Administrator Guide

Network Requirements

URLs and ports to allow for Network Weather connectivity

Network Weather clients require access to several network endpoints to function properly. This document lists all required URLs for firewall allowlisting and proxy configuration.

Quick Reference

Required Endpoints

Domain Port Protocol Purpose
api.networkweather.com 443 HTTPS C2 check-in, configuration
logs.networkweather.com 443 HTTPS Telemetry upload
pkgs.networkweather.com 443 HTTPS App updates

Firewall Rules (Minimum)

ALLOW TCP 443 to *.networkweather.com

Endpoint Details

1. API Server (api.networkweather.com)

Purpose: Command & Control (C2) server for device registration, configuration sync, and update notifications.

Property Value
Domain api.networkweather.com
Port 443
Protocol HTTPS (TLS 1.2+)
Paths /v1/check-in, /v1/device/checkin
Method POST

Traffic Pattern:

  • Check-in on app launch
  • Periodic check-in (every 1-4 hours)
  • Payload: ~1-2 KB JSON

If Blocked:

  • App functions normally for local diagnostics
  • No automatic update notifications
  • No MSP dashboard visibility
  • Device not registered with organization

2. Telemetry Server (logs.networkweather.com)

Purpose: Diagnostic telemetry for remote troubleshooting and fleet analytics.

Property Value
Domain logs.networkweather.com
Port 443
Protocol HTTPS (TLS 1.2+)
Path /v1/ingest/logs
Method POST

Traffic Pattern:

  • Batched uploads (up to 100 events per batch)
  • Upload frequency: every few minutes when active
  • Payload: ~10-50 KB per batch (compressed)

If Blocked:

  • App functions normally for local diagnostics
  • No remote visibility in MSP dashboard
  • Local diagnostics still work
  • Logs accumulate locally (not persisted long-term)

Privacy Note: Telemetry never includes passwords, credentials, or network traffic contents. See our Privacy Policy for details.

3. Package Server (pkgs.networkweather.com)

Purpose: App update distribution for both macOS and Windows.

Property Value
Domain pkgs.networkweather.com
Port 443
Protocol HTTPS (TLS 1.2+)
Paths /macOS/*, /Windows/*
Method GET

Traffic Pattern:

  • Update check: ~5 KB (appcast XML)
  • Update download: 5-50 MB (infrequent)

macOS Paths:

  • /macOS/appcast.xml — Sparkle update feed
  • /macOS/NetworkWeather-*.pkg — Installer packages

Windows Paths:

  • /Windows/NwxWin.appinstaller — App Installer manifest
  • /Windows/NwxWin-*.msix — MSIX packages

If Blocked:

  • App functions normally
  • No automatic update checks
  • Must deploy updates manually via MDM

Diagnostic Endpoints (Third-Party)

Network Weather uses third-party services for network diagnostics. These are used for measurement purposes only—no sensitive data is transmitted.

Public IP Discovery

Domain Port Protocol Purpose
stun.cloudflare.com 3478 UDP (STUN) Public IP detection
whoami.ds.akahelp.net 53 DNS TXT Fallback IP detection

If Blocked:

  • Public IP may show as "Unknown"
  • ISP identification may be incomplete
  • Local network diagnostics unaffected

IP Geolocation

Domain Port Protocol Purpose
ipinfo.io 443 HTTPS IP geolocation and ISP info

Endpoints:

  • ipinfo.io/json — Current connection's public IP and location
  • ipinfo.io/{ip}/json — Geolocation for specific IP

Traffic Pattern:

  • Lookup on network change
  • Cached locally for 1 year per IP
  • Rate limit: 50,000 requests/month (free tier)

If Blocked:

  • Location info shows as "Unknown"
  • ISP name may be incomplete
  • Core diagnostics still functional

Network Intelligence

Domain Port Protocol Purpose
*.asn.cymru.com 53 DNS TXT ASN/ISP identification
cloudflare.com 443 HTTPS Connection diagnostics

DNS Queries:

