Network Analyzer
Help
Network Analyzer is an all-in-one tool for network analysis, scanning, and problem detection. All the tools are split into several pages: Information, Wi-Fi Signal, UPnP & Bonjour, LAN, Tools, Speed, Routing Table, Connections, and About.
Some of the displayed values (for which it makes sense) can be copied. Hold the value to invoke the Copy popup. Also, most of the pages offer the possibility to export the results. Simply press the action button (or menu button on Android) in the toolbar and select the desired export type.
The Information page displays various network-related information such as the default gateway, DNS server, and external IP (displayed after pressing the Reload button). Further, wifi network information is available, including SSID, BSSID, IP address, subnet mask, received/sent data, and some additional info. Finally, cell network information includes cell IP address, carrier name, country code, MCC/MNC, VOIP availability, signal strength, and received/sent data. When connected using VPN, the page also displays some basic information about the VPN connection. The amount of the available information differs based on the used operating system - some of the above entries are available only under iOS, some only under Android.
Further, the Information page provides access to the list of Bonjour services available on the wifi network. After pressing the Bonjour Services item under the Wi-Fi section, the list of available service types is revealed. After pressing a service type, new page with all the services of the given type appears. The services are grouped by the hostname. For each service, the service name, IP address and port are displayed together with an optional list of TXT records assigned to the service.
Finally, UPnP/DLNA services and devices can be accessed from the UPnP Services item, including the associated entries and related subservices and subdevices.
Note: This feature is available in the Android version of the app only.
The Wi-Fi Signal page shows all the Wi-Fi networks in the neighborhood together with their signal strengths, associated channel and other information. There are three different views: channel list, channel graph, and channel usage. The views can be toggled by a view selection button in the toolbar or by swiping left/right between the individual screens. Also, the first toolbar icon toggles between the 2.4 GHz and 5 GHz ranges.
For each Wi-Fi network the channel list shows the channel number, SSID and the signal strength (colors indicate the signal strength: green - strong, yellow - medium, red - weak), BSSID, the corresponding manufacturer, network type (WEP, WPA, WPA2), encryption standard used (TKIP, AES), channel width and whether the network supports WPS. The connected network is shown with a green background. It is possible to search for a given network by pressing the loupe icon in the toolbar or sort the list by signal strength, channel or SSID by selecting the corresponding item from the toolbar menu. Each of the rows in the list is selectable - when a row is selected, a page with additional details about the network is shown. Here, one can also override the network name with a custom name which is then shown instead of SSID.
In the channel graph view, the X-axis shows channel numbers and the Y-axis the signal strength in dBm. The individual network signal masks are depicted in the graph together with the corresponding network name (SSID or custom name, see above). The networks are displayed so that it is easy to see the overlap of their bandwidths.
Finally, the channel usage view shows all the networks which use thegiven channel. The values are stacked on top of each other and are normalized relative to the most used channel. The colors correspond to the networks from the channel list or channel graph. This view is useful for determining the least used channels when setting up a new Wi-Fi network. For instance, when the new network uses 20MHz bandwidth it spans four channels. One should look for the four smallest neighboring values in the plot and select the middle channel as the channel used by the router. Note that also signal strengths should be taken into account - often it is better to use a channel with many weak signals than a channel with a single strong signal as the weak signals are more or less a noise and interfere much less than the strong signal. Also, the signal strengths change depending on your location - pick the best channel for the locations where you plan to use the Wi-Fi network most.
Note that the channel width information is only accessible on Android 6 and newer devices - for older devices the 20MHz width is always displayed.
The UPnP & Bonjour page provides access to the list of UPnP/DLNA and Bonjour services available on the wifi network.
After pressing the Bonjour Services item, the list of available service types is revealed. After pressing a service type, a new page with all the services of the given type appears. The services are grouped by the hostname. For each service, the service name, IP address and port are displayed together with an optional list of TXT records assigned to the service.
UPnP/DLNA services and devices can be accessed from the UPnP Services item, including the associated entries and related subservices and subdevices.
The LAN page provides access to the LAN scanner. LAN scanner scans all IP addresses in the connected wifi network and discovers devices connected to the same network. The scan can be initiated by pressing the green Scan button in the top-right corner of the page. The Options button (or menu button on Android) in the toolbar can be used to display a list of additional actions which can be performed from this page:
-
Clear History deletes all the history items from the list.
-
Scan Custom IP Range can be used to scan a custom range of IP addresses which can be different from the wifi network configuration. The custom range can be entered in the subsequent dialog.
-
Wake on LAN sends a special WOL packet to the device with the provided MAC address. Note that to make WOL working, the target device should be connected to the network using a wired connection (WOL usually does not work over wifi) and has to be configured to accept WOL packets (this is usually configured using BIOS). Apart from local WOL, Network Analyzer can also send the WOL packet to a remote device. In that case, the IP address and port of the remote device have to be configured. Note that if the remote device is behind a router, the router has to be configured to send the WOL packet to the target device.
