---
title: Network
description: Ping (ICMP), TCP, UDP, DNS and full network-path (MTR) monitoring — reachability, latency, packet loss, expected records and hop-by-hop routes.
canonical: https://watchfor.io/docs/monitors/network
---

# Network

Ping (ICMP), TCP, UDP, DNS and full network-path (MTR) monitoring — reachability, latency, packet loss, expected records and hop-by-hop routes.

Network monitors check connectivity and routing below the application layer —
servers, ports, resolvers and the path packets take to reach you. All of them
run from your chosen [probe locations](/docs/monitors/scheduling#locations)
and follow the standard [confirmation](/docs/monitors/scheduling#how-a-failure-becomes-an-incident)
before an incident opens (MTR uses a slower re-check cadence).

## Ping (ICMP)

Measures reachability with **round-trip time** (min / avg / max), **jitter**
and **packet loss**. The monitor view focuses on RTT and loss rather than a
generic "duration", so you see latency trends and intermittent drops at a
glance.

**Target:** a hostname or IP address.

| Setting | Notes |
| --- | --- |
| **Ping Count** | Packets per check (default 1). More packets give a meaningful loss percentage. |
| **Packet Size** | Payload bytes (default 56). |
| **Timeout** | Seconds to wait (default 5). |
| **Network Protocol (IP)** | Auto (prefer IPv4) / Force IPv4 / Force IPv6. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The host doesn't answer at all. |
| **Packet Loss** | off | Loss exceeds a percentage. |
| **Ping Latency** | off | Average RTT exceeds a threshold in milliseconds. |

Try it once, free: [ping test](/ping-test).

## TCP

Opens a TCP connection to a **host and port** to confirm a service is
accepting connections. A **connection-timing waterfall** breaks the handshake
into DNS, connect and (optionally) TLS stages, so you can see exactly where a
slow connect comes from.

**Target:** `host:port`, e.g. `db.example.com:5432`.

| Setting | Notes |
| --- | --- |
| **Use TLS** | Wrap the connection in TLS after connecting; records the handshake time and the certificate's days until expiry. |
| **Timeout** | Seconds (default 5). |
| **Network Protocol (IP)** | Auto (prefer IPv4) / Force IPv4 / Force IPv6. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | Connection refused, unreachable or timed out. |
| **TCP Connect Time** | on (warning, 1000 ms) | The connect takes longer than the threshold. |
| **TLS Handshake Time** | off | The TLS handshake exceeds the threshold (with **Use TLS**). |
| **Response Match** | off | After connecting, send a string and check the reply against a regular expression — banner grabs, protocol `PING`s, line-based health endpoints. Both the payload and the pattern are set on the rule. The pattern is matched against up to **1 MiB** of the reply, including a single very long line (a minified HTML or JSON body); the first 64 KiB of each line is kept with the check. |

Free: [port checker](/port-checker).

## UDP

Sends a UDP datagram to a host and port and records whether — and how fast —
a reply comes back. For services that don't use TCP: DNS, NTP, RADIUS, game
servers, syslog.

**Target:** `host:port`, e.g. `ntp.example.com:123`.

| Setting | Notes |
| --- | --- |
| **Payload format** | Text (ASCII) or Base64 for binary payloads such as a raw DNS query packet. |
| **Send Data** | The payload to send. |
| **Timeout** | Seconds (default 5). |
| **Network Protocol (IP)** | Auto (prefer IPv4) / Force IPv4 / Force IPv6. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The datagram could not be sent (name resolution or socket failure). |
| **No Response Received** | off | Nothing came back before the timeout. Off by default because many UDP services are one-way — turn it on when you expect replies. |
| **Response Latency** | off | First byte of the reply takes longer than the threshold. |
| **Response Match** | off | The reply doesn't match a regular expression set on the rule. |
| **Response Too Short** | off | The reply is smaller than *N* bytes — catches truncated or empty answers. |

## DNS

Resolves a name and checks the answer.

**Target:** a domain name, e.g. `example.com`. Two record types take a
different target: **PTR** wants an IP address (`203.0.113.10` or `2001:db8::1`
— the reverse name is derived for you; a hostname also works and is resolved
first, then every address is looked up in reverse), and **SRV** wants the
service name, e.g. `_sip._tcp.example.com`.

