How Global Edge Probes Detect Internet Outages in Under 200 Milliseconds
Inside the mechanics of distributed synthetic monitoring: DNS resolution trees, TCP handshakes, TLS protocol negotiation, and avoiding false positives.
- Why automated HTTP probes must measure timing at multiple handshake stages.
- How synthetic probes handle anti-bot challenges and CDN security shields.
- The difference between synthetic uptime checking and Real User Monitoring (RUM).
- Why false positives happen and how multi-region validation prevents them.
1. What Happens During an Instant Synthetic Probe
When you click "Check Status" on ItsUporDown, our backend does not simply send an unmeasured ping. It orchestrates a multi-phase synthetic probe that mirrors exactly what real web browsers experience during connection establishment.
The probe executes sequentially: Authoritative DNS lookup -> TCP socket connect -> TLS 1.3 cryptographic negotiation -> HTTP HEAD/GET request transmission -> First Byte Timing (TTFB) -> Response status validation.
2. The Resolution Breakdown
If a domain has an expired registration or invalid nameserver NS records, the probe immediately reports a DNS resolution failure (ENOTFOUND) without wasting time waiting for TCP timeouts.
Once an IP is resolved, our probe connects to port 443 (HTTPS) or port 80 (HTTP). If the server refuses the socket connection (ECONNREFUSED) or fails to complete the TLS handshake, our edge node accurately reports network unreachability.
3. Handling CDN WAFs and False Positives
Many high-traffic websites run behind Cloudflare, Akamai, or AWS CloudFront WAF rules that reject standard bot user-agents with a 403 Forbidden code.
ItsUporDown uses verified browser-conforming headers and follow-redirect mechanics to ensure that genuine operational websites behind web application firewalls are correctly recognized as operational rather than incorrectly marked as down.
Suspect an outage on a website right now?
Run an instant live probe from our global edge network in seconds.