---
title: "Wireglass connection inspector"
description: "Rust CLI measuring DNS → TCP → TLS (ALPN) → HTTP/2 → HTTP/3 plus UDP/STUN and QUIC, with honest failures. v0.2.1 for Linux, macOS, Windows, Android."
author: "Mohammad-Pouya Ghourchiani"
canonical: "https://ghourchiani.ir/projects/wireglass"
image: "https://ghourchiani.ir/og/mark-square.png"
updated: "2026-10-31"
lang: "en"
generated: "2026-11-02"
---
# Wireglass connection inspector

> **TL;DR:** Local-only Rust CLI that measures DNS → TCP → TLS (ALPN) → HTTP/2 → HTTP/3 plus UDP/STUN and QUIC probes — prebuilt for Linux, macOS, Windows and Android.

Wireglass is a local-only Rust CLI that walks the real path of a connection — DNS → TCP → TLS (ALPN) → HTTP/2 → HTTP/3 — and reports each step as a directly measured, reproducible result. Since v0.2.0 it also runs protocol-aware UDP diagnostics for STUN and QUIC. Nothing is inferred or guessed; every failed measurement is reported with its error and a precise status.

## Direct answer

One command, one target, one JSON report. Deep DNS (records, TTLs, CAA, delegation chain, DS/DNSKEY) + real TCP connect + TLS handshake (protocol, cipher, ALPN, certificate expiry) + a real HTTP/2 request + a real QUIC/HTTP-3 handshake + optional STUN/QUIC UDP probes. The silent HTTP/3 downgrade — advertised via `Alt-Svc` but never actually connected — is reported honestly instead of being hidden. Download a prebuilt binary from [Releases](https://github.com/BTF-Kabir-2020/wireglass/releases) and run it against any URL.

## Status (2026-10-31)

- **Latest release:** [v0.2.1](https://github.com/BTF-Kabir-2020/wireglass/releases/tag/v0.2.1) (2026-10-30) — prebuilt binaries for Linux x86_64, macOS ARM64 and Windows x86_64, plus an Android APK.
- **Phase 1:** scoring + interpretive "roast" on top of the Phase 0 measurement engine. The Phase 1 evidence gates G1–G6 in [`docs/evidence-plan.md`](https://github.com/BTF-Kabir-2020/wireglass/blob/main/docs/evidence-plan.md) are still open.
- **CI** ([Actions](https://github.com/BTF-Kabir-2020/wireglass/actions)): `cargo fmt` + `clippy -D warnings` (core and Android app), build + tests on Linux, macOS and Windows, and an Android host check — green on `main`. A separate Release workflow builds the binaries for each tag.
- **License:** MIT OR Apache-2.0.

## What it measures

- **DNS** — A / AAAA records with real TTLs, CAA, the NS/SOA delegation chain (root → … → host zone), raw DS / DNSKEY records, explicit errors (`hickory-resolver`).
- **TCP** — real connect timing to a chosen address; `--repeat N` records dispersion.
- **TLS** — real handshake timing, protocol version, cipher suite, negotiated ALPN, certificate subject/issuer/expiry (`rustls` + `x509-parser`).
- **HTTP/2** — a real request over the negotiated ALPN, capturing status, `server` and `Alt-Svc`.
- **HTTP/3** — a real QUIC handshake with ALPN `h3` on the URL's actual port; *advertised* is kept separate from *actually connected*.
- **UDP/STUN** — a STUN Binding request; success only for a correlated Binding response with the right magic cookie, transaction ID and lengths. Repeatable, multi-target.
- **UDP/QUIC** — probes that reuse the same HTTP/3 handshake against any host:port.
- **Score** — `score/total`, grade, per-category reasons and a deterministic roast, in the JSON and the HTML report.

## Download (v0.2.1)

| Platform | File | Size |
| --- | --- | --- |
| Linux x86_64 | `wireglass-linux-x64` | 10.8 MB |
| macOS ARM64 | `wireglass-macos-arm64` | 9.0 MB |
| Windows x86_64 | `wireglass-windows-x64.exe` | 8.0 MB |
| Android (arm64-v8a) | `wireglass-android-arm64-v0.2.1.apk` | 7.4 MB |

SHA256 checksums (`SHA256SUMS.txt`, `wireglass-android-SHA256SUMS.txt`) and both license files ship with every release.

**Android** is an engineering preview, not a Play Store release: a Slint UI over the same `wireglass::run` core, `minSdk 26` (Android 8), `targetSdk 34`, arm64 only, and **only the `INTERNET` permission**. It has live stage progress, cancel, share with clipboard fallback, recent targets and "Save JSON" export. Device coverage is tracked separately — no broad OS-support claim without evidence.

## Run it

```sh
# prebuilt binary
chmod +x wireglass-linux-x64 && ./wireglass-linux-x64 https://example.com

# from source
cargo run -- https://example.com
cargo run -- https://example.com --compact --timeout 15
cargo run -- https://example.com --html report.html --card card.svg

# UDP diagnostics (repeat the flag for more targets)
cargo run -- --stun-target stun.l.google.com:19302 --timeout 3 --repeat 3
cargo run -- --quic-target example.com:443 --quic-target example.net:8443

# prove the QUIC client path works when UDP/443 is blocked
cargo run --example quic_selfcheck
```

Output is JSON on stdout (pretty by default). `--render FILE` re-renders a saved report offline. A Docker image builds from the repo (`docker build -t wireglass .`).

## Honest limitations

- **DNSSEC:** the chain and raw DS/DNSKEY are reported, but signatures are **not** cryptographically validated (`unsigned` · `signed_unverified` · `delegation_signed_no_dnskey`).
- **HTTP/3:** only the QUIC handshake — no HTTP/3 request/response yet, and the report says so.
- **STUN:** `MESSAGE-INTEGRITY` / `FINGERPRINT` are not validated; TURN is out of scope.
- **UDP timeout ≠ blocked:** a timeout means no valid response from that endpoint in time — never proof of filtering. One resolved address per target; single vantage point; IPv4 preferred for the connection step.

## Release history

- **v0.2.1** (2026-10-30) — hardening: stricter URL/scheme validation, no `0.0.0.0` fallback when DNS fails, IPv6 bind for IPv6 HTTP/3 targets, correct HTTP/1.1 body bytes, cooperative cancel; Android manifest reduced to `INTERNET`, "Save JSON", clipboard share fallback; CI now covers the Android app.
- **v0.2.0** (2026-10-28) — protocol-aware UDP diagnostics (`--stun-target`, `--quic-target`), multi-target/multi-port probing, structured `udp_measurements`, deterministic local UDP tests; HTTP/3 probe uses the URL's real port.
- **v0.1.0** (2026-10-13) — Phase 0: DNS with delegation chain and raw DNSSEC records, TCP, TLS + ALPN, HTTP/2, QUIC handshake, JSON + HTML report, SVG card, score.
- **On `main`, unreleased:** Windows stack-overflow fix for `cargo run` (boxed futures + larger main-thread stack).

Full log: [CHANGELOG.md](https://github.com/BTF-Kabir-2020/wireglass/blob/main/CHANGELOG.md).

## Why it exists

Per its own [competitor notes](https://github.com/BTF-Kabir-2020/wireglass/blob/main/docs/competitors.md), "a timeline" and "a reproducible report" alone are not unique — `http-stat-rs` and `httptap` already do that. Wireglass bets on the combination: deep DNS + TLS + HTTP/2 + HTTP/3 in one reproducible output, honest reporting of the silent HTTP/3 downgrade, protocol-aware STUN and QUIC measurements with structured failure categories, and a local single-binary Rust tool that never sends your data to a third-party service.

## Links

- Repository: https://github.com/BTF-Kabir-2020/wireglass
- Releases: https://github.com/BTF-Kabir-2020/wireglass/releases
- Docs: https://github.com/BTF-Kabir-2020/wireglass/tree/main/docs (Android, requirements, permissions, APK size, design, deploy)
- CI: https://github.com/BTF-Kabir-2020/wireglass/actions
- Evidence plan: https://github.com/BTF-Kabir-2020/wireglass/blob/main/docs/evidence-plan.md
- Changelog: https://github.com/BTF-Kabir-2020/wireglass/blob/main/CHANGELOG.md