QuickCheck Feature

<h3 style="margin-top:0">Proxy QuickCheck — Squid network diagnostics</h3>

<p>QuickCheck periodically runs, from the Squid server, a series
of HTTP/HTTPS probes against sentinel domains to detect
latency, upstream outages, or TLS degradation <em>before</em>
users report issues. Results are stored in
SQLite (<span style="font-family:monospace">/home/artica/SQLITE/proxy-quickcheck.db</span>)
with a 15-day retention.</p>

<h4>Three probe paths</h4>
<ul>
  <li><span style="color:#cc00cc;font-weight:bold">LOCAL</span> &mdash;
      goes through the local Squid instance
      (<span style="font-family:monospace">http://127.0.0.1:PORT</span>).</li>
  <li><span style="color:#3366cc;font-weight:bold">PARENT</span> &mdash;
      goes through the configured parent proxy
      (<span style="font-family:monospace">http://PARENT:3128</span>).</li>
  <li><span style="color:#00bcd4;font-weight:bold">DIRECT</span> &mdash;
      no proxy, direct access from the server.</li>
</ul>
<p>Comparing these three paths isolates the faulty layer: if LOCAL is
slow and DIRECT is fast, the local proxy is the issue. If both are
slow, the problem is network-related.</p>

<h4>Five measured phases (<span style="font-family:monospace">curl -w</span> semantics)</h4>
<table style="border-collapse:collapse">
  <tr><td style="padding:2px 8px"><b>DNS</b></td>  <td>name resolution &mdash; orange/red: slow DNS server or cold cache</td></tr>
  <tr><td style="padding:2px 8px"><b>TCP</b></td>  <td>TCP handshake &mdash; orange/red: WAN, firewall, MTU, congestion</td></tr>
  <tr><td style="padding:2px 8px"><b>TLS</b></td>  <td>TLS handshake &mdash; orange/red: SSL inspection, crypto CPU, incomplete CA chain</td></tr>
  <tr><td style="padding:2px 8px"><b>TTFB</b></td> <td>time to first byte &mdash; orange/red: ACLs, authentication, cache miss, slow backend</td></tr>
  <tr><td style="padding:2px 8px"><b>TOTAL</b></td><td>full request duration</td></tr>
</table>
<p style="font-size:0.95em">All values are <em>cumulative from the start
of the request</em>: <span style="font-family:monospace">DNS &le; TCP &le; TLS &le; TTFB &le; TOTAL</span>.</p>

<h4>Jitter</h4>
<p>Three quick total-time measurements are performed per path;
jitter is computed as <span style="font-family:monospace">max &minus; min</span>.
A high value indicates unstable latency (queueing, packet loss,
MTU issues, fluctuating DNS) &mdash; a site may have an acceptable
TOTAL but critical jitter, resulting in erratic page loads
for users.</p>

<h4>Probe verdict</h4>
<ul style="list-style:none;padding-left:0">
  <li><span style="background:#28a745;color:#fff;padding:2px 8px;border-radius:3px">OK</span>
      &mdash; all comparable paths are below the <em>warn</em> threshold.</li>
  <li><span style="background:#fd7e14;color:#fff;padding:2px 8px;border-radius:3px">WARN</span>
      &mdash; latency on two paths, or only the local proxy is suspect.</li>
  <li><span style="background:#dc3545;color:#fff;padding:2px 8px;border-radius:3px">CRIT</span>
      &mdash; critical latency on two comparable paths (network incident).</li>
  <li><span style="background:#7f1d1d;color:#fff;padding:2px 8px;border-radius:3px">UPSTREAM_FAIL</span>
      &mdash; at least one path returned HTTP code 0 or 5xx;
      latency metrics are <em>not</em> reliable in this case — check the
      associated Curl/TLS error.</li>
</ul>

<h4>Mode <span style="font-family:monospace">insecure (-k)</span></h4>
<p>For domains listed in <span style="font-family:monospace">insecure_domains</span>
(non-compliant PKI, self-signed CA), certificate validation is
skipped to obtain usable network measurements. A badge
<span style="background:#fd7e14;color:#fff;padding:1px 4px;border-radius:2px">(-k)</span>
is displayed: <strong>latency remains valid, but real TLS errors
will not be detected for these domains</strong>.</p>

<h4>System snapshot (per run)</h4>
<p>Each execution captures the system state (load1, RAM, swap,
ESTABLISHED/TIME_WAIT sockets) at test time, read directly from
<span style="font-family:monospace">/proc/loadavg</span>,
<span style="font-family:monospace">/proc/meminfo</span> and
<span style="font-family:monospace">/proc/net/tcp{,6}</span>.
This allows correlation between latency and CPU saturation or
unusually high socket counts.</p>

<h4>Limitation for HTTPS via proxy</h4>
<p>When the target is <span style="font-family:monospace">https://</span> and
traffic goes through LOCAL or PARENT, the <b>DNS</b> and <b>TCP</b>
phases measure resolution and connection to the <em>proxy</em>,
not the final destination (same limitation as
<span style="font-family:monospace">curl -x</span>).
To compare LOCAL/PARENT/DIRECT, rely only on <b>TOTAL</b>;
other phases must be interpreted <em>per path</em>.</p>