Why you saw a probe from us

If you are a network operator who noticed unexplained ICMP or UDP traffic and traced it here, this page tells you exactly what it was — and how to make it stop.

Who we are

SquidGrid measures how internet paths actually behave. We run a fleet of small measurement probes on several continents and continuously record latency, packet loss, and the sequence of routers a packet crosses. The purpose is to tell a customer whether a slowdown is inside their own network or somewhere out on the path — and to name the network it is on rather than leaving them guessing.

Every SquidGrid probe is software: a container running on a server. SquidGrid is a software service and makes no equipment of any kind.

Exactly what we send

These are the values compiled into the probe that is running right now, not estimates.

Measurement	What is sent	Rate
Reachability and latency	3 ICMP echo requests, 2 second timeout	Once every 15 seconds per destination
Path discovery	UDP datagrams with increasing TTL, base destination port `33435`, maximum TTL 30, across 3 flows	Once every 5 minutes per destination

A traceroute stops as soon as the destination answers, so a typical run is around fifteen hops rather than thirty. In steady state a single destination receives roughly twelve small packets per minute from any one probe.

What we never do

We do not scan ports, and we do not sweep address ranges looking for hosts.
We do not open connections to services, attempt authentication, or send application-layer traffic of any kind.
We do not inspect, capture, or store anyone's traffic. We measure our own packets and the ICMP responses they provoke.
We do not attempt to evade filtering. If you drop our packets, they stay dropped — that is a legitimate answer and we record it as one.

Identifying our traffic

Our probes send from hosting providers rather than from address space we announce ourselves, so a WHOIS lookup on the source address will name the hosting company, not us. The signature to look for is the combination above: three ICMP echoes at a fifteen-second cadence, and periodic low-TTL UDP toward ports at and above 33435.

If you would like the specific addresses currently in our fleet in order to match them against your logs, ask and we will send the list.

To be excluded

Email [email protected] with the prefixes or AS number you want removed. No justification is required and we will not ask for one. We will confirm in writing once the exclusion is in place, and it is permanent unless you tell us otherwise.

Customer-installed probes

Some probes are installed by our customers inside their own networks. Those measure only the destinations that customer configures. We never add our own measurements to a customer's probe, and we do not measure a customer's internal network. If the traffic you are seeing originates inside an organisation you work with, that organisation chose its destinations, not us.

Security reports

If you have found a vulnerability in our probe or our service, please write to [email protected]. The probe image is public at squidgrid/probe on Docker Hub and we welcome people taking it apart.