One measurement pipeline, composed rather than chosen from a menu
You describe what to measure against a target. RouteSpear works out which captures can share a pass, runs them together, and stores every sample with the context needed to interpret it later.
An application feels slow
An illustrative investigation. Follow the evidence from where it was measured to the result you need to explain.
1.Measure from the affected location
Place an agent where the problem is experienced. Compare the same target from another vantage point to see whether the issue is local or shared.
Set up a vantage point2.Separate the path from the application
Use Path Health for the route and HTTP for request timing. Compare DNS, connection, TLS and response phases before deciding which layer to investigate.
Choose your checks3.Inspect the moment that matters
Choose the time window, inspect individual results and read the trust qualifiers. Keep the target and vantage point alongside the evidence.
Read the resultsCompose a test, don't pick a product
Most tools sell a DNS product, an HTTP product and a traceroute product, and you correlate them yourself afterwards. Here they are capture types on one test against one target, sharing one schedule and one timeline.
| Capture | What it records |
|---|---|
| Path Health | Per-hop RTT, loss and jitter along the live path, with the route fingerprinted on every pass so a reroute is an event with a before and an after rather than something you infer from two graphs. |
| HTTP and API Flow | Status and timing broken out by phase (DNS, connect, TLS, first byte) plus certificate expiry. API Flow runs an ordered multi-step sequence, because one request against a login page does not tell you the login works. |
| DNS | Resolution time and the answer itself, over UDP, TCP, DoT or DoH. Recording the answer is what separates slow from wrong: a resolver returning a stale record quickly looks healthy on a latency graph. |
| TCP, SSH, NTP, Path MTU | Connect timing, handshake phases and host-key changes, clock offset, and deliberate MTU black-hole detection, the failure where small packets work so everything looks up, and anything substantial hangs. |
| Browser | Real page loads in a real browser, so you measure what a person experiences rather than what an HTTP request experiences. |
| Local link | DHCP, ARP sweeps, LLDP, WiFi and Bluetooth LE scanning: the network the agent is plugged into. An exhausted DHCP scope or a changed gateway MAC is a site-wide outage that no remote probe can see. |
| eBPF flow | Real TCP behaviour per peer (retransmits, resets, failed connects, smoothed RTT) observed inside the Linux kernel without sending a single probe. The answer to "synthetic traffic is not representative". |
| SNMP, with discovery | Interface counters, errors, discards and device health, with subnet sweeps that keep the inventory current by themselves. The device nobody added to the list is reliably the one that fails. |
| Multi-agent mesh | Path health between your own sites in every direction, which is how routing asymmetry becomes visible instead of becoming an argument between two teams. |
| Custom scripts | Anything you can script, reporting through the same pipeline into the same store with the same retention, dashboards and trust qualifiers. No second-class custom-metrics system. |
Combinations that cannot share a capture are disabled in the editor rather than hidden, so it is clear that the option exists and why it does not apply to this target.
Every sample says how much to believe it
This is the part of RouteSpear that is hardest to retrofit and the reason the raw samples are kept. A number with no provenance cannot be argued with, and during an incident that is exactly what you need to do.
- Fidelity
- How good the measurement mechanism was on this pass. A probe that had to fall back to a less precise method says so, on the row, rather than being averaged in as though it had not.
- Confidence
- Per hop, how sure we are that this hop is what it appears to be. Load balancers, anycast and rate-limited routers all make a hop ambiguous, and the ambiguity is recorded rather than resolved by guessing.
- Agent health
- What the agent could and could not do at the time. Losing a capability (no raw sockets, no flow-ID control on this OS) is reported with its reason instead of being rounded up to healthy.
Raw samples, not just rollups
Most platforms aggregate on ingest and keep the averages. That is cheaper, and it works until the question is about a specific ninety seconds three weeks ago, at which point the data that would have answered it has been averaged away.
RouteSpear keeps every individual measurement and builds rollups alongside them rather than instead of them. Dashboards read the rollups because they are fast. Investigations read the measurements because they are still there.
Any result can be opened in full, exactly as the agent reported it, including the trust qualifiers. There is no level of detail held back from you and no export step to get at it.
Why it matters
- The question
- What happened at 03:14 three weeks ago?
- Averaged data
- A flat hourly figure. The minute is gone.
- Kept samples
- Every probe in that minute, per hop.
- With trust
- And which of them were worth believing.
Retention on the detail is a plan setting rather than a constant, so how far back this works is a decision you get to make.
Built for reading fast, in the dark
The interface assumes you arrived because something is wrong, at an hour you did not choose.
Dashboards you arrange
Drag and resize panels, correlate arbitrary metrics on one axis, and save the arrangement as a view. Not a fixed template with a settings page.
Live without refreshing
Turn on Live and agent state and charts keep moving on their own. During an incident the screen is current because it is being kept current, not because you reloaded it.
Drag to zoom
Select a range on any time series to scope every panel on the page to it. The interesting ninety seconds is usually found by looking, not by typing timestamps.
Command palette
Ctrl or Cmd+K to any test, agent or dashboard. Faster than remembering where in the navigation something lives.
Logs, only when it matters.
Keep routine logs on your hosts instead of continuously shipping the full stream. Log ingest rules collect bounded, redacted excerpts from agent files, Windows events, or remote SSH hosts when selected agents or tests become unhealthy. Read the evidence on the incident.