Wireglass connection inspector

Wireglass is a local-only Rust CLI that walks the real path of a connection — DNS → TCP → TLS (ALPN) → HTTP/2 → HTTP/3 — and reports each step as a directly measured, reproducible result. Since v0.2.0 it also runs protocol-aware UDP diagnostics for STUN and QUIC. Nothing is inferred or guessed; every failed measurement is reported with its error and a precise status.

Direct answer

One command, one target, one JSON report. Deep DNS (records, TTLs, CAA, delegation chain, DS/DNSKEY) + real TCP connect + TLS handshake (protocol, cipher, ALPN, certificate expiry) + a real HTTP/2 request + a real QUIC/HTTP-3 handshake + optional STUN/QUIC UDP probes. The silent HTTP/3 downgrade — advertised via Alt-Svc but never actually connected — is reported honestly instead of being hidden. Download a prebuilt binary from Releases and run it against any URL.

Status (2026-10-31)

• Latest release: v0.2.1 (2026-10-30) — prebuilt binaries for Linux x86_64, macOS ARM64 and Windows x86_64, plus an Android APK.
• Phase 1: scoring + interpretive “roast” on top of the Phase 0 measurement engine. The Phase 1 evidence gates G1–G6 in docs/evidence-plan.md are still open.
• CI (Actions): cargo fmt + clippy -D warnings (core and Android app), build + tests on Linux, macOS and Windows, and an Android host check — green on main. A separate Release workflow builds the binaries for each tag.
• License: MIT OR Apache-2.0.

What it measures

• DNS — A / AAAA records with real TTLs, CAA, the NS/SOA delegation chain (root → … → host zone), raw DS / DNSKEY records, explicit errors (hickory-resolver).
• TCP — real connect timing to a chosen address; --repeat N records dispersion.
• TLS — real handshake timing, protocol version, cipher suite, negotiated ALPN, certificate subject/issuer/expiry (rustls + x509-parser).
• HTTP/2 — a real request over the negotiated ALPN, capturing status, server and Alt-Svc.
• HTTP/3 — a real QUIC handshake with ALPN h3 on the URL’s actual port; advertised is kept separate from actually connected.
• UDP/STUN — a STUN Binding request; success only for a correlated Binding response with the right magic cookie, transaction ID and lengths. Repeatable, multi-target.
• UDP/QUIC — probes that reuse the same HTTP/3 handshake against any host:port.
• Score — score/total, grade, per-category reasons and a deterministic roast, in the JSON and the HTML report.

Download (v0.2.1)

Platform	File	Size
Linux x86_64	wireglass-linux-x64	10.8 MB
macOS ARM64	wireglass-macos-arm64	9.0 MB
Windows x86_64	wireglass-windows-x64.exe	8.0 MB
Android (arm64-v8a)	wireglass-android-arm64-v0.2.1.apk	7.4 MB

SHA256 checksums (SHA256SUMS.txt, wireglass-android-SHA256SUMS.txt) and both license files ship with every release.

Android is an engineering preview, not a Play Store release: a Slint UI over the same wireglass::run core, minSdk 26 (Android 8), targetSdk 34, arm64 only, and only the INTERNET permission. It has live stage progress, cancel, share with clipboard fallback, recent targets and “Save JSON” export. Device coverage is tracked separately — no broad OS-support claim without evidence.

Run it

# prebuilt binary
chmod +x wireglass-linux-x64 && ./wireglass-linux-x64 https://example.com

# from source
cargo run -- https://example.com
cargo run -- https://example.com --compact --timeout 15
cargo run -- https://example.com --html report.html --card card.svg

# UDP diagnostics (repeat the flag for more targets)
cargo run -- --stun-target stun.l.google.com:19302 --timeout 3 --repeat 3
cargo run -- --quic-target example.com:443 --quic-target example.net:8443

# prove the QUIC client path works when UDP/443 is blocked
cargo run --example quic_selfcheck

Output is JSON on stdout (pretty by default). --render FILE re-renders a saved report offline. A Docker image builds from the repo (docker build -t wireglass .).

Honest limitations

• DNSSEC: the chain and raw DS/DNSKEY are reported, but signatures are not cryptographically validated (unsigned · signed_unverified · delegation_signed_no_dnskey).
• HTTP/3: only the QUIC handshake — no HTTP/3 request/response yet, and the report says so.
• STUN: MESSAGE-INTEGRITY / FINGERPRINT are not validated; TURN is out of scope.
• UDP timeout ≠ blocked: a timeout means no valid response from that endpoint in time — never proof of filtering. One resolved address per target; single vantage point; IPv4 preferred for the connection step.

Release history

• v0.2.1 (2026-10-30) — hardening: stricter URL/scheme validation, no 0.0.0.0 fallback when DNS fails, IPv6 bind for IPv6 HTTP/3 targets, correct HTTP/1.1 body bytes, cooperative cancel; Android manifest reduced to INTERNET, “Save JSON”, clipboard share fallback; CI now covers the Android app.
• v0.2.0 (2026-10-28) — protocol-aware UDP diagnostics (--stun-target, --quic-target), multi-target/multi-port probing, structured udp_measurements, deterministic local UDP tests; HTTP/3 probe uses the URL’s real port.
• v0.1.0 (2026-10-13) — Phase 0: DNS with delegation chain and raw DNSSEC records, TCP, TLS + ALPN, HTTP/2, QUIC handshake, JSON + HTML report, SVG card, score.
• On main, unreleased: Windows stack-overflow fix for cargo run (boxed futures + larger main-thread stack).

Full log: CHANGELOG.md.

Why it exists

Per its own competitor notes, “a timeline” and “a reproducible report” alone are not unique — http-stat-rs and httptap already do that. Wireglass bets on the combination: deep DNS + TLS + HTTP/2 + HTTP/3 in one reproducible output, honest reporting of the silent HTTP/3 downgrade, protocol-aware STUN and QUIC measurements with structured failure categories, and a local single-binary Rust tool that never sends your data to a third-party service.

Links

• Repository: https://github.com/BTF-Kabir-2020/wireglass
• Releases: https://github.com/BTF-Kabir-2020/wireglass/releases
• Docs: https://github.com/BTF-Kabir-2020/wireglass/tree/main/docs (Android, requirements, permissions, APK size, design, deploy)
• CI: https://github.com/BTF-Kabir-2020/wireglass/actions
• Evidence plan: https://github.com/BTF-Kabir-2020/wireglass/blob/main/docs/evidence-plan.md
• Changelog: https://github.com/BTF-Kabir-2020/wireglass/blob/main/CHANGELOG.md