  • origin.asn.cymru.com — IP to ASN mapping
  • asn.cymru.com — ASN to organization name

HTTPS Endpoint:

  • cloudflare.com/cdn-cgi/trace — Connection trace info

If Blocked:

  • ISP name may show as "Unknown"
  • Some network path information unavailable
  • Core diagnostics still functional

OUI Database (Device Identification)

Domain Port Protocol Purpose
www.wireshark.org 443 HTTPS MAC vendor database

Endpoint:

  • /download/automated/data/manuf — IEEE OUI database (~2 MB)

Traffic Pattern:

  • Downloaded once on first launch
  • Cached locally for 30 days
  • Contains 66,000+ vendor entries

If Blocked:

  • Router/device manufacturer shows as "Unknown"
  • MAC addresses still displayed
  • Core diagnostics unaffected

Default Monitoring Targets

Network Weather pings default targets to measure network health. These can be customized via config.json.

Target Port Protocol Purpose
1.1.1.1 — ICMP Internet connectivity check
User's gateway — ICMP/ARP LAN connectivity
Traceroute path — ICMP/UDP Path discovery

If Blocked:

  • Configure alternative ping targets in config.json
  • Use internal endpoints for enterprise networks
  • ICMP is required for ping measurements

Proxy Configuration

System Proxy

Network Weather respects system proxy settings on both macOS and Windows. Configure proxy at the OS level:

macOS: System Preferences → Network → Advanced → Proxies

Windows: Settings → Network & Internet → Proxy

Proxy Allowlist

If using SSL inspection, add these domains to the bypass list to avoid certificate errors:

*.networkweather.com
stun.cloudflare.com
cloudflare.com
*.asn.cymru.com
ipinfo.io
www.wireshark.org

Authentication

Network Weather supports proxy authentication via system credentials. If your proxy requires authentication, ensure the user account has appropriate permissions.

Complete Allowlist

Domains (Wildcard)

*.networkweather.com
*.asn.cymru.com
stun.cloudflare.com
cloudflare.com
whoami.ds.akahelp.net
ipinfo.io
www.wireshark.org

IP Addresses

Network Weather endpoints use Cloudflare's global network. For IP-based firewalls, allow Cloudflare IP ranges:

  • IPv4: https://www.cloudflare.com/ips-v4
  • IPv6: https://www.cloudflare.com/ips-v6

Note: Cloudflare IPs change periodically. Domain-based rules are recommended.

Offline Operation

Network Weather continues to function without internet connectivity:

Feature Offline Behavior
Local diagnostics Full functionality
WiFi analysis Full functionality
Gateway detection Full functionality
Ping to local targets Works
Ping to internet Fails (expected)
Update checks Skipped
Telemetry Queued locally
MSP dashboard No visibility

When connectivity is restored, telemetry is uploaded and update checks resume.

Troubleshooting

Verify Connectivity

macOS:

# Test API endpoint
curl -I https://api.networkweather.com/v1/check-in

# Test package server
curl -I https://pkgs.networkweather.com/macOS/appcast.xml

# Test STUN (requires nc with UDP)
nc -u -z stun.cloudflare.com 3478 && echo "STUN OK"

Windows (PowerShell):

# Test API endpoint
Invoke-WebRequest -Uri "https://api.networkweather.com/v1/check-in" -Method HEAD

# Test package server
Invoke-WebRequest -Uri "https://pkgs.networkweather.com/Windows/NwxWin.appinstaller" -Method HEAD

Common Issues

"Unable to check for updates"

  • Verify pkgs.networkweather.com is accessible
  • Check for SSL inspection interference
  • Ensure port 443 outbound is allowed

"Device not visible in dashboard"

  • Verify api.networkweather.com is accessible
  • Check logs.networkweather.com is accessible
  • Review proxy/firewall logs for blocked requests

"Public IP shows as Unknown"

  • Allow UDP 3478 to stun.cloudflare.com
  • Or allow DNS queries to whoami.ds.akahelp.net

Support

For network configuration assistance, contact support@networkweather.com.