LAN Scan History
The LAN scan history page shows the list of the most recently scanned networks. Apart from the network's name, each entry also shows the address range of the network together with the date of the last scan. In addition, if the network is the connected one, a green indicator is shown (otherwise the indicator is gray). The number next to the indicator displays the number of devices found during the last scan.
When touched, the entry reveals the result of the last scan. The star icon on the left of each entry can be used to move the entry into the Starred section which groups user's favorite networks.
Wake on LAN actions are displayed in the list as well and provide a shortcut to WOL of the given device.
Items can be deleted from the history by the swipe-to-delete gesture (or long-pressing a row on Android). In addition, the whole history list can be cleared using the Options button (or menu button on Android) as described above.
LAN Scan
During the scan, a progress bar indicating the scan progress is displayed in the top part of the screen. Below the progress bar, there is an entry with the currently scanned IP address and the number of remaining addresses to be scanned. The scan can be interrupted at any moment by pressing the red Stop button in the top-right corner.
Once scanned, the list displays all the discovered devices together with the network name. Each entry contains the device name when available (mDNS, NetBIOS, LLMNR or DNS name), IP and MAC addresses and the device manufacturer (the last two are not available on iOS 11 and later because of privacy restrictions). In addition, some device properties are displayed using colored flags:
-
P - pingable (green): the device responds to ICMP ping requests
-
B - Bonjour (brown): the device provides Bonjour services
-
U - UPnP/DLNA (blue): the device provides UPnP/DLNA services
-
G - gateway (red): the device is a gateway
-
S - scanning device (yellow): the device from which you perform the scan
-
6 - IPv6 (purple): there are known IPv6 addresses for the device
-
W - web interface available (cyan): port 80 or 443 open
The scan result can be filtered using the magnifying glass icon in the toolbar. When entering text, all entries containing the given text in any displayed field are shown. In addition, it is possible to filter based on flag availability by prefixing the flag letter with # so for instance #P shows all pingable devices. By using the special value #name one can show only those items whose name is available.
More details about a network device can be revealed by pressing the list item.
LAN Device Details
The Details page contains some additional details about the device. Apart from this information, there is also a shortcut to the Tools page to simplify querying the current device. It is also possible to send the WOL packet to the device and browse the Bonjour/UPnP services which the device provides. In addition, when either port 80 or 443 is open, the Web Interface entry opens the web browser to see the web interface provided by the device. Finally, one can set a custom name of the device - this name is then used in the list of discovered devices instead of the detected one.
The Tools page contains the most commonly used network tools such as ping, traceroute, portscan, whois, and DNS lookup. New query can be created by pressing the green New button in the top-right corner of the page.
Tools History
The tools history page shows the list of most recently queried hosts and IP addresses together with the query types. The query types are ordered in the order of their use with the most recently used one displayed in darker color. Favorite queries can be moved into the Starred section of the list by pressing the star on the left of each entry. By pressing an entry, the query is initialized with the last used parameters of the query. Items can be deleted from the history by the swipe-to-delete gesture (or long-pressing a row on Android). In addition, the history list can be cleared using the bin button (or menu button on Android) in the toolbar.
Tools Query
The tools query page lets you specify the IP address or host/domain name to analyze (it is possible to enter the full URL, the domain name is extracted automatically) together with the type of the query to perform. The query is initiated by pressing the green Start button in the top-right corner of the screen.
Ping
The Ping tool can be used to determine the round-trip delay between your device and the analyzed device or determine whether the analyzed device is reachable. To work correctly, ICMP packets must not be filtered by the router and the receiving device has to respond to ping requests. The parameter Probe delay sets the frequency of ping probes. The default value is once per second. The Payload size parameter allows setting the size of the ping packet excluding the size of the packet header.
Once started, the ping display starts showing the probes sent to the other device together with the round-trip delay time. Ping can be stopped by pressing the red Stop button in the top-right corner. If no response is received from the remote device, the indicator stays gray (otherwise it turns green) and no round-trip delay information is shown. When available, also hostname and flag indicating the location of the remote server are displayed.
After pressing an entry, more details about the remote server are shown. In particular, apart from the IP address, hostname and round-trip delay, there are more details about the location of the server together with a map showing the server's approximate location. The location information is IP-address-based so it can be very inaccurate sometimes. When available, also the autonomous system number and name of the network are displayed.
The Statistics entry reveals a page with the graphical representation of ping times and additional ping statistics. The display is live and statistics are computed even when ping is running.
