# How to prove intermittent internet drops to your ISP

> A dropout that has ended is not evidence. Collect a timestamped series on your phone, and send the six things a support desk can check against its logs.

Source: https://apps.swtlm.com/blog/prove-internet-drops-to-your-isp · TLM Apps — focused mobile apps from a team of engineers.
Published: 2026-09-10 · Updated: 2026-09-10 · TLM Software Design

Evidence of an intermittent drop is a timestamped series of checks from one
fixed point, repeated over several days. One page that failed to load is not
evidence; twenty checks an hour apart, three of them at 100% packet loss, are.
A phone can produce that series — one saved address, one interval, and a
history that keeps every check with its time. The report you send then names
times, targets and loss instead of the word "sometimes".

## What counts as evidence once the line is working again

A support desk can act on a measurement it can compare against something.
Their equipment writes timestamped logs, so a report naming 21:40 on three
consecutive evenings can be looked up. "It keeps dropping in the evenings"
cannot be looked up at all, and that is why it comes back as a suggestion to
restart the router.

Four properties make a series worth sending.

**It is timed.** Every check carries a date and a clock time, and you say which
timezone that clock is in.

**It is numeric.** "Slow" and "keeps dropping" describe how it felt. "Five of
five packets lost at 22:15, again at 22:31" describes an event, and the
difference between those two sentences is the whole of this article.

**It repeats.** One bad half-hour has too many explanations that are nobody's
fault. The same failure at similar times across three or four days is a
pattern.

**It separates your equipment from theirs.** A measurement that fails past your
router while your router itself answers cleanly is the one that points outward.
On its own, a failing measurement points at everything between the phone and
the target, which includes your own Wi-Fi.

## Which two addresses to measure

Measure your own router and one address beyond it, in the same window. That
pairing turns "the internet is broken" into a statement about a specific
stretch of the path. It is the same split the diagnostic order in
[is it my Wi-Fi or the internet](https://apps.swtlm.com/blog/is-it-my-wifi-or-the-internet) uses,
and that article is the one for a fault happening in front of you right now.

Your router's address is usually `192.168.0.1` or `192.168.1.1`, and your
phone's Wi-Fi settings show it as the router or gateway. Traffic to it never
leaves the building, so loss there is yours to fix and says nothing about your
provider.

For the address beyond it, pick one that answers pings deliberately rather than
a website. `1.1.1.1` is a resolver that responds to ICMP by design, so a
timeout against it is a real timeout rather than a policy.

Ping runs over ICMP, and a great many servers, firewalls and home routers drop
or deprioritise ICMP on purpose. A timeout can therefore mean the path is
broken or mean the target ignores pings, and nothing in the result distinguishes
the two. Two things narrow it: choosing a target that answers ICMP by design,
and reading the router leg beside the external one. Where ICMP is blocked
outright, [Ping Network Tool](https://apps.swtlm.com/ping-network-tool) times a real TCP connection to
port 443 or 80 instead, so the round trip is still measured rather than
estimated.

## How to collect the series from a phone

Run one ping against the target, then save it and let the app repeat that check
on a schedule. In [Ping Network Tool](https://apps.swtlm.com/ping-network-tool) the flow is: ping the
address once, add it to Monitoring from the sidebar, and set a check interval —
1, 15 or 60 minutes, or a custom value up to 24 hours. Each check pings
the host with up to five packets and writes the result to the History tab as a
saved session, with the resolved IP, the time, the min/average/max round-trip
time and the loss percentage.

The free tier monitors one host, and the one-time unlock lifts that cap. With
one slot, monitor the external address on a schedule and ping your router by
hand whenever you notice a drop — both land in the same history, timestamped
the same way.

The checks run only while the app itself is running, and that decides how you
run this. There is no OS-scheduled background task, and no notification when a
host drops or comes back. Leave the phone on a charger with the app open across the hours the fault
happens. A gap in the series is a gap in the recording, not a quiet period on
the line.

## What to send

Send the numbers as text where you can. The History tab in
[Ping Network Tool](https://apps.swtlm.com/ping-network-tool) keeps every saved session on the device
and has no export button. In practice that means attaching a screenshot of the
list and a screenshot of the failing session. The live ping output on the Ping
tab does have a copy button, so copy it while a drop is actually happening.

What to do with the evidence afterwards — the complaint procedure, any
recalculation of a monthly bill — depends on your country and your contract,
and this article does not cover it. The measurement is the part that is the
same everywhere.

## What this does not prove

**It does not isolate the fault to your provider.** It shows that something
past your router failed while your router answered. The break could be in the
line to the building, in their equipment, or further out in a network they buy
from.

**It does not separate Wi-Fi from the connection on its own.** Your phone's
radio is part of every measurement it takes, which is exactly why the router
leg is in the checklist above.

**It does not describe throughput.** Ping measures round-trip time and loss,
not how fast a file downloads. A line can hold a healthy ping and still deliver
a fraction of the speed you pay for; that is a different measurement, and
[what ping, jitter and packet loss mean](https://apps.swtlm.com/blog/what-ping-jitter-and-packet-loss-mean)
sets out which number answers which question.

**It does not run unattended.** Nothing in this app schedules checks at the
operating-system level today, on either platform, so the series is only as
continuous as the app's own uptime.

## Why we can be specific about the limits

We wrote the monitoring loop, so the description above is what the code does
rather than what the feature sounds like. Each check is a real ICMP ping over
an unprivileged datagram socket — no root, no special permission — falling back
to a timed TCP connection where ICMP is blocked. The result is stored in the
app's own local database. Nothing is uploaded: the app has no backend,
and its analytics deliberately never record the host you typed or the IP it
resolved to.

[Ping Network Tool](https://apps.swtlm.com/ping-network-tool) has no ads at all. Ping, traceroute,
history and one monitored host are free; a one-time $1.99 unlock adds TCP ping,
lifts the monitoring cap and stops the periodic upgrade sheet. There is no
subscription, and the reasoning behind charging once rather than monthly is in
[what a puzzle game subscription costs](https://apps.swtlm.com/blog/what-a-puzzle-game-subscription-costs).
The rest of our utilities are on the [Tools page](https://apps.swtlm.com/tools).

## Frequently asked questions

**How long should I collect measurements before reporting?**

Long enough to cover the fault more than once. A single bad evening has too many innocent explanations; the same failure at similar times across three or four days is a pattern that can be looked up against equipment logs.

**What interval should I check at?**

One minute while you are watching the screen, fifteen for a long run. A one-minute interval catches short dropouts but produces hundreds of entries a day; fifteen minutes catches anything lasting a quarter of an hour and keeps the list readable.

**Does a failed ping prove the connection was down?**

Not on its own. Many hosts and firewalls drop ICMP by design, so a timeout can mean the target ignores pings. That is why you measure an address that answers ICMP deliberately, and why you check your own router in the same window.

**Can I collect this evidence with the phone in my pocket?**

Not reliably. Ping Network Tool runs its checks while the app itself is running, so the series stops when the system suspends or closes it. Leave the phone on a charger with the app open for the hours the fault happens.

**Is a phone measurement worth anything if the problem is on a cable?**

It is worth less than the same measurement on a wired device, because your Wi-Fi is part of what you measured. Pinging your own router in the same window is what separates the two: a clean router leg with a failing leg beyond it points past your equipment.