"Run a speed test" is good advice — until the speed test comes back clean and everything still breaks. Real connection diagnostics treat your network as a stack of layers. Each layer — reachability, naming, encryption, routing, stability — can fail independently. This guide walks through the checks that matter, what healthy results look like, and how speedtest.doctor brings them together on one platform.
The diagnostic stack: what to run and when
Think of diagnostics as triage. You do not need every tool for every problem, but knowing the order saves time:
| Layer | Tool | Reveals |
|---|---|---|
| Reachability | Ping test | Is the host alive? Baseline RTT? |
| Naming | DNS lookup | Correct records? Resolver speed? |
| Security | SSL checker | Valid cert? Expiry? Chain issues? |
| Path | Traceroute | Where does latency enter the route? |
| Throughput | Speed test | Download, upload, sustained Mbps |
| Stability | Loss / jitter / bufferbloat | Dropouts, call quality, gaming lag |
Ping: the heartbeat of your connection
A ping test sends small probes to a target and measures round-trip time. It is the fastest sanity check: if ping fails entirely, no amount of bandwidth will help. Healthy idle ping on a wired connection is typically under 30 ms domestically; wireless adds 5–20 ms depending on distance and interference.
Raw ping alone is incomplete. Run it alongside jitter (variation between samples) and bufferbloat (latency under load). A line with 15 ms idle ping that jumps to 200 ms when a download starts has a queueing problem — not a speed problem.
DNS: the hidden delay in every click
Before your browser can open a site, it must resolve the hostname to an IP address. A DNS lookup tool shows whether records resolve correctly — critical when a site "works for others but not for you." A DNS speed test compares resolver response times; slow DNS makes every new tab feel sluggish even on a gigabit line.
Privacy-conscious users should also run a DNS leak test when using a VPN. Leaks expose queries outside the tunnel, defeating the privacy benefit and sometimes routing traffic through a slower resolver.
SSL and TLS: trust before traffic flows
An SSL checker opens a TLS handshake to a host and inspects the certificate chain: subject, issuer, validity window and fingerprint. Browsers hide most of this, but developers and site owners need it when debugging "your connection is not private" errors, mixed-content warnings or expired certs on staging environments.
Use the SSL tool
on speedtest.doctor or call POST /v1/tools/ssl
via the API for
programmatic checks in CI pipelines or monitoring dashboards.
Traceroute and beyond: following the path
When latency is high but local Wi-Fi is ruled out, traceroute shows where delay enters the path — your ISP's gateway, a congested peering point, or a distant server. Pair it with IP geolocation and ASN lookup to understand which networks carry your traffic.
For web-specific issues, add HTTP headers inspection and site speed checks to separate network problems from server-side slowness.
One platform for every check
Scattered bookmarklets and ad-heavy test sites make consistent diagnostics hard. speedtest.doctor consolidates free browser tools at /tools, automated interpretation at /diagnosis, developer access at /api and /docs, and embeddable widgets at /widgets. Every tool shares the same measurement engine at api.speedtest.doctor.
The Connection Doctor runs the full panel — throughput, ping, jitter, loss, bufferbloat and DNS — then returns a verdict with likely causes and suggested fixes. It is the checklist in this article, automated.
Symptom → diagnostic cheat sheet
Match what you feel to the check that actually explains it:
- Pages slow to start, then fast — DNS latency or resolver misconfiguration. Run DNS speed and try a public resolver.
- Calls and games stutter, Mbps fine — jitter, packet loss or bufferbloat. Check jitter and bufferbloat.
- Browser warns about certificate — expired or mismatched SSL. Use the SSL checker before blaming the network.
- One site unreachable, others work — traceroute to see where the path breaks; check DNS propagation after DNS changes.
- VPN on but sites know your ISP — DNS leak or WebRTC leak tests.
Automating diagnostics for teams
Browser tools are enough for one-off checks. For NOC dashboards, onboarding
flows or support bots, use the Measurement API documented at
/docs.
Endpoints mirror the free tools: POST /v1/tools/ping,
/v1/tools/ssl,
/v1/diagnose
for the full panel. Embed the same checks via
/widgets
when you need a UI without building one.
Tool quick links
Run the full diagnostic panel
One click for throughput, latency, DNS and a plain-language verdict — or browse individual tools and API endpoints.
Frequently asked questions
- What is the difference between a speed test and connection diagnostics?
- A speed test measures throughput — how much data moves per second. Connection diagnostics is the broader panel: ping, DNS resolution time, SSL certificate health, routing path, packet loss, jitter and bufferbloat. Together they explain why a connection feels slow, insecure or unstable even when Mbps looks fine.
- Which diagnostic should I run first?
- Start with ping to confirm basic reachability and baseline latency. If ping is clean, check DNS — slow lookups delay every new hostname. For HTTPS issues, run an SSL checker. If problems are intermittent, add packet loss and bufferbloat tests under load.
- What is a good ping result?
- Under 30 ms is excellent for gaming and real-time calls. 30–80 ms is acceptable for most browsing. Above 100 ms, or spikes under load, point to routing, Wi-Fi or bufferbloat issues — not insufficient download speed.
- How do I check if DNS is slowing my connection?
- Use a DNS benchmark or lookup tool to compare resolver response times. Resolution above 50–100 ms on common sites suggests your resolver or ISP DNS is a bottleneck. A DNS leak test also confirms your VPN is not exposing queries.
- Can I run all diagnostics through one API?
- Yes. The speedtest.doctor Measurement API at api.speedtest.doctor exposes speed, ping, SSL, DNS, traceroute and full diagnosis endpoints. See /docs for authentication, parameters and sample responses. Embed the same checks via /widgets on your site.