Information for IT

Summary

A member of your HR team cannot open a supplier web application. This page, which they may have been asked to run, tries a list of that supplier's own addresses from their device, times the results, and writes a plain-text report describing what worked and what did not.

It is a static web page. There is no agent, no installer, no extension and no background process. Closing the tab ends it.

Depending on how it has been deployed, some checks are supported by a small serverless function that reports back what the supplier's server received — the labels a proxy added, and the public address the request arrived from. Where that function is not deployed, those checks report themselves as unavailable rather than guessing, and the page still works.

The part you probably care about

The page has no ability to transmit the report. There is no upload endpoint in it. The report is assembled in the browser, displayed in an editable text box, and can only leave the device if a person copies, saves, shares or emails it deliberately.

You do not have to take that on trust. It takes about a minute to confirm:

• Open the page with developer tools on the Network tab.
• Run the check.
• Every request will be to one of the addresses listed on the page itself and reproduced below. There are no POST or PUT requests at all.
• Search the page source for fetch. Every call is a GET to a listed address.

The report is plain text, so you can read the whole thing before it is sent, and edit or delete any part of it.

What it deliberately does not do

• No local network discovery. It does not use WebRTC to enumerate local addresses, does not probe RFC1918 ranges, does not scan ports and does not attempt host discovery. It contacts a fixed list of public addresses belonging to the supplier, and nothing else.
• No access to device data. No filesystem, clipboard read, camera, microphone, geolocation, contacts or browsing history. It reads the user-agent string and the browser's own network-quality estimate, both of which every website already receives.
• No persistence. No cookies are set on this page's own domain. One test cookie is set on the supplier's domain, scoped to a single path, expiring after two minutes, containing a fixed constant.
• No analytics, no third-party scripts, no CDN, no webfonts. Every asset is served from the page's own origin. That is why it uses system fonts.

Every check it runs

Grouped as the page groups them. Each entry states what is tested, why, and which requests it makes.

If you would rather check it yourself

These are the equivalent commands. The diagnostic page exists because the people reporting the problem cannot run them, not because they are better.