What each tool measures, and how to read what it says.
Most network tools give you numbers. Pulse gives you the numbers and then says what they mean — which hop is at fault, whether a certificate will outlive your next maintenance window, whether the name server that is not answering matters. Where it makes a judgement, this page tells you the rule behind it, so you can disagree with it knowingly.
Three colours, everywhere, and they always mean the same thing: green measured and fine, amber worth knowing about, red a problem. A hollow dot means never measured, which is not the same as fine — an empty result is not a clean bill of health.
Latency, loss and jitter thresholds are yours to set. Settings → Thresholds. The defaults are a starting point, not a claim: latency good under 100 ms and slow under 200; loss good under 1% and slow under 5%, tighter because loss is not supposed to happen at all; jitter good under 10 ms and slow under 30.
Type a host and start. Pulse walks the whole path to it every 2.5 seconds and keeps a rolling window per hop, so you are looking at behaviour over time rather than one sample.
Each row is a hop: its address, who owns it, then avg, cur and jit in milliseconds, and a sparkline of its recent history. The bar chart on the right draws each hop's minimum-to-maximum range against a shared axis, so a hop that is slow and erratic looks different from one that is merely far away.
When a hop reports loss, two entirely different things can be happening.
The router might be dropping your traffic — in which case everything past it suffers, and the destination sees loss too.
Or it might be forwarding your traffic perfectly and simply rate-limiting the replies it sends about itself. Many routers do this by policy. Nothing is wrong; the hop just will not talk about itself as often as you asked.
Pulse separates the two and labels them. If loss appears at hop 4 and the destination is clean, the path is fine. If loss at hop 4 continues to the destination, hop 4 is where to look.
"Stable · 3 ms · no loss over 9 rounds" is the summary of the window, not the last round. It changes as the session runs, and it is what to screenshot for a ticket.
Optional, about twenty seconds. It measures throughput each way and — more usefully — what latency does while the line is busy. A connection that reads 5 ms idle and 300 ms under load is why calls break up when somebody starts a backup. That gap is bufferbloat.
Eight checks in about ten seconds, then one sentence. The checks run in causal order — link, address, gateway, neighbours, DNS, internet, public address, VPN — and the verdict names the earliest failure, because that is the one that explains the others. No link means no gateway means no DNS; reporting the DNS failure would send you after the wrong thing.
Findings that passed are folded away. Open them when you want the figures behind a pass.
"Another device is using this device's address" means two devices answered ARP for the same address. Worth chasing: usually a static address handed out twice, or a device holding an address after its lease moved.
Enter a host, or host:port for anything not on 443. The SNI
field, disclosed under the target, lets you connect to one address and ask
for a different name — for checking one virtual host of many behind a load
balancer.
curl, Java and Python do not.
"Works in my browser" is exactly the bug this finds.Trust is judged by this device, including any profile or enterprise root installed on it. A certificate that works on your phone and nowhere else is worth knowing about.
Any record type, against the system resolvers or one you name. The strip reports the answering server and the round trip; the answers carry their TTLs. When a reply will not fit in a datagram the query is retried over TCP and the strip says so.
An empty NOERROR is amber, not red: the name exists and has
no record of that type, which is a finding rather than a failure.
NXDOMAIN — the name does not exist — is red.
Domains, addresses and AS numbers. RDAP where a registry offers it, port 43 where it does not. Expiry is banded red inside 30 days and amber inside 90 — a domain is renewed by hand on a yearly cycle, so the warning needs to arrive far earlier than a certificate's.
Ping charts round trips as they arrive, with loss and RFC 3550 jitter.
Traceroute walks the path once, over ICMP, UDP or TCP to port 443. Try TCP when the others are filtered — many networks drop ICMP and UDP probes but pass a connection to 443.
Path MTU finds the largest packet that gets through. If a router names its MTU, Pulse believes it and then verifies; if the path stays silent, it binary-searches. A path MTU below 1500 with no ICMP explaining it is the classic cause of "small pages load, big ones hang".
Every run is kept, grouped by day. Each row carries the time, the target, the headline figure and the context — how long it took, where you were, and which interface it went over.
A stored run is judged again every time you open it, against today's thresholds — not frozen at the verdict it was recorded under. A certificate check saved when it had 40 days left reads red once it has 10. Change a threshold in Settings and every past run re-colours.
Free keeps seven days. Pro keeps everything and syncs it through your own iCloud.
The globe in the toolbar pins every tool to one interface — Wi-Fi, cellular, a VPN tunnel — so you can measure them separately and compare. Interfaces that cannot currently carry a probe are still listed, with the reason beside them and a coloured dot: not connected in red, no address or no way out in amber. They stay selectable on purpose: the interface you most want to investigate is often the broken one.
Label the network you are on — "Home", "Office", a client's name — and every run made there is filed under it. It makes History readable months later and stops you comparing two runs that were never comparable.
On a network Pulse has not seen before it can suggest a name, which it gets by asking iOS for your position at kilometre accuracy and turning it into a suburb. Accept it, type your own, or leave it blank. The coordinates are never stored and never leave the device; the label does travel — it is saved with your runs and included when you ask for an AI diagnosis. See the privacy page.
Every measuring tool is free and unlimited, along with seven days of history and three AI diagnoses. Pro adds:
It reads the run's own numbers and writes what is wrong, where, why it is probably so, and what to try next — with the evidence it used and a confidence rating. It can be wrong: check the hops it names before acting.
The run leaves your device to produce it. The first time you ask, Pulse shows you exactly what is sent and waits for you to agree. The privacy page lists it in full.
Local network — needed to see the other devices on your network and for the link test. Location — iOS requires it before any app can read the Wi-Fi network's name, and Pulse also uses it at kilometre accuracy to suggest a place label for a network you have not seen before. Your coordinates are never stored and never leave the device; only a label you accept does. See the privacy page. Declining either leaves the rest of the app working.