﻿net-test-v2  company-side network probe   2026-09-10 16:33:15

===== 0. self check =====
script file    : E:\xxcool\project\workbuddy.xpcool.com\net-test-v2.ps1
script has BOM : False  (pure ASCII script -> BOM irrelevant)

===== 1. privileges (need admin to install a VPN driver) =====
running as Administrator : False
local Administrators group members:
   别名     Administrators
   注释     管理员对计算机/域有不受限制的完全访问权
   成员
   -------------------------------------------------------------------------------
   Administrator
   ybtdevxxl
   命令成功完成。
note: if you can install software normally, you usually have admin

===== 2. host info =====
OS      : Microsoft Windows 11 专业版  build 26200
RAM     : 31.2 GB
GPU     : Sharing Monitor  |  drv 17.1.40.460
GPU     : AMD Radeon 780M Graphics  |  drv 31.0.14003.38003
SCREEN  : 1707x1067  primary=True
SCREEN  : 1920x1080  primary=False

===== 3. IPv6 capability (re-check) =====
IPv6 local : NONE  -> company network is IPv4 only (IPv6 direct path is dead)

===== 4. TCP egress freedom (targets that REALLY listen) =====
TCP www.baidu.com:443      443    -> OPEN   [domestic HTTPS - baseline]
TCP www.qq.com:443         443    -> OPEN   [domestic HTTPS - baseline]
TCP www.aliyun.com:80      80     -> OPEN   [domestic HTTP - baseline]
TCP 193.112.118.168:80     80     -> OPEN   [your own server :80]
TCP 193.112.118.168:443    443    -> OPEN   [your own server :443]
TCP 193.112.118.168:22025  22025  -> OPEN   [your own server :22025 (non-standard)]
TCP portquiz.net:443       443    -> OPEN   [portquiz :443 (all-port listener)]
TCP portquiz.net:8080      8080   -> OPEN   [portquiz :8080 (all-port listener)]
TCP portquiz.net:8443      8443   -> OPEN   [portquiz :8443 (all-port listener)]
read: if baidu:443 is OPEN then 443 is NOT whitelisted-blocked.
read: portquiz.net listens on EVERY port -> OPEN there proves arbitrary ports allowed.

===== 5. UDP egress + CORRECT NAT mapping test =====
--- round : fixed local UDP port 46001 ---
   stun.miwifi.com:3478     -> mapped 117.188.24.89:16993
   stun.hitv.com:3478       -> mapped 117.188.24.89:16994
   stun.qq.com:3478         -> TIMEOUT
   stun.l.google.com:19302  -> mapped 117.188.24.89:17011
   stun.nextcloud.com:443   -> mapped 117.188.118.254:43681
   => STUN replies received means UDP egress AND UDP return path work.
--- round : fixed local UDP port 46002 ---
   stun.miwifi.com:3478     -> mapped 117.188.24.89:17013
   stun.hitv.com:3478       -> mapped 117.188.24.89:17014
   stun.qq.com:3478         -> TIMEOUT
   stun.l.google.com:19302  -> mapped 117.188.24.89:17041
   stun.nextcloud.com:443   -> mapped 117.188.118.254:43705
   => STUN replies received means UDP egress AND UDP return path work.

--- NAT verdict ---
local port 46001 -> public ip 117.188.118.254,117.188.24.89  mapped ports: 16993,16994,17011,43681
local port 46002 -> public ip 117.188.118.254,117.188.24.89  mapped ports: 17013,17014,17041,43705
NAT verdict : SYMMETRIC NAT (mapping changes per destination) -> hole punching unreliable, relay needed

===== 6. local proxy / tunnel clients already present =====
listening local TCP ports (common proxy ports):
(if 7890/7897/7892 etc are LISTENING, a Clash-style proxy client is running)

installed software matching VPN / proxy / remote-control / streaming keywords:
   Clash Verge
   ToDesk
   WireGuard
   火绒安全软件

===== 7. security / endpoint-management agents (may block drivers or audit traffic) =====
   AMD Crash Defender Service | AMD Crash Defender Service | Running
   aTrustService | aTrustService | Stopped
   edr_monitor | edr_monitor | Stopped
   HipsDaemon | Huorong Internet Security Daemon | Running
   HRWSCCtrl | Huorong Windows Security Center | Running
   MDCoreSvc | Microsoft Defender Core 服务 | Stopped
   mpssvc | Windows Defender Firewall | Running
   savsvc | EDR Antivirus Service | Stopped
   Sense | Windows Defender Advanced Threat Protection Service | Stopped
   WdNisSvc | Microsoft Defender 防病毒网络检查服务 | Stopped
   WinDefend | Microsoft Defender 防病毒服务 | Stopped

===== 8. summary =====

IPv6 available        : NO
Admin rights          : False
NAT verdict           : SYMMETRIC NAT (mapping changes per destination) -> hole punching unreliable, relay needed

How to read the TCP section:
  * www.baidu.com:443 OPEN        -> 443 egress is fine (v1 result was false)
  * portquiz.net:* OPEN           -> arbitrary TCP ports allowed
  * everything TIMEOUT            -> real port whitelist, relay over 443 only

