has partial support for macOS and Linux where equivalent tools are available. Windows remains the primary target, and the .bat launchers are Windows-only.

Quick start

1. Download or clone the repository

git clone https://github.com/YOUR-USERNAME/isp-pathcheck.git
cd isp-pathcheck

Or download the files and open a terminal in the folder containing isp_evening_diagnostics.py.

2. Confirm Python and curl are available

python --version
curl.exe --version

3. Find your router address

On Windows:

ipconfig

Look for Default Gateway. Common examples are 192.168.1.1, 192.168.0.1, or 10.0.0.1.

4. Find your first ISP hop

Run a traceroute:

tracert -4 8.8.8.8

Usually:

• Hop 1 is your router.
• Hop 2 is often your first ISP hop.

Use that hop 2 address with --first-hop. If you are unsure, you can still run the tool, but first-hop results are only meaningful when the address matches your ISP path.

5. Run an overnight diagnostic

Replace the example router and first-hop addresses with your own values:

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --curl-max-time 180 `
  --slow-threshold 2 `
  --interval-seconds 2 `
  --dns-interval-seconds 30 `
  --bucket-minutes 15 `
  --evening-start 18:00 `
  --evening-end 23:59

--until 07:00 means the script runs until the next 07:00 according to your computer's local clock. If 07:00 has already passed today, it runs until tomorrow morning.

Press Ctrl+C to stop early. The script will still write a report with the samples collected so far.

Windows batch launchers

The repository includes two .bat files for convenience.

run_evening_diagnostics.bat

Runs a 3-hour diagnostic using a 2-second sampling interval and 15-minute summary buckets.

Before using it, open the file in a text editor and replace these example values:

--router 192.168.1.1
--first-hop 62.166.136.1

run_overnight_until_7am.bat

Runs until the next local 07:00, using an evening issue window of 18:00 to 23:59.

Before using it, open the file in a text editor and replace the router and first-hop values with your own network details.

Common run profiles

Short evening run

Good when the issue is already happening and you want a smaller evidence package.

python .\isp_evening_diagnostics.py `
  --duration-hours 3 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --curl-max-time 180 `
  --slow-threshold 2 `
  --interval-seconds 2 `
  --dns-interval-seconds 30 `
  --bucket-minutes 15

Higher-resolution run

Captures shorter spikes, but creates larger CSV files.

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --curl-max-time 180 `
  --slow-threshold 2 `
  --interval-seconds 1 `
  --dns-interval-seconds 15

Lower-noise long run

Good for slower laptops or very long collection windows.

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --interval-seconds 5 `
  --dns-interval-seconds 60

Fixed 12-hour run

python .\isp_evening_diagnostics.py `
  --duration-hours 12 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --curl-max-time 180 `
  --slow-threshold 2 `
  --interval-seconds 2 `
  --dns-interval-seconds 30

Optional router log correlation

If your router can export logs to a text file, save them as router_log.txt and run:

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --router-log .\router_log.txt

The generated report will include a DHCP/WAN-related extract when matching lines are found.

Output files

Each run creates a timestamped folder, for example:

isp_diagnostics_20260507_180000

Typical contents:

File	Description
ISP_Evening_Diagnostics_Report.md	Main Markdown report intended for ISP tickets or personal review.
summary.json	Machine-readable summary of the run.
time_window_summary.csv	Per-window degradation table, usually 15-minute windows.
curl_samples.csv	Raw HTTPS timing samples.
ping_samples.csv	Raw router and first-hop ping samples.
dns_samples.csv	Raw DNS lookup samples.
https_slow_pct_timeline.svg	Timeline chart for slow or failed HTTPS samples.
tls_p95_timeline.svg	Timeline chart for TLS/appconnect p95.
total_p95_timeline.svg	Timeline chart for total HTTPS p95.
first_hop_p95_timeline.svg	Timeline chart for first ISP hop p95 latency.
router_p95_timeline.svg	Timeline chart for local router p95 latency.
dns_p95_timeline.svg	Timeline chart for DNS p95 lookup time.
traceroute_initial.txt	Traceroute captured before continuous sampling.
traceroute_final.txt	Traceroute captured after continuous sampling.
mtu_tests.txt	Raw MTU probe output.
ipv6_forced_https_check.txt	Forced IPv6 HTTPS check output.
ipconfig_all.txt, route_print_4.txt, netsh_*.txt	Windows network configuration snapshots.

What to send to your ISP

Start with these files:

1. ISP_Evening_Diagnostics_Report.md
2. time_window_summary.csv
3. https_slow_pct_timeline.svg
4. tls_p95_timeline.svg
5. first_hop_p95_timeline.svg
6. curl_samples.csv
7. ping_samples.csv

Also include router logs if available and relevant.

Review files before sending. Network snapshots and router logs may contain information you do not want to share publicly.

How to interpret common findings

These are practical rules of thumb, not proof by themselves.

Finding	Likely area to investigate
Router ping has high latency or packet loss	Local LAN, Wi-Fi, router CPU/load, cabling, or local gateway.
Router ping is clean but first-hop ping is bad	ISP access network, modem/ONT path, WAN link, or first ISP gateway.
DNS samples are slow or failing	DNS resolver, router DNS forwarding, ISP resolver, or upstream DNS path.
DNS and TCP are fast, but TLS/appconnect is slow	HTTPS new-flow handling, ISP path behavior, router/NAT/firewall behavior, congestion, or packet loss not visible in basic ping.
MTU probes fail at expected sizes	Possible MTU/MSS/path fragmentation problem.
Only one public target is slow	Could be target/CDN-specific rather than a general ISP issue. Test multiple targets.
Evening windows are worse than baseline	Useful evidence for congestion or time-of-day degradation.

