Service checks

Choose the service in Test Management → New test, then configure its target, address family, credentials and assertions. Use agents advertising the check’s capability. DNS, Path Health and Path MTU can accompany these services; unrelated services need separate tests. See check compatibility.

Use a credential reference for secrets. Agent-local credentials and shared secrets have different delivery requirements; shared credentials require approved, authenticated destinations.

Database

One Database check supports PostgreSQL, MySQL, SQL Server, Oracle, MongoDB and Redis. Supply a host or IP with an optional port, not a connection string. Choose the engine, database, username, credential reference and TLS mode. Verified TLS is the default. Without a query, the check measures connection and authentication using a protocol ping.

For SQL engines, enter a single SELECT or WITH query and optional expected row count or scalar value. Results are bounded to 100 rows by default, with a maximum of 1,000. Extra rows beyond the limit fail the check and mark the count truncated. Scalar assertions require exactly one non-NULL cell. PostgreSQL, MySQL and Oracle use read-only transactions; SQL Server queries require the database itself to be read-only, though connection-only checks work on writable databases. Use a dedicated database account with limited privileges.

MongoDB accepts a bounded find description, such as {"collection":"health","filter":{"ready":true}}, with a row-count assertion. It does not expose aggregation or scalar assertions. Set the authentication database separately when necessary.

Redis accepts selected scalar reads, such as ["GET","health:ready"], with optional count or text assertions. The database is a numeric index. Arbitrary commands, writes, scripts and cluster redirects are not supported.

Connection timing includes TLS, authentication and ping; TCP establishment has its own measurement. Query timing includes consuming the bounded result. Query text and returned values are not copied into result telemetry, but the configured query is stored in the test definition. Minimum interval is 15 seconds; maximum whole-check timeout is 30 seconds.

SIP

SIP measures signaling with OPTIONS, registration, or synthetic call setup/teardown. Use a hostname or IP, optionally with a port, rather than a SIP URI. Select IPv4 or IPv6. UDP/TCP default to port 5060; TLS uses 5061. SRV/NAPTR discovery is not performed.

OPTIONS defaults to expecting a final 200 response. A configured 401/407 expectation proves a challenge response, not successful authentication. Authenticated OPTIONS, registration and calls use TCP or TLS; shared credentials require TLS. Registration creates and then removes a unique Contact. Calls need a dedicated destination that answers synthetic calls and use inactive media. Review cleanup failures because remote state can survive interrupted execution.

SIP results describe signaling availability and timings. Use a separate RTP check to measure synthetic voice transport. SIP’s minimum interval is 15 seconds and its whole-check timeout is capped at 32 seconds.

Throughput

Throughput measures bounded payload goodput against an authenticated RouteSpear responder. Select HTTP, TCP or UDP, then download, upload or both directions sequentially. The target is the responder’s control URL. Supply its token reference, byte budget, rate cap and timeout. It is not compatible with iperf.

The responder is a separately deployed routespear-responder process; a test does not start one automatically. Configure its token, TLS and the listeners required by the selected protocol. Each transfer is bounded to 64 MiB and 60 seconds. Defaults are download, 1 MiB, 10 Mbps and a 15-second timeout. A check must run at least one minute apart, and the requested budget must fit its timeout. Choosing both directions transfers the byte budget once in each direction.

On the responder host, set ROUTESPEAR_RESPONDER_TOKEN to a random secret of at least 32 bytes and start with -listen 0.0.0.0:8020 -tls-cert server.crt -tls-key server.key, using your certificate files. The agent must trust the certificate and hostname. Store the matching token in its credential backend. Without TLS, the responder accepts only an explicit loopback listen address.

TCP mode upgrades the control connection; a reverse proxy must support that upgrade. UDP mode additionally needs -throughput-udp-listen 0.0.0.0:8022 and the matching externally reachable UDP port. UDP sessions authenticate synthetic packets but do not encrypt their payload. RTP separately uses -rtp-listen 0.0.0.0:8021. Neither UDP listener opens by default.

Rate-capped results do not estimate maximum circuit capacity. Reported goodput includes connection overhead. HTTP mode can measure loaded response time on separate connections during the transfer; this includes HTTP/connection/TLS work, not ICMP or one-way delay. No loaded sample means unavailable, not zero.

