The short answer
A speed test measures one thing: bandwidth. The two measurements that actually break video calls and browsing are latency and packet loss, and a speed test sees neither. A 500 Mbps line losing 8% of its packets scores excellent on every speed test and is unusable in a meeting. The XIT agent sends 10 packets to 1.1.1.1 every 15 minutes and records average latency and loss percentage. Above 150 ms everything feels slow even at full speed, 5% loss breaks calls, 20% is a broken link, and WiFi signal below 30% is a common cause of drops.
Why does the speed test say excellent while nothing works?
Almost everyone whose internet stutters runs the same test. They open a speed-test site, see 480 Mbps, and conclude the line is fine. Half an hour later the call drops again. That gap is not an accident, and it explains why so many network faults stay open for months.
A speed test measures how much data can be pushed through per second. It opens several connections, pulls down a large file, and averages the result. It does not check whether every piece of data arrived, and it does not check how long each piece took. Those two things are exactly what decide whether a video call works.
A video call does not need much bandwidth — a typical call is happy with 2 to 4 Mbps. What it needs is continuity. A packet lost on the way is a clipped word, a frozen frame, a sentence the other side asks you to repeat. A 500 Mbps line that loses 8% of its packets scores excellently on any speed test and makes every meeting painful. That is why the measurement we run on customer machines is not a speed test.
The three measurements people confuse with each other
A network is described by three independent measurements. Any one of them can be perfect while the other two are failing, which is why testing one tells you nothing about the others.
Throughput — how much
How many megabits per second the line can carry. This is the only figure a speed test reports, and in practice it is the one that breaks least often. It matters for large downloads, cloud backups and streaming. It has almost nothing to do with why a meeting keeps freezing.
Latency — how long
How many milliseconds a packet takes to reach its destination and come back. This decides how quickly a page starts loading, how quickly a click responds, and how natural a conversation feels. High latency feels exactly like slow internet even at full throughput — which is why the user reports slowness, the technician measures full speed, and both are right.
Packet loss — how much arrived
What percentage of packets simply never made it. On a download this is nearly invisible: the protocol asks again for whatever was lost and the file arrives complete, just slower. In a live conversation there is no time to ask again. What was lost stays lost, and it sounds like robotic audio, a frozen picture and dropped calls.
The XIT agent measures the last two directly. Every 15 minutes it sends 10 packets to 1.1.1.1, calculates the average round-trip latency and the percentage that never came back, and stores the result. The check takes seconds and runs identically on Windows and Mac.
The numbers that decide when it is really a fault
A measurement without a threshold is just a number. These are the thresholds that raise an alert, and they are the same on every machine:
| Measurement | Warning | Critical | What it means in practice |
|---|---|---|---|
| Packet loss | 5% | 20% | At 5% video calls break up and browsing stutters. 20% is a broken link — something on the path is genuinely faulty. |
| Latency (ping) | Above 150 ms | — | Everything feels slow even at full throughput. Pages start loading late, clicks respond late. |
| WiFi signal | Below 30% | — | A common cause of drops and slowness. Usually distance, walls or a crowded channel. |
| Machine not reporting | 1 hour | 24 hours | Powered off, disconnected from the network, or the agent stopped running. That is also a possible network fault. |
Note the gap between 5% and 20%. Five per cent loss is exactly the range where the customer says sometimes it works and sometimes it does not — bad enough to ruin a meeting, small enough that any one-off test comes back clean. That is why a spot check never resolves network faults and a measurement every 15 minutes does.
From the symptom you notice to the cause behind it
This table is the fastest way to turn a user complaint into a measurement, and a measurement into a likely cause:
| What you notice | The measurement that explains it | The usual cause |
|---|---|---|
| Calls break up, robotic audio, frozen picture — but downloads are fine | Packet loss of 5% or more | A damaged cable or connector, weak WiFi, an overloaded router, or a provider line fault |
| Everything feels slow, yet the speed test reports full speed | Latency above 150 ms | A congested line, a VPN routing traffic through another country, or a saturated upload |
| Drops every few minutes, mostly in one room | WiFi signal below 30% | Distance from the router, walls and concrete, or a channel crowded with neighbours |
| Some sites will not load while everything else works | A change in the hosts file entry count and modification time | An old blocker nobody remembers, or a malicious redirect |
| Certificate warnings, ads on sites that should not carry them | A proxy enabled that nobody configured | Traffic interception — the classic signature of adware or malware |
| The machine is busy at hours when nobody is sitting at it | RDP logons, counted separately for out-of-hours activity | A remote session left open, whether legitimate or not |
| A service or site that stopped working with no warning | A certificate that expired or has under 30 days left | A certificate nobody renewed in time |
Weak WiFi is the most common cause, and the easiest to fix
Before blaming the provider, check the last three metres. The agent reads the network name, the channel, the signal percentage and the receive rate in megabits from the machine itself. A signal below 30% raises an alert, because that is the range where a connection starts shedding packets without fully disconnecting — the most confusing symptom there is.
One distinction matters here. The receive rate shown on the machine is the rate to the router, not your internet speed. You can see 866 Mbps to the router and still lose every packet heading out, and the reverse happens too. The two numbers describe different segments of the same path, which is another reason a single figure never diagnoses anything.
Alongside signal strength, the agent records the active adapter, the local IP address, the gateway, the configured DNS servers, the public IP address and whether a VPN tunnel is up. Those details are what make it possible to say with certainty that a machine moved to a different network, that its DNS was changed, or that traffic is routed through a tunnel that was not there yesterday.
A proxy that appeared on its own, and an edited hosts file
Not every network problem is a fault. Some of them are somebody sitting in the middle.
The proxy. Windows stores whether all traffic should go through an intermediate server, the address of that server, and whether an automatic configuration file dictates the routing. A proxy that appears without anyone configuring it is textbook traffic interception: everything the machine sends passes through a third party before it reaches its destination. What the user sees is ads in strange places, certificate warnings in the browser, and sites loading slower than usual. We read all three of those settings on every report, so a change stands out immediately.
The hosts file. This is a small file that can bypass name resolution entirely and point a web address at a completely different destination. It is an old technique, used both for legitimate blocking and for malicious redirection. We count how many real redirect entries the file contains and when it was last modified — and deliberately do not read its contents, because the contents reveal which sites the user visits. A count that jumped, or a modification date of yesterday, is enough to justify looking.
Listening ports. The agent records which ports the machine is listening on together with the process that opened each one. A bare port number is a meaningless figure; a port with the owning process attached is a finding you can act on. The full security treatment of these findings, including what to do about them, lives on the security check page.
RDP left open without NLA, and certificates about to expire
Remote Desktop exposed to the network without Network Level Authentication is one of the most dangerous ransomware entry points there is. Without NLA, anyone who reaches the port gets a login screen before authenticating at all, which means passwords can be guessed indefinitely. That raises an alert on its own, regardless of whether anyone has exploited it yet.
Separately, we count the RDP logons that actually happened over the past seven days, when the last one was, and how many of them fell outside working hours. The account name is deliberately not extracted. The count alone is enough to ask the right question: somebody logged into this machine at three in the morning — was that you?
Finally, digital certificates. An expired certificate takes down a service or a site with no warning, usually on the least convenient day. We flag certificates with under 30 days remaining, and under 7 days is classified as critical — enough runway to renew without a panic.
How to isolate a home network fault before calling anyone
Before you phone the provider, you can narrow the suspects down yourself in about twenty minutes. The method is to change one variable at a time and see whether the symptom disappears.
- Plug in a cable. Connect the computer straight to the router with an ethernet cable and turn WiFi off. If the stutter disappears, the problem is your wireless coverage, not the line.
- Sit next to the router. If you must stay wireless, try it from a metre away. If everything is clean there and the problem returns in the other room, this is a coverage problem inside the house.
- Test a second device. Check a phone or another computer on the same network at the same time. If every device suffers, the suspect is the router or the provider. If only one does, the problem is on that machine.
- Watch loss, not speed. Run a long ping to 1.1.1.1 and watch the percentage of packets lost rather than the megabit figure. From 5% upward, that is your dropped calls.
- Swap the cable and the port. A damaged ethernet cable produces exactly the picture of random packet loss. Swapping the cable is the cheapest test available.
- Restart the router and write down when it came back. If the problem clears for an hour and returns, you are looking at equipment or a line that degrades, not a random glitch.
