mrambossekandClaude Opus 5
6d042a9d89
Captive portals, hotel wifi and corporate firewalls routinely permit only 80 and 443 — exactly the networks this tool exists to diagnose. A control plane on 8443 is unreachable precisely when it matters most, and it fails as "cannot reach server", which tells the user nothing about why. The two cannot share a certificate, so sharing the port needs two names. The control plane is trusted by SPKI pin and uses a long-lived self-signed certificate; a browser needs one a CA vouches for. One name on one port is one certificate. Pinning the Let's Encrypt key instead was considered and rejected: it survives renewal only while key reuse holds, so a routine key rotation would brick the fleet. One listener now picks the certificate by SNI and the handler by Host. Both have to agree, or a client gets the pinned certificate with the admin UI behind it. 8443 stays open. Devices enrolled before this carry that URL in their settings, and closing it for the sake of a port number would strand every one of them; it can go once nothing points at it. Verified per SNI on 443: fmr.echo-lot.app serves the Let's Encrypt cert, fmr-1.echo-lot.app serves the self-signed one whose pin is unchanged, and /v1/profile answers 401 on the control name against 303 to the login page on the UI name. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Echolot
Free software for detecting and debugging local network issues from an Android phone — built for people who actually know what a neighbor table is.
Most "wifi analyzer" apps show you signal bars. Echolot aims at the layer where home and office networks actually break: duplicate DHCP servers, broken IPv6 RAs, MTU black holes, NAT64 weirdness, multicast that dies at the AP, DNS that answers differently than it should. It records what it observed, separates observation from interpretation, and exports the whole run so you can argue with it later.
Status: pre-release. The capability prober runs on real hardware; the production app and the probe server are not built yet.
Repository layout
docs/ design docs — the contract for everything below
echolot-prober/ capability prober: validates the no-root feasibility matrix on real devices
The Go probe server and the production app land here as siblings.
Design docs
The three specs are draft-complete and reviewed; treat them as the contract.
| Doc | What it defines |
|---|---|
| docs/feature-catalog-and-feasibility.md | Full feature list + the no-root feasibility matrix |
| docs/measurement-schema.md | Archived/exportable measurement JSON (observation vs finding, two-clock rule, anonymization) |
| docs/probe-protocol.md | Client↔server wire protocol (pinned TLS control plane, binary UDP data plane, STUN, canary DNS) |
| docs/build-status.md | Running log of decisions and next steps |
Privilege tiers
Every result records which tier produced it:
app— no root, no special setup. The bulk of the functionality.shizuku— ADB-shell privileges via wireless pairing, no root. Shipped in v1.root— future optional module.
Licensing
| Part | License | Why |
|---|---|---|
| All code (app, prober, server) | GPL-3.0-or-later | The value here is the platform-API research; copyleft keeps derivative apps free |
docs/ (the specs) |
CC-BY-4.0 | A wire protocol and a measurement format should be implementable by anyone, without license anxiety |
Full texts: LICENSE (GPLv3) and docs/LICENSE (CC BY 4.0).
Sources carry SPDX-License-Identifier headers.
If you want to build a compatible server or client, the protocol and schema docs are deliberately permissive — go ahead.
Building
See echolot-prober/README.md. Short version, from echolot-prober/:
echo "sdk.dir=/path/to/Android/sdk" > local.properties
./gradlew :app:assembleDebug