Route
The Route option offers the traceroute tool which can be used to determine the network nodes on the way to the server. Normally Network Analyzer sends new probes immediately after receiving a response from the server for the previous node. The Min. delay parameter can be used to slow down the speed by the specified amount of time between the probes. The Max. delay parameter is used as a wait time when no response is received from the server. Note that in total 3 probes are sent to each node, so the total time spent on a single node is 3-times the specified time. The UDP probes parameter allows using UDP probes instead of the default ICMP probes. This may help to penetrate certain firewalls.
Once started, the traceroute display starts showing the list of devices on the way to the destination. The format of the output is similar to the output of the Ping tool. The round-trip delay time shown in the list corresponds to the median value of the three probes sent. Similarly to Ping, after clicking an entry, the details display appears with additional data about the server node. There is also a shortcut button to further query the given node with the tools.
At the top of the traceroute list, there is the Visual Route entry which reveals all the nodes displayed on the map. Each of the pins can be tapped to display a bubble with the node number and round-trip time (or ranges when the given location corresponds to multiple network nodes). The green pin corresponds to the destination location, the blue pin to the current location.
The location information is based on the node's IP addresses. Network Analyzer uses the MaxMind GeoIP databases available at www.maxmind.com. In certain cases (e.g., when the IP is assigned to an international company with the seat in a different country or when anycast is used), the location information corresponds to the company seat rather than the actual server location. At best, IP-based location services provide the city, where the IP is located, but cannot be used to provide its exact location.
Ports
The Ports option starts a port scanner which lets you scan the given host for open TCP ports. This can identify services running on the scanned device. With the Common option selected, only the most commonly used ports are scanned. With the All option, all ports in the specified range are scanned.
Once started a progress bar appears in the top part of the screen together with the current port being scanned and a number of ports left. Note that the information about ports being open or closed may only be displayed after some time because of the network delay.
Open ports (indicating that the service is available) are marked with a green indicator. Port number and port name together with its description are shown for open ports. In addition, if another app is registered for the given service, it is possible to open the app with the given URL by tapping the entry (a right arrow appears for such entries). Closed ports and ports blocked by a firewall are displayed with red and gray indicators, respectively, together with the corresponding port ranges.
Whois
The Whois option reveals the domain's entry from the public Whois database. The output can be zoomed-in/out for better readability.
DNS
The DNS option serves for performing a DNS lookup for a domain name or a reverse DNS lookup when an IP address is entered. By default, the system DNS server is used for the query, but it can be overridden when needed. By selecting Show DNSSEC it is possible to request DNSSEC, records which are then displayed in the result when available. Status of the query is displayed in the first row of the result page (the output corresponds to dig). Individual records are listed below, grouped by the record type. The following query types are supported: ANY, A, AAAA, CAA, CNAME, MX, NAPTR, NS, PTR, SOA, SRV, and TXT. In addition, when performing the ANY query, many more record types are decoded, including DNSSEC records. Currently unsupported record types are shown in the generic RFC 3597 format. For more information about the individual records and the displayed fields, please refer for instance to this Wikipedia article.
The Speed page lets you test your Internet speed. The test is started by the green Start button in the top-right corner of the screen. The test can be interrupted at any time by pressing the red Stop button at the same place. Network Analyzer automatically selects the servers nearest to your location and uses them for testing.
The test itself takes approximately 30 seconds, and the progress is indicated by the round blue indicators. During the test, the current speed measurements are displayed and plotted in the graph. Once finished, the average network download and upload speeds are displayed, both in megabits and megabytes per second and the resulting value is plotted with a yellow color in the graph. After a successful test, a new item is added to the history list which is accessible from the toolbar.
Note: This feature is available in the Android version of the app only.
The Routing Table page displays the network routing table (for IP and IPv6). Each row contains the following values (see, e.g., this page for more info):
-
Destination - destination address
-
Gateway - gateway used for the given address
-
Iface - network interface name
-
Flags - described below
The most common flags are:
-
U (UP) - route usable
-
G (GATEWAY) - destination requires forwarding by intermediary
-
H (HOST) - host entry (net otherwise)
-
D (DYNAMIC) - created dynamically (by redirect)
-
M (MODIFIED) - modified dynamically (by redirect)
-
A (ADDRCONF) - has associated entry in ARP table
-
C (CACHE) - cache entry
Note: This feature is available in the Android version of the app only.
The Connections page displays active network connections for various protocols (TCP, UDP, IP, IPv6) shown in table section headers. For every connection, the following values are available: local IP address and port, remote IP address and port, remote hostname, and connection state. The value * in the address or port field means all or not specified. The state value can be one of the states listed in TCP protocol operation. When the connection is made by an application, the app name is shown at the top of the row. The name is not available when the connection is made by an Android system process.
The About page shows information about Network Analyzer and provides some useful links and general information about the application.
Please have a look at the support page corresponding to your system for the complete list of frequently asked questions and further support: