What NetDoctor sends, and privacy

Note

NetDoctor is in development. The engine, the netdoctor command line and the NetDoctor.exe desktop app are implemented and tested internally; there is no public download or release yet. This page describes the current implementation.

At a glance

See the plan before anything is sent

netdoctor probes reads the network configuration and sends nothing. It lists each probe a diagnosis would send on this computer, with your actual gateway and DNS server addresses: the kind of probe, the destination, who operates it, why it is sent, the maximum count, and whether it is sent only when an earlier test calls for it. It ends with the most data the probes could exchange.

Before netdoctor or netdoctor gaming sends anything, a summary of the same plan is printed. The desktop app shows the full list for the chosen adapter and options under “What will be contacted” before you press Start. If the list has changed by the time you start (a VPN connected, the route changed), it sends nothing and shows the new list instead. After the diagnosis, the report’s “Contacted” list gives every destination actually contacted, how many probes went to it and roughly how many bytes were exchanged.

Who is contacted

--local-only limits a diagnosis to the local network, your DNS servers and the proxy configuration, at the cost of not testing the internet. While a VPN carries your internet traffic, NetDoctor keeps its own probes inside the tunnel and does not send them over a path that would bypass it.

Never sent, never collected

• No telemetry, crash reporting or usage statistics. Results stay on your computer unless you share them.
• Your public IP address is never looked up.
• Hardware (MAC) addresses, the Wi-Fi network name, the access point address, the Wi-Fi profile name, the computer name and the user name are not collected.
• Only fixed test names are looked up (plus an endpoint you name and the load-test server); nothing about your browsing.
• URLs are reported without credentials or query strings, and a redirect only by its host. Response bodies are compared with the expected text, never stored.
• Credentials are never stored or reported. Your Windows sign-in is offered to a proxy only if it is a proxy you configured yourself, never to one found by automatic detection.

Web requests identify themselves with the user agent NetDoctor/ followed by the version.

What a report contains

To explain its verdict, a report includes this computer’s IP addresses (which can be public, for example a global IPv6 address), the gateway, DHCP and DNS server addresses, adapter names and descriptions, DNS suffixes, name-resolution policy namespaces and proxy settings. Review a report before you share it.

The loaded-latency test

The gaming check can optionally measure latency while your connection is saturated. It is the only traffic beyond small probes. Before anything is sent, NetDoctor shows the direction, the server, the longest each direction runs (10 seconds by default) and the most data it will transfer (100 MB per direction by default), and that this counts against a metered or capped data allowance. On the command line only typing y or yes starts it; anything else, including just Enter, cancels without sending anything. Ctrl+C stops it at once. The desktop app asks in its own confirmation, separate from the Start button, and Stop (Esc) ends it.

What the desktop app keeps

The desktop app keeps no diagnostic history. It writes only to %LOCALAPPDATA%\UtilityForge\NetDoctor\Desktop:

• settings.json: the theme, the zoom and the window position. Never an adapter, address, endpoint, option or result.
• error.log, only after an unexpected error.

Delete the folder to forget them. A report is saved only when you copy or export it. Remove identifying details, on by default, replaces this computer’s addresses, adapter identifiers, DNS suffixes, proxy settings, an endpoint you named and similar values with numbered placeholders. Adapter names, private addresses such as a home router’s, NetDoctor’s own reference endpoints and every number stay in the report, so read it before you share it.

Read-only guarantees

• NetDoctor never changes DNS servers, routes, adapters, firewall rules, proxy settings or Windows services, never flushes a cache and never resets Winsock. Registry keys are opened read-only.
• A TCP probe only opens a connection (a single connection request where Windows supports limiting it), sends no data and closes at once.
• HTTPS certificates are validated and never bypassed. Redirects are recorded, never followed, and cookies are never stored.
• Every probe has its own timeout and the whole diagnosis a time limit.

There is no “fix it” button. When NetDoctor knows what is wrong, it says what you can check or change yourself. The guide Websites do not load but Windows says you are connected walks through the same checks by hand, including the fixes and their warnings.

Signing and reporting

There is no public release yet, so nothing can be downloaded or verified. The packaging pipeline builds reproducible portable ZIPs with SHA-256 sums, a manifest and an independent verifier, but every package so far is an unsigned internal build that is not distributed. A public NetDoctor release would follow the same pipeline as every Utility Forge application: published SHA-256 checksums, immutable release paths, a signed or unsigned status stated before download and the owner’s approval of the exact files. No code-signing certificate exists; free signing is being evaluated, and an unsigned NetDoctor release would first need its own policy decision. The security page explains what Windows shows for signed and unsigned files and how to report a vulnerability. Please do not report security issues in public.