What each tool measures, and how to read what it says.
Most network tools give you numbers. Pulse gives you the numbers and then says what they mean — which hop is at fault, whether a certificate will outlive your next maintenance window, whether the name server that is not answering matters. Where it makes a judgement, this page tells you the rule behind it, so you can disagree with it knowingly.
Three colours, everywhere, and they always mean the same thing: green measured and fine, amber worth knowing about, red a problem. A hollow dot means never measured, which is not the same as fine — an empty result is not a clean bill of health.
Latency, loss and jitter thresholds are yours to set. Settings → Thresholds. The defaults are a starting point, not a claim: latency good under 100 ms and slow under 200; loss good under 1% and slow under 5%, tighter because loss is not supposed to happen at all; jitter good under 10 ms and slow under 30.
Type a host and start. Pulse walks the whole path to it every 2.5 seconds and keeps a rolling window per hop, so you are looking at behaviour over time rather than one sample.
When a name has both an IPv4 and an IPv6 address, the system picks one and Pulse follows it. The IP version row under the host lets you choose: IPv4 or IPv6 forces that family for the session, and Both watches the two side by side, one family each, over the same interface. Pulse remembers the choice on this device.
A forced family never quietly falls back to the other one. If the name has no address of that family, if the only IPv6 address is one a mobile network made up to reach an IPv4-only host (NAT64), or if this network has no route for it, the session does not start and says which. An address typed in directly decides its own family.
Each row is a hop: its address, who owns it, then avg, cur and jit in milliseconds, and a sparkline of its recent history. The bar chart on the right draws each hop's minimum-to-maximum range against a shared axis, so a hop that is slow and erratic looks different from one that is merely far away.
When a hop reports loss, two entirely different things can be happening.
The router might be dropping your traffic — in which case everything past it suffers, and the destination sees loss too.
Or it might be forwarding your traffic perfectly and simply rate-limiting the replies it sends about itself. Many routers do this by policy. Nothing is wrong; the hop just will not talk about itself as often as you asked.
Pulse separates the two and labels them. If loss appears at hop 4 and the destination is clean, the path is fine. If loss at hop 4 continues to the destination, hop 4 is where to look.
"Stable · 3 ms · no loss over 9 rounds" is the summary of the window, not the last round. It changes as the session runs, and it is what to screenshot for a ticket.
While a Pulse runs, the chart marks the three things a phone does that explain a spike on an otherwise steady path: a roam to another access point on the same Wi-Fi, a switch between Wi-Fi and cellular or to a different Wi-Fi network, and a VPN coming up or going down. Each is a dashed line where it happened, with a small symbol. The newest three are named under the chart, a kept session lists them all under Changes, and they go into the CSV and the picture when you export. Compare shows each session's marks in its own colour.
The AI diagnosis sees them too, as the kind of change and how far into the run it happened, so it can relate a burst of loss to a roam. The access points' identifiers are not sent. Roams need Location, because iOS reveals a Wi-Fi network's details only with it; without it, switches and VPN changes are still marked.
Every session still running is listed under Running now. Swipe one left to pause, resume or stop it without opening it. A session that failed swipes away with Dismiss.
Dual Pulse measures two interfaces, or IPv4 and IPv6, at once. Every comparison names each side by what differs — "Wi-Fi (en0)" against "Ethernet (en8)", or "IPv4" against "IPv6" — and gives it a colour, blue or pink, the same on every card. Each side's figures are single Pulse's own tiles (Cur, Avg, Loss and Jitter, coloured by your thresholds), and a tick marks the better side for Avg, Loss and Jitter. Within 10% is a draw.
Optional, about twenty seconds. It measures throughput each way and — more usefully — what latency does while the line is busy. A connection that reads 5 ms idle and 300 ms under load is why calls break up when somebody starts a backup. That gap is bufferbloat.
While a Pulse runs it is also a Live Activity: on the Lock Screen, in the Dynamic Island, and in your Apple Watch's Smart Stack — no watch app needed. The card carries the verdict line from the strip above and a coloured dot. With several hosts, or two interfaces side by side, it leads with the worst one and counts the rest: "2 of 3 good".
