Network observation

How readings are taken, normalised and compared.

Everything GURDN knows comes from asking Windows. It does not probe the network, scan other hosts, or inspect the contents of traffic.

What a reading contains

Which interfaces exist, their type, their status, and whether they are connected.
Unicast addresses, prefix lengths, DHCP origin, gateways and MTU per interface.
The routing table, joined to the interface list, to name the active path.
The resolvers configured per interface.
The associated wireless network and its security type.
Whether a VPN interface is present.
The host firewall profile and whether it is enabled.

Every observation reports its own reliability

A reading is recorded as collected, partly collected, or not available, with a reason in the last two cases. This matters more than it sounds: a product that silently treats a failed read as an empty result will tell you a machine is fine because it could not see anything wrong.

Collector health is itself tracked. A stalled or failing observer degrades the connection verdict rather than leaving the previous answer on screen.

How often

Windows publishes change notifications for interfaces, addresses and routes, and GURDN subscribes to them, so those are observed within milliseconds. It publishes no notification for resolver, firewall or wireless security changes, so GURDN polls for those on an adaptive interval. A change that starts and finishes between two observations is not seen.

Baselines

A network is fingerprinted from the interface kind, the wireless network name, the gateway address and the gateway hardware address from the neighbour table. The baseline is what that network looked like last time. Judging against the network rather than against a general idea of normal is what lets GURDN treat your home router and an airport network differently without being told to.

A network GURDN has not seen before has no baseline, and is never trusted by default.

Correlation

Diffs are grouped into transitions and correlated, so that changes which arrived together are judged together.

Figure 5, correlation

Resolver changedordinary on its own
New adapter appearedordinary on its own
Default route movedordinary on its own
Firewall profile changedordinary on its own

Correlated

One event, with its evidence

severity, confidence, and the inputs it used

Explained to you, in order

with what GURDN could not read also shown

Each of these happens innocently every day. Arriving together, within seconds, on a network joined for the first time, they are worth a sentence to the person using the machine.

What this does not give you

An adapter hidden by a filter driver is invisible to the Windows IP Helper API, and so to GURDN.
Where several interfaces carry a default route, GURDN reports the ambiguity instead of guessing.
No observation establishes intent. GURDN reports what changed, not who changed it or why.

See limitations for the full list.