Three possible causes, none of them yours to inspect
A remote worker reports that the application is unusable. It could be their home network, the VPN path, or the service itself. Your service desk has no way to tell which, so it asks them to reboot the router.
This is the single least satisfying category of ticket in most organisations. The user is genuinely suffering, the evidence is a screenshot of a speed test, and the resolution is usually attrition; either the problem goes away or the user stops reporting it.
What is missing is not effort or goodwill. It is a measurement taken from where the user is, at the time they were suffering, of the path they were actually using.
The laptop becomes the vantage point
The same agent that runs on a branch appliance runs on Windows and macOS endpoints, taking the same measurements. It sits below the application, so it sees the path rather than the symptom, and it keeps a continuous record instead of a snapshot taken after the fact.
Because it measures continuously, the useful comparison is available: this user, this week, versus last week, and versus everybody else on the same tunnel endpoint.
The three candidate causes separate cleanly. The first few hops are the home network. The middle is the path to your concentrator. Beyond that is your estate and the services it reaches. A degradation is located rather than debated.
Answers you can actually give
- It is the home network
- Loss starts at hop one or two and the wireless scan shows a saturated channel. This is a router placement conversation, and now an evidenced one.
- It is the path to us
- The home segment is clean and loss appears several hops out, on a route shared by every user on that regional ISP. One ticket, not forty.
- It is the tunnel
- The underlying path is healthy but connect and handshake phases have degraded to the concentrator. That is a capacity problem you own and can fix today.
- It is not the network
- Everything measured is normal through the reported window. Unwelcome, but it redirects the investigation instead of leaving it circling.
When the workspace is a virtual desktop
A desktop session adds another place to investigate: the host running the desktop. Plan measurements from both the physical endpoint and the session host.
Our dedicated VDI solution covers golden images, distinct clone identities, pool-based checks, and the limits of inferred endpoint matching. VDI session monitoring is pending release and live-environment validation.
Two things worth being straight about
This measures a home network
Which is somebody's house. An agent on a personal machine is a decision to make deliberately, with your works council or equivalent, and to tell people about plainly. It measures network paths rather than activity (it is not a screen recorder, a keylogger or a browsing monitor) but "it only measures the network" is a claim people are entitled to hear from you rather than from a vendor page.
Laptops are honest but awkward vantage points
They sleep, move between networks, and run on battery. That is exactly what makes them representative, and it means measurements carry the state of the host alongside them. Wireless detail is richer on some platforms than others, and the agent reports which capabilities it had rather than presenting a thinner measurement as an equivalent one.
Stop asking users to run speed tests
A speed test measures a different path at a different time to a different destination than the one that was slow.
A remote user reports an intermittent slowdown.
An illustrative investigation. Follow the evidence from where it was measured to the result you need to explain.
1.Measure from the affected location
Place an agent where the problem is experienced. Compare the same target from another vantage point to see whether the issue is local or shared.
Set up a vantage point2.Separate the path from the application
Use Path Health for the route and HTTP for request timing. Compare DNS, connection, TLS and response phases before deciding which layer to investigate.
Choose your checks3.Inspect the moment that matters
Choose the time window, inspect individual results and read the trust qualifiers. Keep the target and vantage point alongside the evidence.
Read the results