The phone alerts you when the verdict has been bad for three rounds in a row, and again when it has been good for three rounds after that. Slow is shown but never announced, and a link that flaps between the two never holds long enough to raise an alarm. With the phone unlocked, the alert comes from the phone rather than the watch: iOS decides where it lands.
Pulse only measures while it is on screen. Leaving it pauses the session and the card says so; coming back resumes it. When every session has stopped, the card becomes a summary — "18 min · went bad 2 times · worst 480 ms" — for an hour. A Services check shows too: "Checking Teams…", then its verdict for fifteen minutes.
Free, on iPhone. Settings › Live Activity & Widget has one switch for the card and one for the alerts; iOS's own Settings › Pulse › Live Activities overrides both. The same section's Background checks switch is for the widget below.
A Home Screen or Lock Screen widget answers one question: is this
network OK right now? It shows Pulse's last check — the router and one
public host, a few pings each — with the network it was measured on and
how long ago. If the host it would check is a LAN address or name —
.local, .lan, .home,
.home.arpa, a bare name such as nas, or a name
that resolves to a home address — it checks 1.1.1.1 instead, so the
reading is always about your internet, not your own network. On a
full-tunnel VPN it reads VPN, with no separate router leg. The app
checks whenever you open it, and, with
Background checks on in Settings, whenever iOS wakes it in the
background: about every 15 to 60 minutes while the phone is in use,
rarely overnight. A widget cannot measure on its own, so the age is
always shown; a check older than six hours is greyed. Tap it to open
Pulse with that host in the field — it fills the field and starts
nothing. While a Pulse runs, the widget follows it instead,
showing that Pulse's own figures every five minutes and once more the
moment you leave the app.
Eight checks in about ten seconds, then one sentence. The checks run in causal order — link, address, gateway, neighbours, DNS, internet, public address, VPN — and the verdict names the earliest failure, because that is the one that explains the others. No link means no gateway means no DNS; reporting the DNS failure would send you after the wrong thing.
Under the verdict, every check is listed with a dot: green passed, amber a warning, red failed, grey not measured. Each check keeps its place on every run, so you learn where DNS is. Tap a name to jump to its full row.
Findings that passed are folded away. Open them when you want the figures behind a pass.
"Working over IPv6 only — IPv4 is not getting through" means the router stopped answering and every IPv4 name server went silent while the IPv6 ones still answered. It is said once, in the verdict, rather than as two separate warnings, and the DNS row names the family: "2 of 3 name servers answered, all of them IPv6; no IPv4 one did." On a network with no IPv4 address at all, the IPv6 name servers are asked over IPv6.
"Another device is using this device's address" means two devices answered ARP for the same address. Worth chasing: usually a static address handed out twice, or a device holding an address after its lease moved.
Enter a host, or host:port for anything not on 443. The SNI
field, disclosed under the target, lets you connect to one address and ask
for a different name — for checking one virtual host of many behind a load
balancer.
curl, Java and Python do not.
"Works in my browser" is exactly the bug this finds.Trust is judged by this device, including any profile or enterprise root installed on it. A certificate that works on your phone and nowhere else is worth knowing about.
Certificate leads the Look up tools. Certificate, DNS and WHOIS open on an empty field, so nothing is checked that you didn't choose. A host that never answers is given up on after 10 seconds.
Every certificate you check is watched. Pulse alerts you 30, 14, 7 and 1 days before it expires, at 9 in the morning, and tells you when it is renewed, stops being trusted, stops matching its name, or the server stops sending its intermediate certificate. The first time, iOS asks for permission to send notifications — only after you tap Turn on under a certificate result.
Re-checks run in the background whenever iOS allows, about twice a day, from your device. A captive portal, or a network that inspects encrypted traffic, makes every certificate look wrong at once; Pulse recognises that and judges nothing on that pass, so it cannot raise a false alarm. Tap an alert to check the certificate again.
The Certificate tool shows how many certificates are watched and which expires soonest. Tap it for Watching, the full list, most urgent first: tap one to check it again, swipe to stop watching it. The same list sits in Settings under Certificate alerts, with the switch. The list syncs through your own iCloud like History; the switch is set per device.
Enter a web address. Pulse loads the whole page in a private browser
session that keeps nothing — no cookies, no cache, no sign-in — and stops
when the page has loaded and gone quiet for 2 seconds, or at 30 seconds.
