NetMaster vs Kodura SSL Analyzer

NetMaster helps explain slowdowns, instability, and intermittent dropouts without an account, ads, analytics, or tracking. RUN A COMPLETE NETWORK SCAN • Measure download and upload goodput with parallel HTTPS requests • See HTTPS latency, adjacent response-time variation, request failures, and a second latency vantage point • See confidence ranges and a p95 only when enough observations support it • Check direct UDP DNS response delivery across two providers, including bursts • Check latency under load and receive a bufferbloat grade • Compare everyday and first-time DNS response times • See the DNS transport observed for NetMaster’s measured request and compare resolver performance • Test real IPv4 and IPv6 reachability • Time the router hop and see whether added delay is local or farther upstream • Review public IP, ASN, egress region, TLS, HTTP, Wi-Fi security, captive-portal evidence, and tunnel indicators • Optionally install the bundled NetMaster Shortcut for connected iPhone Wi-Fi channel, standard, RSSI, noise, and RX/TX PHY rates — no compatible router or controller required • Watch live signal/noise, negotiated PHY rates, passive device traffic, and access-point changes • Compare the OS route gateway, Apple, Cloudflare, Google, and selected public-service latency graphs, rotating one probe at a time • Optionally select an M-Lab server for a separate single-flow route cross-check NARROW DOWN CONNECTION PROBLEMS Quick Diagnosis checks the path, router, internet, DNS, and responsiveness in sequence, then gives one likely explanation and a practical next step. INVESTIGATE INTERMITTENT DROPOUTS Run a 5-, 15-, or 30-minute monitor. On iOS 26, a user-started finite session can request lock-screen continuation; earlier versions must keep NetMaster visible. NetMaster records route changes, HTTPS heartbeats, gateway/DNS controls, IPv4/IPv6 evidence, latency changes, unknown gaps, and optional AP-roaming evidence. ESTIMATE ACTIVITY NEEDS Cautious assessments cover calls, 4K streaming, gaming, browsing, and uploads while naming the measured evidence and its limits. Protected history compares the same network over time, with a metrics-only mode. WATCH YOUR MAC FROM IPHONE Pair one iPhone to your Mac through private iCloud. See processor, memory, thermal, battery, and Mac traffic updates, 30-day history, eligible alerts, and PDF/CSV reports. Storage and low-storage findings remain visible only on the Mac. Remote speed tests require confirmation. BUILT FOR HONEST RESULTS A payload budget controls data use. Replenished parallel transfers target a stable window; when the cap ends a fast test too soon, the result is a lower bound, not a claimed maximum. Full-scan HTTPS timing is not ICMP ping; the separate live-latency board uses explicitly labeled ICMP echo. HTTPS adjacent response variation is not packet jitter; HTTPS request failures and UDP DNS response loss are not raw packet loss. PRIVACY BY DESIGN History stays in protected on-device storage. Optional Mac monitoring uses your private CloudKit database and no developer monitoring server. Reports leave only when you choose Share, with address redaction on by default. Important: Direct iOS app APIs omit exact radio values. The optional user-installed Shortcut uses Apple's Get Network Details action for connected RSSI, noise, channel, standard, and PHY rates; derived band can be ambiguous. Channel width, RF spectrum health, and cellular dBm are never invented. Wi-Fi identity needs permission. Balanced allows about 54.5 MB of throughput payload plus small requests and protocol overhead. Results are evidence, not proof that a router, carrier, VPN, or service is defective.

A TLS checker that tells you what is wrong, not just what is there. Point it at any host and port. It performs a real TLS handshake, reads the certificate chain the server actually sent, and turns it into plain language: what the problem is, why it matters, and what to change. SEES WHAT YOUR BROWSER HIDES Browsers and most phone tools quietly download any certificate a server forgot to include, so a misconfigured server looks perfectly healthy. This turns that repair off. If your server is missing an intermediate, you will see it here and nowhere else — which is why a site can work in Safari while your API client, your mobile SDK, or anything behind a strict firewall fails against it. ANSWERS IN THREE LAYERS A letter grade and one sentence you can read in a second. Then a finding for each problem — what was detected, the practical consequence, and the fix. Then every field of every certificate, for when you want to check the working yourself. WHAT IT CHECKS • Trust chain — complete, incomplete, or untrusted, and exactly where it breaks • Expiration — how long you have, and when to start worrying • Hostname — whether the certificate really covers the name you connected to • Certificate — signature algorithm, key size, validity dates • Protocols — which TLS versions are enabled, including ones that should not be • Cipher — forward secrecy and whether the negotiated suite is still sound THE CHAIN, DRAWN Every certificate the server presented, in order, leaf to root. Where a certificate is missing, the gap is drawn and labelled rather than quietly skipped. Tap any certificate for its full detail: subject, issuer, serial, both fingerprints, key, and every name it covers. BUILT FOR THE AWKWARD CASES Any port, not just 443. Self-signed certificates identified as such rather than dismissed. Deprecated TLS 1.0 and 1.1 reported against RFC 8996. Protocol probes that say "no answer" instead of claiming a version is disabled when the network simply swallowed the handshake. SHARE THE ANSWER Every scan exports as plain text — grade, chain, findings, impact and fix. Paste it into a ticket or send it to whoever owns the server. HISTORY Every endpoint you scan is kept, with its grade, so you can come back and see what you found. Rescan any of them in one tap. LIGHT AND DARK Both designed, not one inverted into the other. Fingerprints, serials and addresses are set in monospace so they stay readable at a glance and selectable when you need to paste one. NO ACCOUNT, NO BACKEND, NO ADS Scans run directly from your device to the host you type. Nothing is sent to Kodura. History never leaves the phone. There is no sign-up, no tracking prompt, and nothing to buy. Built by Kodura for network engineers, sysadmins and anyone who has lost an afternoon to a certificate that worked in a browser.