v0.2.0-alpha — the complete v1 rule set

All fifteen v1 rules are implemented. This is the first build where the rule
set is complete.

What's new since v0.1.0-alpha

Four checks, completing the set:

• R10 rtt-outlier — one host far slower to reach than every other host in
  the capture. Reports whether the latency was steady or variable, since that
  separates distance from congestion.
• R11 dns-failure — name lookups that went unanswered, came back as errors,
  or ran slow. A lookup happens before the connection it enables, so a slow one
  delays everything behind it and is very often blamed on the application.
• R12 tls-handshake-failure — encrypted connections that failed to
  negotiate, took an unusually long time, or presented a certificate close to
  expiry.
• R13 pmtu-blackhole — large packets repeatedly failing while small ones on
  the same connection succeed. The signature of a size limit on the path that
  nothing is reporting back to the sender.

R11 and R12 are the first checks that read above TCP. Two consequences:

• Encrypted traffic is reported as unreadable, not as clean. DNS over TLS
  and TLS 1.3 both hide what these checks would otherwise read, and both produce
  an explicit "not assessed" note. An absence of certificate findings is not a
  statement that the certificates are valid.
• Neither check reads names. R11 reports how many lookups failed, never
  which ones. R12 reads a certificate expiry date and no subject, issuer or
  server name.

Also in this release:

• The report no longer says "Partial build". It names the fifteen checks and
  states that anything outside them was not examined.
• A capture containing nothing to examine is no longer presented as well
  covered.
• Findings can be filtered by clicking the hosts and ports they name, or by
  typing one. Informational findings fold into a single row so a long report
  stays readable.
• Guide pages for every check, in plain language, reachable from any finding.

What's not in it

• Windows only. It should build for macOS and Linux; neither has been
  produced or tested.
• No export action in the app. The development CLI writes HTML and JSON
  reports; the app does not yet.
• ICMP is not decoded. R13 detects path-MTU blackholes from the TCP
  signature alone and says it could not check for the ICMP half.
• Thresholds are uncalibrated. They are starting points measured against
  synthetic captures, not real ones.

Installing

Download pcaptriage-gui.exe below. There is no installer — it is a single
file. Put it wherever you like and run it.

Windows will warn you the first time. The binary is not code-signed, so
SmartScreen shows "Windows protected your PC" with an unknown publisher. That
is expected. Click More info, then Run anyway.

SHA256  6AAEF2CB797B46D2481784F63E7B946214A9A9DF50297981275DC68D7EC32E3B

Feedback

This is an alpha. The most useful thing you can report is whether the ranking
puts the right thing first on a capture of your own — that is the one question
synthetic fixtures cannot answer.