| Setting | Notes |
| --- | --- |
| **Record Type** | A (default), AAAA, CNAME, MX, NS, TXT, SOA, SRV, PTR or CAA. SOA answers carry the primary name server, admin mailbox and serial; SRV the target host, port, priority and weight; CAA the tag (`issue`, `issuewild`, `iodef`) and authority value. |
| **Upstream DNS Resolver** | The probe location's own resolver (default), Cloudflare `1.1.1.1`, Google `8.8.8.8`, Quad9 `9.9.9.9`, OpenDNS, or any custom IP (`ip` or `ip:port`) — for example your own authoritative server, to catch a stale zone before the world does. |
| **Capture record details** | Store the returned records with every check (on by default) so the Overview shows what was actually resolved. |
| **Timeout** | Seconds (default 5). |
| **Network Protocol (IP)** | Auto (prefer IPv4) / Force IPv4 / Force IPv6 — the address family used to reach a custom upstream resolver, and to resolve a hostname target before a PTR lookup. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The lookup fails — NXDOMAIN, SERVFAIL, timeout. |
| **DNS Lookup Time** | on (warning, 1000 ms) | Resolution takes longer than the threshold. |
| **No Records Returned** | off | The query succeeds but the record set is empty. |
| **DNS Errors** | off | The resolver returned an error. Evaluated on failed checks too, so it fires alongside *Probe Status* and names the failure as a resolver error rather than a generic "lookup failed". |
| **Expected DNS Records** | off | The answer doesn't contain the values you expect (set the expected values and match mode on the rule). The incident's root cause shows what differed. |

**Expected DNS Records — what to enter.** One value per line. The match mode
on the rule decides how it's compared: exact (trailing dots ignored),
*contains*, *none contains* (forbidden strings) or a regex. What counts as
"the value" depends on the record type:

| Record type | Expected value |
| --- | --- |
| A / AAAA | The address, e.g. `203.0.113.10` or `2001:db8::1` |
| CNAME | The canonical name, e.g. `cdn.example.net` |
| NS | A name-server host, e.g. `ns1.example.net` |
| MX | The mail host, written either `mail.example.com` or `10 mail.example.com` |
| TXT | The record text, e.g. `v=spf1 include:_spf.example.com -all` (use *contains* for long records) |
| PTR | The reverse hostname, e.g. `mail.example.com` |
| CAA | The authority value only, e.g. `letsencrypt.org` — the tag and flag aren't compared |
| SOA | The primary name server, the responsible mailbox or the serial, e.g. `ns1.example.net`, `hostmaster.example.net` or `2026090201` |
| SRV | The target host, e.g. `sip.example.com` — port, priority and weight are shown with the record but not compared |

Checking from several regions doubles as a propagation check: after a zone
change, the Probes tab shows which locations already see the new records.
Free tools: [DNS checker](/dns-checker), [DNS propagation checker](/dns-propagation-checker).

## Network path (MTR)

Traces the **full route** to your host, hop by hop, combining traceroute and
ping. You get:

- a **path ladder** of every hop with per-hop latency and loss,
- a **path-history heatmap** you can click to **replay** the route as it was
  at any moment,
- a per-location breakdown, so a single flapping hop near one probe doesn't
  mislead you.

Great for diagnosing "it's slow but the server is fine" — the problem is
often a hop in between.

**Target:** a hostname or IP address.

| Setting | Notes |
| --- | --- |
| **Protocol** | ICMP (default), UDP or TCP traceroute. |
| **Pings per Hop** | Probes sent per hop (default 1). |
| **Max Hops** | Maximum TTL (default 30). |
| **Port** | For TCP/UDP traceroute. |
| **Timeout** | Seconds (default 30). |
| **IP version** | Auto / IPv4 / IPv6 (`mtr -4` / `-6`). |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The trace could not run. |
| **Destination Unreachable** | on (critical) | The destination never answered. Evaluated on failed traces too, so an unreachable host is reported as exactly that rather than only as a generic probe failure. |
| **Destination Packet Loss** | off | Loss at the final hop exceeds a percentage. |
| **Destination RTT** | off | Average RTT to the destination exceeds a threshold. |
| **Loss At Any Hop** | off | Any hop on the path shows loss above a percentage. |
| **Unresponsive Hops** | off | More than *N* hops don't answer (informational — many routers rate-limit ICMP). |

MTR traces are slow, so confirmation re-checks run every 2 minutes for up to
10 minutes rather than every 30 seconds. Free: [traceroute online](/traceroute-online).

> **Info**
>
> Network monitors default to IPv4. Where the target supports it, switch a
> monitor to IPv6 under **Settings → Advanced Options** — see
> [Choosing IP version](/docs/reference/probe-locations#choosing-ip-version).

## Also via API

Create with `type` set to `icmp`, `tcp`, `udp`, `dns` or `mtr` — the config
keys and alert metrics for each are listed in the
[type catalog](/docs/api/monitor-types): [ICMP](/docs/api/monitor-types#icmp-ping),
[TCP](/docs/api/monitor-types#tcp), [UDP](/docs/api/monitor-types#udp),
[DNS](/docs/api/monitor-types#dns), [MTR](/docs/api/monitor-types#mtr-traceroute).

---

Canonical page: https://watchfor.io/docs/monitors/network · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt