# Edge network probes

Scripts for the **Debian router** (`134.17.26.161` / `10.7.6.228`) — not FE/BE app hosts.

## `wan-snapshot.sh`

Periodic ping comparison:

| Target | Default | Meaning |
|--------|---------|---------|
| **WAN** | `1.1.1.1` | ISP/upstream leg (outbound from router) |
| **FE** | `10.7.0.10` | LAN leg router → Gentoo FE |
| **BE** | `10.7.16.128` | Optional deeper LAN (disable: `BE_PING_TARGET=none`) |

### Install (router)

```bash
sudo cp examples/network/wan-snapshot.sh /usr/local/bin/wan-snapshot.sh
sudo chmod +x /usr/local/bin/wan-snapshot.sh
```

### Cron (every 15 minutes)

```cron
*/15 * * * * root /usr/local/bin/wan-snapshot.sh >>/var/log/wan-quality.cron.log 2>&1
```

Log: `/var/log/wan-quality.log` (override with `WAN_SNAPSHOT_LOG`).

### Usage

```bash
# one line appended + printed
sudo /usr/local/bin/wan-snapshot.sh

# compare tonight vs yesterday
/usr/local/bin/wan-snapshot.sh --report

# recent samples
/usr/local/bin/wan-snapshot.sh --tail 48
```

Example log line:

```text
ts=2026-06-04T21:15:01+02:00 wan=1.1.1.1 wan_loss=0% wan_avg_ms=11.2 fe=10.7.0.10 fe_loss=0% fe_avg_ms=0.3 be=10.7.16.128 be_loss=0% be_avg_ms=0.5
```

### Reading results

- **`wan_avg_ms` high, `fe_avg_ms` low** → ISP/upstream (your “rocketship vs gap” bet).
- **Both high** → router CPU, conntrack, or local link.
- **Ping good, HTTPS/git slow** → DNAT or service layer (not measured here).

From **outside** LAN, still run occasionally:

```bash
mtr -rwzc 50 134.17.26.161
```

That catches path issues ping from the router cannot see.