Skip to content

ISP Performance Monitor

Evidence-grade ISP performance monitoring for Ofcom-aligned complaints. Runs on a dedicated Linux Mint workstation connected directly to the Technicolor router, bypassing the UniFi network for clean ISP-only measurements.

Overview

Property Value
Host Linux Mint (192.168.100.164 / 10.44.1.14)
Location UK - Direct to Technicolor DGA0153
Dashboard isp.charliehub.net
Database SQLite (~/isp-audit/data/isp_evidence.db)
ISP Trooli (900/900 Mbps declared)
Migrated 2026-02-08 (from CT1118)

Purpose

This system collects WAN-side metrics directly from the ISP router interface to build an evidence dataset for potential Ofcom complaint or early-termination dispute with Trooli. The direct connection to the Technicolor router eliminates UniFi as a variable.

Architecture

┌─────────────────────┐     ┌─────────────────────┐
│   Technicolor       │     │   Linux Mint        │
│   DGA0153 (ISP)     │────▶│   192.168.100.164   │
│   192.168.100.1     │     │   ISP Monitor       │
└─────────────────────┘     └─────────────────────┘
         │                          │
         │                          │ WiFi (10.44.1.14)
         ▼                          ▼
┌─────────────────────┐     ┌─────────────────────┐
│   Internet          │     │   hub2 (Traefik)    │
│   (Trooli ISP)      │     │   isp.charliehub.net│
└─────────────────────┘     └─────────────────────┘

Network Configuration

Interface IP Purpose
enp3s0 (Ethernet) 192.168.100.164 Primary - Direct to Technicolor, all speedtests route here
wlp2s0 (WiFi) 10.44.1.14 Secondary - Management access via UniFi network

Routing

Policy routing ensures all speedtests go through the Technicolor (enp3s0) while the web dashboard is accessible via WiFi (wlp2s0).

Data Collection

Metrics Collected

Metric Frequency Source
WAN throughput (rx/tx bytes) Every 60s Local interface (/sys/class/net/enp3s0/statistics)
Latency Every 60s Ping to 1.1.1.1
Ping probes (RTT, packet loss) Every 30s fping to 8.8.8.8, 1.1.1.1, ping.ui.com
Ookla Speedtest Scheduled (see below) speedtest CLI to Trooli Slough (ID: 54746)
TBB Download Test With each speedtest ThinkBroadband 1GB download

Speedtest Schedule

Time Zone Purpose
05:00, 06:00 CONTROL Baseline (off-peak)
13:00 MIDDAY Daytime reference
17:00-23:30 PEAK Every 30 mins during peak hours

Each slot has ±3 minute random jitter to avoid ISP detection.

Peak Hours

Peak hours are defined as 19:00-23:00 UK time - this is when ISP congestion typically manifests and is the focus of Ofcom-relevant metrics.

File Locations

On Linux Mint (192.168.100.164)

~/isp-audit/
├── enhanced_monitor.py     # Main monitoring daemon
├── web_server.py           # Dashboard web server (port 8080)
├── web_report_enhanced.py  # Dashboard HTML generator
├── discrepancy_generator.py # Forensic audit reports
├── report_generator.py     # Weekly/monthly report generation
├── start_monitor.sh        # Startup script
├── stop_monitor.sh         # Stop script
├── data/
│   └── isp_evidence.db     # SQLite database
├── reports/                # Generated reports
└── logs/
    ├── monitor.log         # Monitor logs
    └── webserver_stdout.log

Service Management

Start/Stop

# SSH to Mint
ssh charles@192.168.100.164

# Start services
cd ~/isp-audit && ./start_monitor.sh

# Stop services
cd ~/isp-audit && ./stop_monitor.sh

# Check status
ps aux | grep -E 'enhanced_monitor|web_server'

View Logs

# Monitor log
tail -f ~/isp-audit/logs/monitor.log

# Web server log
tail -f ~/isp-audit/logs/webserver_stdout.log

Check Database

sqlite3 ~/isp-audit/data/isp_evidence.db \
  "SELECT 'speedtests:', COUNT(*) FROM speedtests UNION ALL \
   SELECT 'tbb_tests:', COUNT(*) FROM tbb_tests UNION ALL \
   SELECT 'wan_samples:', COUNT(*) FROM wan_samples"

Web Dashboard

URLs

URL Description
https://isp.charliehub.net Main dashboard
https://isp.charliehub.net/report/discrepancy Systemic Breach Audit
https://isp.charliehub.net/api/status JSON status
https://isp.charliehub.net/api/breaches Breach events JSON

Features

  • Real-time speedtest trigger
  • Breach event tracking
  • CSV export
  • PDF audit report generation
  • Peak-hour performance charts

Manual Speedtest

ssh charles@192.168.100.164 "speedtest --accept-license --accept-gdpr --server-id=54746"

Policy Routing

To ensure WiFi responses go back via WiFi (for management access):

# Applied automatically via /etc/networkd-dispatcher/routable.d/50-wifi-policy-route
ip rule add from 10.44.1.14 table 100
ip route add default via 10.44.1.1 dev wlp2s0 table 100
ip route add 10.44.1.0/24 dev wlp2s0 table 100

Ofcom Relevance

This monitoring system is designed to collect evidence aligned with Ofcom's approach to broadband speed complaints:

Key Advantages of Direct Connection

  1. Bypasses UniFi - Eliminates internal network as a variable
  2. Direct to ISP router - Clean measurements of ISP-delivered speeds
  3. Dual-test methodology - Ookla (diagnostic) vs TBB (application-layer)
  4. Discrepancy detection - Identifies traffic prioritization

Evidence Requirements

  1. Sustained under-performance - Not one-off issues, but persistent patterns
  2. Peak hour focus - 19:00-23:00 is when congestion manifests
  3. 5th percentile - Shows worst-case, not just averages
  4. Multiple consecutive days - Strengthens the case
  5. WAN-side only - Excludes internal network issues

Migration History

Date Change
2026-01-12 Initial deployment on CT1118
2026-02-08 Migrated to Linux Mint (direct Technicolor connection)

Why Migration?

  • Removes UniFi bottleneck excuse - Mint connects directly to Technicolor
  • Direct-to-ISP evidence - Fulfills Trooli's Diagnostic Requirement #52
  • Cleaner WAN metrics - Uses local interface stats instead of UniFi API

Legacy Container

CT1118 (10.44.1.118) has been stopped and disabled. Database was migrated to Mint preserving all historical data from 2026-01-24 onwards.