Command-line options

Option	Default	Description
--duration-minutes	90	Collection duration when --until and --duration-hours are not used.
--duration-hours	none	Collection duration in hours. Overrides --duration-minutes.
--until	none	Run until the next local HH:MM, for example --until 07:00.
--bucket-minutes	15	Time-window size for degradation tables and charts.
--evening-start	18:00	Start of the configured issue window, local time.
--evening-end	23:59	End of the configured issue window, local time. Can cross midnight.
--router	192.168.1.1	Local router or gateway IP to ping. Replace with your own gateway.
--first-hop	example ISP hop	First ISP hop to ping. Replace with your own first ISP hop.
--targets	Google and Cloudflare HTTPS URLs	One or more HTTPS URLs to test with curl.
--dns-hosts	Google, Cloudflare, dns.google	Hostnames to resolve repeatedly.
--interval-seconds	1	Target interval for ping and HTTPS timing loops.
--dns-interval-seconds	10	Interval for repeated DNS lookups.
--ping-timeout-ms	1500	Timeout for each ping probe.
--curl-max-time	75	Maximum time allowed per HTTPS request.
--curl-connect-timeout	10	TCP connect timeout passed to curl.
--slow-threshold	2	Seconds above which HTTPS samples are counted as slow.
--output-root	current directory	Location where timestamped output folders are created.
--router-log	none	Optional router log text file for DHCP/WAN extraction.
--skip-mtu	off	Skip MTU probes.
--skip-traceroute	off	Skip traceroute.
--skip-network-snapshot	off	Skip network configuration snapshots.

Custom HTTPS targets

You can test other HTTPS endpoints with --targets:

python .\isp_evening_diagnostics.py `
  --duration-hours 2 `
  --router 192.168.1.1 `
  --first-hop YOUR.FIRST.ISP.HOP `
  --targets https://www.google.com/ https://www.cloudflare.com/ https://www.microsoft.com/

Use stable, public, highly available URLs. Avoid testing websites that prohibit automated traffic, and do not use aggressive intervals.

Troubleshooting

curl not found

Confirm curl.exe is in your PATH:

curl.exe --version

Modern Windows 10/11 systems usually include it. If it is missing, install curl or update Windows.

The first-hop results look wrong

Run:

tracert -4 8.8.8.8

Use the first public or ISP-looking hop after your router. Some ISPs hide or rate-limit ICMP, so first-hop ping is a useful signal but not a perfect measurement.

Traceroute has timeouts

Some routers intentionally ignore or rate-limit traceroute probes. A timeout in traceroute does not always mean traffic is failing. Compare it with HTTPS, DNS, and ping samples.

The report did not capture the issue

Run longer, start before the expected failure window, or use a shorter interval:

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --interval-seconds 1 `
  --dns-interval-seconds 15 `
  --curl-max-time 180

CSV files are very large

Use longer intervals:

python .\isp_evening_diagnostics.py `
  --until 07:00 `
  --interval-seconds 5 `
  --dns-interval-seconds 60

Possible future features

Ideas for future releases:

• JSON configuration file support, so users can save router, first-hop, target, timing, and output settings without editing long commands or .bat files.
• First-hop auto-detection from traceroute output, with a clear warning when the result is ambiguous.
• Tested Linux support with platform-specific adapters for ping, traceroute, MTU probes, and network snapshots.
• Tested macOS support using native tools such as ping, traceroute, ifconfig, netstat, and scutil --dns.
• Shell launchers for Linux and macOS, equivalent to the Windows .bat files.
• Better IPv6 diagnostics, including separate IPv4/IPv6 target timing summaries.
• Optional speed-test integration, while keeping HTTPS setup timing as the main focus.
• HTML report output in addition to Markdown.
• Automatic redaction mode for private values such as hostnames, local IP addresses, DNS servers, and gateway addresses.
• Config validation with friendly error messages before a long run starts.
• Example ISP ticket bundle creation as a .zip file.

Limitations

• The script collects evidence; it does not prove root cause by itself.
• ICMP ping can be rate-limited or treated differently from real application traffic.
• Public HTTPS targets can have their own outages, CDN routing changes, or rate limits.
• Wi-Fi problems, router CPU load, bufferbloat, ISP congestion, DNS issues, IPv6 issues, and target-side problems can overlap.
• The included Windows batch files contain example parameters and should be edited for each user's network.

Suggested ISP ticket text

You can paste something like this into an ISP support ticket:

I am seeing intermittent slow new-connection setup, especially during the configured evening window. Speed tests may eventually show normal throughput, but normal web/app startup stalls or times out.

I ran ISP PathCheck, which collected continuous router ping, first-hop ping, DNS lookup timing, HTTPS setup timing via curl, MTU probes, traceroute, and network snapshots. The attached report separates DNS, TCP connect, TLS/appconnect, first byte, and total HTTPS time.

Please review the time-window summary and timeline charts, especially any windows where the local router ping remains clean but first-hop latency, HTTPS setup time, TLS/appconnect time, or connection failures increase.

License

MIT License.

This project is released under the MIT License. See LICENSE for the full license text.