A typed http:// is kept, so you see its redirect to HTTPS.
cdn.example.com
belongs to example.com. Another site often does not disclose sizes or
phases to the page; Pulse says "not disclosed" rather than counting 0.Redirect hops show where each one went and how long it took; the browser does not report their status codes. A run keeps the 300 longest requests. Going to the background stops a check, because iOS pauses web pages there. Without Pro, the Web tile wears a PRO badge and Check opens the paywall.
Say it to Siri, run it from Shortcuts, or tap a button in Control Center. The phrases are English, as the app is. All of it is free, except what is Pro in the app, and nothing new leaves your device.
When another app on the phone has the same name as the service (Microsoft Teams, Zoom...), Siri may open that app instead. Say "Check a service in Pulse" and answer the question.
"My router" or "my gateway" means the gateway of the network you are on. Any other host, Siri asks for ("Which host?"); "google dot com" is understood.
Check my network, Ping, Certificate and My network answer by voice with a small card, without opening the app, within 25 seconds. Runs are saved to History like any other run; My network is not a run. The Shortcuts action Pulse a host has an optional Minutes field (1 to 1440): set it there, or in a shortcut you then run by voice or with the Action button, and the Pulse ends after that many minutes and is kept. It is not something you say to Siri.
Add the control Check network (from Pulse) in Control Center. A tap runs a Health Check in the background and posts the verdict as a notification; tap the notification to open that run in History.
The Shortcuts action Check my network has Notify: Only if not healthy (the default), Always or Never. It is made for automations, such as when you join a Wi-Fi network, and for the Action button. Siri's own phrase never posts a notification. With no connection the answer is "You're offline: no Wi-Fi or cellular."; from the Shortcuts action it also notifies according to its Notify setting, and the Control Center button always notifies.
Pro works as in the app: starting a second Pulse on the free plan says "Running more than one Pulse is part of Pulse Pro." and opens the paywall. There is no AI diagnosis through Siri.
Any record type, against the system resolvers or one you name. The strip reports the answering server and the round trip; the answers carry their TTLs. When a reply will not fit in a datagram the query is retried over TCP and the strip says so.
An empty NOERROR is amber, not red: the name exists and has
no record of that type, which is a finding rather than a failure.
NXDOMAIN — the name does not exist — is red.
Domains, addresses and AS numbers. RDAP where a registry offers it, port 43 where it does not. Expiry is banded red inside 30 days and amber inside 90 — a domain is renewed by hand on a yearly cycle, so the warning needs to arrive far earlier than a certificate's.
Ping charts round trips as they arrive, with loss and RFC 3550 jitter.
Traceroute walks the path once, over ICMP, UDP or TCP to port 443. Try TCP when the others are filtered — many networks drop ICMP and UDP probes but pass a connection to 443.
Path MTU finds the largest packet that gets through. If a router names its MTU, Pulse believes it and then verifies; if the path stays silent, it binary-searches. A path MTU below 1500 with no ICMP explaining it is the classic cause of "small pages load, big ones hang".
An SSH and telnet terminal, for the hosts the other tools point at.
Save a host with its address, user and port; keep a password or a key for
it in the device's Keychain (or generate a key in the app and paste its
public half into authorized_keys); tap it to connect. A row
of keys — Esc, Ctrl, Tab, the arrows — sits above the keyboard, and pinch
changes the font. Each host can have its own colour scheme.
From Pulse, a hop's detail sheet offers Open terminal beside Ping this hop; a device on the Devices screen offers the same. If the address belongs to a saved host, that host opens with its user and key; otherwise you are asked for a user. The first time an unsaved session connects, Pulse offers to save it.
A multi-line paste is shown in full before it goes. Every line of a paste runs the moment it lands, so anything with more than one line — or more than a few kilobytes — opens a preview first, numbered, with one Paste button.
With Pro, a session stays open when you go back to the host list and is there when you return; without it, leaving disconnects, and Pulse says so first. Pro also keeps a command history: every command you ran, per host and user, searchable, one tap to paste it back into a prompt — from the terminal's toolbar, from the host list, or from the long-press menu. Anything that looks like a password or a token is never kept, and Record command history and Sync command history with iCloud (off by default) are switches in Settings. The history is a guess taken from what the shell echoes; the optional shell integration makes the host report each command exactly.
Opened from inside a session it starts on that host, which is usually what you want — but it is not locked there. The Host menu at the top left switches to any other host, or to all of them, where everything you have run is one list, newest first, every host mixed together and each row naming the one it came from. Being connected to one machine is no reason to be unable to read what you ran on another.
The list is built to be read. A command you run forty times from now on is one row with a count beside it, not forty rows. History recorded before this version keeps the rows it already has: nothing folds them together after the fact. Commands that cannot be undone — anything that deletes, formats, overwrites or reboots — are marked, so you see them before you tap. A coloured stripe down the side of each row says which host it came from, taken from that host's own terminal colours whenever they are legible against the list. Swipe to pin the one you never want to lose: a pinned command is kept whatever else ages out, and filters for Pinned and Risky sit under the search field. Long-press a row for Edit and send… — the command opens in a field with its arguments listed as buttons, so changing an address or a number is a tap rather than a drag on a tiny cursor, and what you send still meets the same paste preview. Share hands over whatever the list is showing as plain text, one command per line with the host and the times at the top, for the ticket that asks what you ran.
From an SSH session's toolbar, or from a swipe on a host in the list, Files opens two panes over SFTP — the same login as the terminal, no second password or key. This device on one side, the host on the other. Tick what you want and press the button: Download brings the files ticked on the host over to this device, Upload sends the ones ticked here to the host, and each button says how many it is about to move. On a phone held upright the two panes become a switcher you tap between; your ticks stay put when you switch.
Whatever you move lands wherever the other pane is standing — there is no destination to choose and no folder to remember. Walk either side into a different directory first and the next transfer follows it. A download still starts out in this app's own folder — Documents > Pulse — which the Files app shows, with Share beside each finished one, and Add brings files in from Files or iCloud Drive. Folders can be opened but not ticked: whole directories are not transferred yet.
Each pane has its own menu for New folder, Rename, Delete and the sort order, and on the host side a read-only look at a file's permissions. There are no swipe actions any more — a full swipe used to delete a file on a live server. Deleting now needs a tick and a confirmation that names how many files and which host. If what you are moving would overwrite something, Pulse asks once for the whole batch, not once per file, and offers to keep both — the new one is numbered — replace, or skip. A transfer stops if you leave the app: an SSH connection does not survive the app being suspended, so Pulse keeps the screen awake while one runs and says plainly that leaving stops it.
When a batch finishes it tells you and waits — how many files moved, and how many were skipped or failed if any were. The ticks then clear for the files that actually moved, and stay on anything that failed or that you skipped, so sending those again does not mean finding them in the list a second time.
What else is on this network. Pulse sends one ICMP echo to every address in your subnet, waits, and lists what answered: your own device marked This device, the gateway marked Router, and everything else under the name it advertises over Bonjour or the name its address resolves to. Tap a row for its addresses, IPv4 and IPv6, the services it advertises, and a way to ping it or open a terminal on it.
What it cannot see, and why. A device that ignores ping does not appear. On a Mac, Pulse would also read the kernel's neighbour table and find it there — a printer or a firewalled NAS answers ARP even when it drops the echo — but iOS hands an app no hardware addresses for its neighbours at all, so on iPhone and iPad the list is what answered. This is a limit of the platform, not a setting, and no app on iOS can do better. It is also why there is no manufacturer beside each device: the name of the maker is derived from the hardware address, and there is none to read.
When it runs. Every time Overview refreshes, and no more than once every five minutes on the same network. Wi-Fi and wired only — never over cellular, and never on a network wider than a /22, which is a thousand addresses and about ten seconds. It stops when you leave the screen. Settings › Scan the local network turns it off entirely.
Check one device, or tick several and check them together, for sixteen well-known ports — SSH, telnet, DNS, web, SMB, AFP, remote desktop, three printing ports and the ones a NAS usually answers on. Nothing is checked until you tap, and the button says what it is about to do before you do: 6 devices · 96 connections. It runs one device at a time and stops the moment you tell it to.
Results stay on the row with the date they were taken. Read the date. Open ports change, and a three-week-old list presented as current is the same lie as a device list that outlived its network.