- Record the times. A fault that returns at the same hour every day is almost always congestion or a scheduled job, not bad luck.
If the symptom survives all of that — on a cable, next to the router, and on a second device — you now have a documented case to put to the provider, instead of a call that ends with try restarting your router.
What XIT measures on the network, and what it does not
Being honest about the limits matters more than a long capability list. We do not run a speed test. That is a deliberate choice: it consumes the customer's bandwidth, it is not repeatable, and it measures the one dimension that is almost never the reason for the complaint. What is measured continuously is latency, packet loss percentage, WiFi signal and link rate to the router, the active adapter and DNS servers, the public IP address, whether a VPN is up, how many connections are currently established, and which ports are open and which process opened them.
Those measurements are kept for 60 days, and that is what makes them useful. A complaint of it happens sometimes becomes a chart showing loss crossing 5% every weekday between eight and nine in the morning. Handing that to an internet provider is worth more than ten phone calls. How the continuous monitoring loop works is covered on the monitoring page.
Beyond the passive monitoring, two checks can be triggered remotely, and both appear in the report under a plain name. Internet connectivity runs a ping to a numeric address, a ping by name to confirm name resolution works, a DNS lookup, a route trace and the routing table — which is how you separate there is no internet from DNS is not answering, two states that feel identical to the user. What is connected to this computer lists the network adapters and the actual connection in use, USB devices and installed printers.
Everything ends up in the customer report, in the network and internet section, alongside the five other sections. No personal content is involved at any point: no files, no documents, no email, no browsing history — only system state and configuration. The full detail of what is collected and what explicitly is not lives on the report privacy page, and the packages, $5 per month per computer for monitoring and $10 with a human technician, are on the pricing page.
FAQ
Why does my speed test show full speed while the internet still stutters?
A speed test measures bandwidth only, meaning how much data passes per second. It does not measure latency and it does not measure packet loss, and those are the two dimensions that determine whether video calls and browsing feel healthy. A 500 Mbps line with 8 per cent packet loss scores excellent on the test and is unusable in a meeting.
How much packet loss is too much?
From 5 per cent upward the loss is noticeable: video calls break up and browsing stutters. From 20 per cent it is treated as a broken link, and something on the path is genuinely faulty, usually a cable, a connector, the router or the provider line. XIT raises a warning at 5 per cent and a critical alert at 20 per cent.
What is high latency and when does it start to hurt?
Latency is the time a packet takes to reach its destination and return, measured in milliseconds. Above 150 milliseconds everything feels slow even at completely full throughput: pages start loading late and clicks respond late. That is why a user reports slowness while the speed test comes back with a perfectly good number.
How do I tell whether the problem is my WiFi or my internet line?
Connect the computer to the router with an ethernet cable and turn WiFi off. If the stutter disappears, the problem is wireless coverage rather than the line. If it persists, test a second device on the same network: if that one suffers too the suspect is the router or the provider, and if only one machine suffers the problem is on that machine.
What is a proxy that appears on its own and why is it dangerous?
A proxy is an intermediate server that all of a machine's internet traffic passes through. When it is switched on in the settings without anyone configuring it, that is a strong indicator of traffic interception by adware or malware. The common symptoms are advertisements on sites that should not carry any and certificate warnings in the browser.
Do you see which websites I visit?
No. From the hosts file only the number of redirect entries and the last modification date are stored, never the contents, precisely so that the sites a person visits are not exposed. The agent collects system state and configuration only and does not read or upload files, documents, photos, email or browsing content.
How often is the network measured and how long are results kept?
The measurement runs every 15 minutes: 10 packets to 1.1.1.1, from which average latency and loss percentage are calculated. Results are retained for 60 days, which is what allows a recurring fault to be proven against a fixed time of day instead of relying on a one-off test that almost always lands in a moment when everything is fine.
Internet stuttering and nobody can say why?
Instead of another speed test, we measure what actually breaks the connection — latency and packet loss, every 15 minutes, with history you can put in front of your provider. From $5 per month per computer.
Talk to usRead next
- Security check — proxy, listening ports and RDP: what to do with the findings
- Continuous monitoring — what a report every 15 minutes looks like and what happens on an excursion
- Slow computer — when the slowness is the machine and not the network
- Report privacy — what is collected from the machine and what explicitly is not