RTP / voice transport

RTP / voice transport uses the authenticated RouteSpear responder to measure loss, interarrival jitter, duplicates, reordering and missing-packet bursts in each direction. Enable the responder’s RTP UDP listener separately, and allow that port through the firewall. The HTTPS control endpoint and UDP endpoint must be reachable at the same host/IP; port translation and reverse proxies that change the apparent client IP are not supported.

The stream sends 50 synthetic packets per second in each direction. The agent’s local per-target budget must sustain 50 packets/second plus control traffic; the usual 20/second limit is insufficient. A local budget failure is not a network-loss result.

Default duration is three seconds, timeout ten seconds, maximum loss 1% and maximum jitter 30 ms. Both directions must meet both thresholds. Duration is limited to ten seconds and minimum interval to one minute. This does not place a SIP call, carry real speech, calculate MOS, or measure one-way latency.

gRPC health

gRPC health opens a fresh connection and calls the standard grpc.health.v1.Health/Check. Leave the service name empty for the whole server or name a health service. It requires SERVING; an absent health implementation fails. It does not execute arbitrary RPCs. Targets are hostnames or IPs with an optional port, defaulting to 443. An optional credential supplies bearer metadata.

WebSocket

WebSocket takes a ws:// or wss:// URL and verifies the handshake. By default, a random ping must receive a matching pong. Alternatively, set both message and expected reply to require an exact first text response. Each configured message is limited to 4,096 UTF-8 bytes. An optional subprotocol must negotiate exactly. Redirects are not followed. Shared bearer credentials require WSS.

Email

Email supports SMTP availability/authentication, IMAP login/NOOP and a round trip that sends a uniquely marked message and checks its arrival by IMAP. Verified implicit TLS defaults to SMTP 465 or IMAP 993. Mandatory STARTTLS uses 587 or 143 respectively.

Round trip requires sender, recipient, SMTP and IMAP identities, an IMAP target and a credential containing JSON smtp_password and imap_password. It opens the receiving mailbox read-only and does not read, mark or delete real mail. Synthetic messages remain; use a dedicated mailbox and retention policy. Choose a timeout that covers delivery, within the 30-second limit. SMTP acceptance alone does not pass a round-trip delivery check.

LDAP / Active Directory

LDAP / Active Directory checks a simple authenticated bind, or anonymous bind when both username and credential are absent. An optional search uses a base DN, scope, filter and entry-count bounds. It requests no attribute values and does not follow referrals. A server size-limit error fails the check. Verified LDAPS uses 636; mandatory STARTTLS uses 389. Empty passwords do not count as an authenticated bind.

RADIUS

RADIUS sends one PAP Access-Request and validates both response authenticators. Choose expected accept or reject; Access-Challenge and interactive EAP flows are not supported. Credentials contain JSON password and shared_secret. Verified RadSec TLS uses port 2083 and permits shared credentials. Explicit UDP uses 1812 and requires agent-local credentials. Use a dedicated test account and a cadence appropriate to the authentication service’s lockout policy.

MQTT

MQTT uses MQTT 3.1.1, verified TLS on 8883 or explicit plaintext on 1883. Connect mode requires CONNACK and PINGRESP. Round trip subscribes to an exact topic, publishes a unique non-retained QoS 0 marker and requires its return. Use a dedicated test topic; wildcard topics, MQTT 5, WebSocket transport and QoS 1/2 are not supported. Shared credentials require verified TLS.

File services

File services supports SFTP (22) with a pinned server key, or SMB (445) with a share and optional domain. Both use a username and password reference; SMB requires agent-local credentials and signed SMB 3.1.1.

Choose access to inspect metadata, read to read/discard a bounded file portion, or write/read to verify a temporary file in a dedicated directory. Write/read creates a unique .routespear-probe-* file, compares the bytes and removes that file; it does not overwrite existing files. The byte budget defaults to 4 KiB, maximum 1 MiB. Cleanup failure fails the check and reports the temporary path for manual removal. Network loss can leave a probe file behind.

gRPC, WebSocket, email, LDAP, RADIUS, MQTT and file checks default to a 60-second interval and five-second timeout. Their minimum interval is 15 seconds and maximum timeout is 30 seconds. Result telemetry omits credentials and service payloads; values deliberately entered in configuration remain in that configuration.