Green means the protocol on that port encrypts what it carries; amber means it sends credentials in the clear. Everything else is left uncoloured, because "SMB is open on your NAS" is not a finding, it is a Tuesday.
Name a device and the name sticks — through a new address and a new scan, and above whatever the network calls it. Pulse also remembers what was there last time, so anything new says New, and a device that was there before and is missing now is listed as Absent rather than deleted: a laptop that is shut is not a laptop that is gone.
A device Pulse has not seen for ninety days is forgotten, along with its first-seen date and any ports a check found. Settings › Forget devices not seen for offers thirty days, a year, or never. A device you have named is always kept, however long it has been away — naming it is the one thing here that costs you effort, and a timer should not undo that. So there is a way out by hand: open a device and choose Forget this device, or Forget them now in Settings to apply the cap immediately. Neither touches anything on the network; the next scan finds the device again, as new.
What is remembered stays on the device, and syncs only to your own private iCloud if you turn that switch on. Nothing about your network is sent anywhere else, and the device list is never part of an AI diagnosis.
Sixteen everyday services in four groups — video calls (Teams, Zoom, Google Meet, Webex), files (OneDrive, SharePoint, Google Drive, Dropbox), sign-in & mail (Entra ID, Okta, Google sign-in, Exchange Online, Gmail), remote desktop (Azure Virtual Desktop / Windows 365, Citrix Cloud, GlobalProtect (Prisma Access)). They wait behind one line on the Pulse screen, Services · 16, so they take no room until you want them: tap the line to open the four groups, each service marked with a dot in its own colour. Once you have checked one, the line also shows your last check and how it went; tap that to run it again. Tap one and Pulse spends about fifteen seconds probing its real endpoints: a STUN binding to the media relay for Teams and Meet, a TCP connect for a gateway, and HTTPS timing — DNS, TCP, TLS, first byte — for the rest. Any answer at all counts as reachable.
The result is a plain verdict, in the same words the rest of the app uses: Calls should be fine, Sync is slow, Sign-in unreachable — other services will fail too, Mail unreachable. One tap on the card starts a Pulse on the worst endpoint it found.
What "reachable" does not mean. Zoom and Webex calls are reported as Reachable — call quality not measured, not as a verdict on the call itself, because their media servers do not answer a test the way Teams and Meet's do. Saying less than the other video calls here is the honest answer, not a missing feature.
Remote desktop is not capped the same way. Azure Virtual Desktop and Windows 365 measure their own gateway over TCP, so the card gets real words about the session — Should feel responsive, Expect some lag, Expect heavy lag, Can't reach the gateway — the same as any other measured check. Citrix Cloud and GlobalProtect (Prisma Access) earn the same words too, but only once your organisation's own gateway is known — see below. Until then, that row reads Needs your organisation name, not a guess about a gateway Pulse cannot yet address.
A check adds a hint when it finds a specific reason: UDP looks blocked and the call will fall back to TCP, Zoom's own port 8801 looks blocked and it will fall back to 443, a Wi-Fi sign-in page is intercepting the traffic, a certificate came back from a named proxy that inspects TLS, or sign-in itself was unreachable a few minutes ago and everything else is probably feeling it too.
Your organisation, by name (Pro). SharePoint, Okta, Citrix Cloud
and the Prisma Access portal of GlobalProtect are yours, not a public endpoint
Pulse already knows. GlobalProtect is checked through Palo Alto's Prisma
Access cloud — the name before .gpcloudservice.com; a
GlobalProtect portal your organisation hosts itself, and Zscaler, are not
checked yet. Pro is asked for a name the first time a check needs
one; free is never asked, because the endpoint it would check is a Pro row
— either way, skipping or going without leaves that service reading
Needs your organisation name until a name is given. What you type
stays on your devices; it is sent to Pulse's server only inside an Explain
this you ask for.
Free sees the headline and the one endpoint that is worst. Pro sees every endpoint's own figures, your organisation's endpoints checked by name alongside the public ones, and Explain this — an AI reading of the check, written the same way as a Pulse or Health Check diagnosis, and sent only when you ask.
Every check is kept in History like any other run, with its own filter chip. Free keeps seven days of it, same as everything else.
