What each tool measures, and how to read what it says.
Most network tools give you numbers. Pulse gives you the numbers and then says what they mean — which hop is at fault, whether a certificate will outlive your next maintenance window, whether the name server that is not answering matters. Where it makes a judgement, this page tells you the rule behind it, so you can disagree with it knowingly.
Three colours, everywhere, and they always mean the same thing: green measured and fine, amber worth knowing about, red a problem. A hollow dot means never measured, which is not the same as fine — an empty result is not a clean bill of health.
Latency, loss and jitter thresholds are yours to set. Settings → Thresholds. The defaults are a starting point, not a claim: latency good under 100 ms and slow under 200; loss good under 1% and slow under 5%, tighter because loss is not supposed to happen at all; jitter good under 10 ms and slow under 30.
Type a host and start. Pulse walks the whole path to it every 2.5 seconds and keeps a rolling window per hop, so you are looking at behaviour over time rather than one sample.
Each row is a hop: its address, who owns it, then avg, cur and jit in milliseconds, and a sparkline of its recent history. The bar chart on the right draws each hop's minimum-to-maximum range against a shared axis, so a hop that is slow and erratic looks different from one that is merely far away.
When a hop reports loss, two entirely different things can be happening.
The router might be dropping your traffic — in which case everything past it suffers, and the destination sees loss too.
Or it might be forwarding your traffic perfectly and simply rate-limiting the replies it sends about itself. Many routers do this by policy. Nothing is wrong; the hop just will not talk about itself as often as you asked.
Pulse separates the two and labels them. If loss appears at hop 4 and the destination is clean, the path is fine. If loss at hop 4 continues to the destination, hop 4 is where to look.
"Stable · 3 ms · no loss over 9 rounds" is the summary of the window, not the last round. It changes as the session runs, and it is what to screenshot for a ticket.
Optional, about twenty seconds. It measures throughput each way and — more usefully — what latency does while the line is busy. A connection that reads 5 ms idle and 300 ms under load is why calls break up when somebody starts a backup. That gap is bufferbloat.
Eight checks in about ten seconds, then one sentence. The checks run in causal order — link, address, gateway, neighbours, DNS, internet, public address, VPN — and the verdict names the earliest failure, because that is the one that explains the others. No link means no gateway means no DNS; reporting the DNS failure would send you after the wrong thing.
Findings that passed are folded away. Open them when you want the figures behind a pass.
"Another device is using this device's address" means two devices answered ARP for the same address. Worth chasing: usually a static address handed out twice, or a device holding an address after its lease moved.
Enter a host, or host:port for anything not on 443. The SNI
field, disclosed under the target, lets you connect to one address and ask
for a different name — for checking one virtual host of many behind a load
balancer.
curl, Java and Python do not.
"Works in my browser" is exactly the bug this finds.Trust is judged by this device, including any profile or enterprise root installed on it. A certificate that works on your phone and nowhere else is worth knowing about.
Any record type, against the system resolvers or one you name. The strip reports the answering server and the round trip; the answers carry their TTLs. When a reply will not fit in a datagram the query is retried over TCP and the strip says so.
An empty NOERROR is amber, not red: the name exists and has
no record of that type, which is a finding rather than a failure.
NXDOMAIN — the name does not exist — is red.
Domains, addresses and AS numbers. RDAP where a registry offers it, port 43 where it does not. Expiry is banded red inside 30 days and amber inside 90 — a domain is renewed by hand on a yearly cycle, so the warning needs to arrive far earlier than a certificate's.
Ping charts round trips as they arrive, with loss and RFC 3550 jitter.
Traceroute walks the path once, over ICMP, UDP or TCP to port 443. Try TCP when the others are filtered — many networks drop ICMP and UDP probes but pass a connection to 443.
Path MTU finds the largest packet that gets through. If a router names its MTU, Pulse believes it and then verifies; if the path stays silent, it binary-searches. A path MTU below 1500 with no ICMP explaining it is the classic cause of "small pages load, big ones hang".
An SSH and telnet terminal, for the hosts the other tools point at.
Save a host with its address, user and port; keep a password or a key for
it in the device's Keychain (or generate a key in the app and paste its
public half into authorized_keys); tap it to connect. A row
of keys — Esc, Ctrl, Tab, the arrows — sits above the keyboard, and pinch
changes the font. Each host can have its own colour scheme.
From Pulse, a hop's detail sheet offers Open terminal beside Ping this hop; a device on the Devices screen offers the same. If the address belongs to a saved host, that host opens with its user and key; otherwise you are asked for a user. The first time an unsaved session connects, Pulse offers to save it.
A multi-line paste is shown in full before it goes. Every line of a paste runs the moment it lands, so anything with more than one line — or more than a few kilobytes — opens a preview first, numbered, with one Paste button.
With Pro, a session stays open when you go back to the host list and is there when you return; without it, leaving disconnects, and Pulse says so first. Pro also keeps a command history: every command you ran, per host and user, searchable, one tap to paste it back into a prompt — from the terminal's toolbar, from the host list, or from the long-press menu. Anything that looks like a password or a token is never kept, and Record command history and Sync command history with iCloud (off by default) are switches in Settings. The history is a guess taken from what the shell echoes; the optional shell integration makes the host report each command exactly.
Opened from inside a session it starts on that host, which is usually what you want — but it is not locked there. The Host menu at the top left switches to any other host, or to all of them, where everything you have run is one list, newest first, every host mixed together and each row naming the one it came from. Being connected to one machine is no reason to be unable to read what you ran on another.
The list is built to be read. A command you run forty times from now on is one row with a count beside it, not forty rows. History recorded before this version keeps the rows it already has: nothing folds them together after the fact. Commands that cannot be undone — anything that deletes, formats, overwrites or reboots — are marked, so you see them before you tap. A coloured stripe down the side of each row says which host it came from, taken from that host's own terminal colours whenever they are legible against the list. Swipe to pin the one you never want to lose: a pinned command is kept whatever else ages out, and filters for Pinned and Risky sit under the search field. Long-press a row for Edit and send… — the command opens in a field with its arguments listed as buttons, so changing an address or a number is a tap rather than a drag on a tiny cursor, and what you send still meets the same paste preview. Share hands over whatever the list is showing as plain text, one command per line with the host and the times at the top, for the ticket that asks what you ran.
From an SSH session's toolbar, or from a swipe on a host in the list, Files opens two panes over SFTP — the same login as the terminal, no second password or key. This device on one side, the host on the other. Tick what you want and press the button: Download brings the files ticked on the host over to this device, Upload sends the ones ticked here to the host, and each button says how many it is about to move. On a phone held upright the two panes become a switcher you tap between; your ticks stay put when you switch.
Whatever you move lands wherever the other pane is standing — there is no destination to choose and no folder to remember. Walk either side into a different directory first and the next transfer follows it. A download still starts out in this app's own folder — Documents > Pulse — which the Files app shows, with Share beside each finished one, and Add brings files in from Files or iCloud Drive. Folders can be opened but not ticked: whole directories are not transferred yet.
Each pane has its own menu for New folder, Rename, Delete and the sort order, and on the host side a read-only look at a file's permissions. There are no swipe actions any more — a full swipe used to delete a file on a live server. Deleting now needs a tick and a confirmation that names how many files and which host. If what you are moving would overwrite something, Pulse asks once for the whole batch, not once per file, and offers to keep both — the new one is numbered — replace, or skip. A transfer stops if you leave the app: an SSH connection does not survive the app being suspended, so Pulse keeps the screen awake while one runs and says plainly that leaving stops it.
When a batch finishes it tells you and waits — how many files moved, and how many were skipped or failed if any were. The ticks then clear for the files that actually moved, and stay on anything that failed or that you skipped, so sending those again does not mean finding them in the list a second time.
Every run is kept, grouped by day. Each row carries the time, the target, the headline figure and the context — how long it took, where you were, and which interface it went over.
A stored run is judged again every time you open it, against today's thresholds — not frozen at the verdict it was recorded under. A certificate check saved when it had 40 days left reads red once it has 10. Change a threshold in Settings and every past run re-colours.
Free keeps seven days. Pro keeps everything and syncs it through your own iCloud.
The globe in the toolbar pins every tool to one interface — Wi-Fi, cellular, a VPN tunnel — so you can measure them separately and compare. Interfaces that cannot currently carry a probe are still listed, with the reason beside them and a coloured dot: not connected in red, no address or no way out in amber. They stay selectable on purpose: the interface you most want to investigate is often the broken one.
Label the network you are on — "Home", "Office", a client's name — and every run made there is filed under it. It makes History readable months later and stops you comparing two runs that were never comparable.
On a network Pulse has not seen before it can suggest a name, which it gets by asking iOS for your position at kilometre accuracy and turning it into a suburb. Accept it, type your own, or leave it blank. The coordinates are never stored and never leave the device; the label does travel — it is saved with your runs and included when you ask for an AI diagnosis. See the privacy page.
Every measuring tool is free and unlimited, along with seven days of history and three AI diagnoses. Pro adds:
It reads the run's own numbers and writes what is wrong, where, why it is probably so, and what to try next — with the evidence it used and a confidence rating. It can be wrong: check the hops it names before acting.
The run leaves your device to produce it. The first time you ask, Pulse shows you exactly what is sent and waits for you to agree. The privacy page lists it in full.
Local network — needed to see the other devices on your network and for the link test. Location — iOS requires it before any app can read the Wi-Fi network's name, and Pulse also uses it at kilometre accuracy to suggest a place label for a network you have not seen before. Your coordinates are never stored and never leave the device; only a label you accept does. See the privacy page. Declining either leaves the rest of the app working.