# OWL Claude network diagnostics — owl-network-1.0.0

Implemented 2026-10-21 by Owl. Independent diagnostics, not an Anthropic or BrowserLeaks product. Source is available under AGPL-3.0 in /relay/source.tar.gz. No warranty.

## Research and provenance

BrowserLeaks DNS (https://browserleaks.com/dns) and its public dns.js were examined to understand the observable mechanism: 50 random names, DNS4/DNS6 endpoints, deduplication of resolver addresses, organization/location display. BrowserLeaks WebRTC (https://browserleaks.com/webrtc) and its public webrtc.js demonstrate RTCPeerConnection, STUN, ICE, SDP, HTTP-IP comparison, permission states and media-device visibility. No BrowserLeaks proprietary backend, text or source code is bundled. The OWL interface and implementation are original.

The DNS observation protocol is interoperable with the public dnscheck.tools service, documented by its open source implementation:
https://github.com/brianshea2/addr.tools/tree/d599b4d2a6bd16c5f2c7249addeedb9b8502d373
Copyright (C) 2026 Brian Shea; AGPL-3.0-or-later. See internal/zones/dnscheck and website/dnscheck.tools. We reviewed its WebSocket message schema, query-name options and authoritative transport zones. Its server code is not hosted by OWL or bundled. The existing combined OWL application is distributed under AGPL-3.0-only.

## Genuine DNS observations

After a user starts the test, the browser opens wss://ws.dnscheck.tools/watch/<random-32-bit-id>. The provider currently allows eight hexadecimal characters for an ID. OWL adds a separate random 64-bit per-run label and accepts only exact challenge names from this run, preventing unrelated or colliding session traffic from appearing in its results. IDs are correlation identifiers, not secrets or authentication. A provider collision or unexpected disconnect is reported as incomplete.

The standard test generates 12 unique hostnames and the extended test 50. Half are under test-ipv4.dnscheck.tools and half under test-ipv6.dnscheck.tools. These names exercise IPv4-only and IPv6-only authoritative DNS reachability; they do NOT force the browser to request only A or AAAA records. A, AAAA, HTTPS and other query types are reported separately. This differs from BrowserLeaks' stated IPv4/IPv6 HTTP endpoint test split and is disclosed in the UI.

Up to five browser probes run concurrently with three-second HTTP deadlines, a four-second final observation window, and a 45-second overall cap. DNS messages from the authority contain remoteIp, qname, qtype, proto and optional EDNS Client Subnet. Only valid public resolver IPs and this run's exact names are accepted. At most 500 observations and 30 resolver metadata lookups are processed. The app cannot guarantee that a browser issues every query or that every resolver path is sampled. It displays unique names observed versus attempted versus planned.

A browser HTTP failure (including certificate mismatch for a multi-label random hostname) can occur after successful DNS resolution. HTTP success is never used as proof of resolver identity. No certificate exception or browser security bypass is requested. HTTP probes use no-cors, omit credentials and suppress referrers. The WebSocket's DNS messages are the measurement.

Resolver organization and approximate geography come from https://ip.addr.tools/<observed-public-ip>. DNS queries remain in memory in the browser and are not sent to OWL's API. Resolver-to-authority UDP/TCP/TLS/QUIC describes only that leg; it does not prove client-side DNS encryption. An EDNS subnet is separately displayed and never sent to geolocation lookup.

Count and country mismatch alone never imply a leak. Without an expected resolver list the result asks the visitor to compare their provider. An unexpected observed IP is flagged for investigation. All observed resolvers matching the expected list is only reported for a completed sample with every planned name observed. Timeouts or no observations cannot be interpreted as safe. Expected values must be recursive egress addresses; anycast client addresses like 1.1.1.1 need not match.

### Infrastructure dependency

The current deployment integrates a third-party public authoritative observation service. It is NOT a private authoritative DNS deployment and has no guaranteed service availability. There is no automatic fallback to fabricated data, an HTTP Worker IP, or a fixed list of DNS providers. If the WebSocket is blocked/unavailable, the UI reports an inconclusive result and permits retry.

Cloudflare Workers currently cannot receive arbitrary incoming UDP/TCP port 53 traffic or expose per-query resolver logs for ordinary authoritative zones. A private replacement needs a publicly reachable authoritative DNS server (UDP and TCP 53, IPv4 and ideally IPv6), an NS-delegated test subdomain, and authenticated/isolated session observation over HTTPS/WSS. Replace makeDnsNames and the fixed observation URL in src/scripts/network.ts once such infrastructure is provisioned; retain exact challenge filtering, public address validation, timeouts and failure semantics. No paid server or new subscription was provisioned for this release.

## WebRTC observations

Two short-lived RTCPeerConnections separately use stun:stun.l.google.com:19302 and stun:stun.cloudflare.com:3478. Each creates only an RTCDataChannel, with a maximum ten-second gathering window. There is no call to getUserMedia and no camera/microphone permission prompt. Connections and data channels close on completion, stop, timeout, failure or pagehide. Both ICE events and final SDP are retained in the tab's report.

Host, srflx, prflx and relay candidates are parsed. IPv4-mapped IPv6 addresses normalize to IPv4. Reserved, private, shared CGNAT, link-local, loopback, public and mDNS addresses are distinguished. mDNS names are never resolved by the app. Related addresses are displayed in the evidence. Relay addresses are not considered the user's public egress. Public related (raddr) addresses are included in the comparison because they can reveal a separate direct address.

The HTTP baseline uses /api/security/ip (trusted Cloudflare request metadata, no forwarding-header fallback) and browser requests to https://myipv4.addr.tools/plain and https://myipv6.addr.tools/plain. Public candidates are compared only against independently measured baseline IPs of the same family. A missing IPv6 baseline cannot be compared against IPv4. Equal public candidates mean only a match in this sample. A different address indicates a possible bypass or separate network route, not automatic proof of a real-world identity leak. No candidates or unavailable STUN is inconclusive. Browser permission restrictions may suppress candidates or device enumeration.

Permissions API state for camera/microphone and counts of audioinput/audiooutput/videoinput are collected without requesting permission. No device IDs, group IDs, or device labels are read into the report. Device absence is not proof of hardware absence. SDP may contain local network metadata; download is explicit.

## Data handling and navigation

Network reports are not stored in localStorage, cookies, D1 or a public report feed. They live in tab memory and can be explicitly downloaded as JSON. OWL's baseline endpoint returns the caller's public IP with no-store; it does not insert IPs into the database. Existing anonymous page-view metrics remain independent. External services observe relevant connections/IPs according to their own policies; users see providers and processing details before pressing Start. No probes run merely from loading the DNS/WebRTC pages.

All five languages expose /security/, /security/dns/, /security/webrtc/ (locale prefixes zh, ms, ja, ko). Existing /relay/ and the homepage regional checker retain their URLs and get a common safety navigation. The original regional scoring file is unchanged; new tests do not modify its weights, thresholds or max score.