The list of services is not fixed to the version of the app you installed: it refreshes from Pulse's server about once a day, so a service can be added without an app update.
Every run is kept, grouped by day. Each row carries the time, the target, the headline figure and the context — how long it took, where you were, and which interface it went over.
A stored run is judged again every time you open it, against today's thresholds — not frozen at the verdict it was recorded under. A certificate check saved when it had 40 days left reads red once it has 10. Change a threshold in Settings and every past run re-colours.
Free keeps seven days. Pro keeps everything and syncs it through your own iCloud, together with your settings: the default terminal colour scheme, the Pulse limits, organisation names and how long devices are remembered. Settings that belong to one device, such as its name or whether it scans the network, stay on that device.
Share session, on a saved session or the one running, sends a link to Messages, Mail and everything else in the share sheet — tap it and Pulse opens the session — and the file to AirDrop and Save to Files. A running session is sent as it stands and keeps running.
Your Wi-Fi name, public address, place and any AI diagnosis are never in
the file or the link, and the names of devices on your home network are
removed from the path. What the comparison needs stays: the routers along
the way, the networks they belong to and your provider's name. Pulse itself
uploads nothing: the link carries the session itself, after the
#, and the page it opens on peltriaux.com never sees it.
A session you are sent is kept in History as "Shared by" whoever sent it, apart from your own: it is never offered as one of your recent hosts or as a session to continue, and it is not sent to the AI diagnosis. Opening the same session twice, even once as a link and once as a file, keeps one copy.
Put it next to one of your own sessions to the same host, or tap Pulse it from here to run one beside it and watch yours fill in live. Two networks part at the first hop, so the comparison shows where the two routes meet — the first router, or the first network, you both pass through — and whether the difference is before that point, on one person's own line, or after it, on the part you share. When the host answers each of you from a different server, it says so and compares the figures alone. Sharing is free; comparing is part of Pulse Pro. The name your sessions go out under is asked the first time you share, and lives in Settings under This device.
Stand an iPhone Duo half-open with the top half standing up and every tool splits at the fold, by one rule: what you watch goes on the standing half, what you touch goes on the flat half. The hinge runs between them.
Run buttons leave the top bar for the flat half, and one row just under the fold has ‹ Back to the tool's landing and Toolbox on every split screen. Open flat, Pulse uses the whole screen with the toolbox beside your results; closed, the outer screen works as on any iPhone. The split needs nothing from you and turns itself off when you open or close the phone.
The globe in the toolbar pins every tool to one interface — Wi-Fi, cellular, a VPN tunnel — so you can measure them separately and compare. Interfaces that cannot currently carry a probe are still listed, with the reason beside them and a coloured dot: not connected in red, no address or no way out in amber. They stay selectable on purpose: the interface you most want to investigate is often the broken one.
Label the network you are on — "Home", "Office", a client's name — and every run made there is filed under it. It makes History readable months later and stops you comparing two runs that were never comparable.
On a network Pulse has not seen before it can suggest a name, which it gets by asking iOS for your position at kilometre accuracy and turning it into a suburb. Accept it, type your own, or leave it blank. Until you accept, runs keep the label you last chose; stopping a Pulse asks again, on the card that offers to save it, so a session away from home is not filed under home by accident. The coordinates are never stored and never leave the device; the label does travel — it is saved with your runs and included when you ask for an AI diagnosis. See the privacy page.
Every network test is free and unlimited, along with seven days of history and three AI diagnoses. Pro adds:
It reads the run's own numbers and writes what is wrong, where, why it is probably so, and what to try next — with the evidence it used and a confidence rating. It can be wrong: check the hops it names before acting.
The run leaves your device to produce it. The first time you ask, Pulse shows you exactly what is sent and waits for you to agree. The privacy page lists it in full.
Local network — needed for the Devices list, the neighbours check in Health Check, and the link test. iOS asks the first time; decline it and those show only this device. Location — iOS requires it before any app can read the Wi-Fi network's name, and Pulse also uses it at kilometre accuracy to suggest a place label for a network you have not seen before. Your coordinates are never stored and never leave the device; only a label you accept does. See the privacy page. Declining either leaves the rest of the app working. Notifications — asked only when you turn on certificate alerts; decline it and certificates are still watched, with no alert.