net-test-v2 company-side network probe 2026-09-10 16:33:15 ===== 0. self check ===== script file : E:\xxcool\project\workbuddy.xpcool.com\net-test-v2.ps1 script has BOM : False (pure ASCII script -> BOM irrelevant) ===== 1. privileges (need admin to install a VPN driver) ===== running as Administrator : False local Administrators group members: 别名 Administrators 注释 管理员对计算机/域有不受限制的完全访问权 成员 ------------------------------------------------------------------------------- Administrator ybtdevxxl 命令成功完成。 note: if you can install software normally, you usually have admin ===== 2. host info ===== OS : Microsoft Windows 11 专业版 build 26200 RAM : 31.2 GB GPU : Sharing Monitor | drv 17.1.40.460 GPU : AMD Radeon 780M Graphics | drv 31.0.14003.38003 SCREEN : 1707x1067 primary=True SCREEN : 1920x1080 primary=False ===== 3. IPv6 capability (re-check) ===== IPv6 local : NONE -> company network is IPv4 only (IPv6 direct path is dead) ===== 4. TCP egress freedom (targets that REALLY listen) ===== TCP www.baidu.com:443 443 -> OPEN [domestic HTTPS - baseline] TCP www.qq.com:443 443 -> OPEN [domestic HTTPS - baseline] TCP www.aliyun.com:80 80 -> OPEN [domestic HTTP - baseline] TCP 193.112.118.168:80 80 -> OPEN [your own server :80] TCP 193.112.118.168:443 443 -> OPEN [your own server :443] TCP 193.112.118.168:22025 22025 -> OPEN [your own server :22025 (non-standard)] TCP portquiz.net:443 443 -> OPEN [portquiz :443 (all-port listener)] TCP portquiz.net:8080 8080 -> OPEN [portquiz :8080 (all-port listener)] TCP portquiz.net:8443 8443 -> OPEN [portquiz :8443 (all-port listener)] read: if baidu:443 is OPEN then 443 is NOT whitelisted-blocked. read: portquiz.net listens on EVERY port -> OPEN there proves arbitrary ports allowed. ===== 5. UDP egress + CORRECT NAT mapping test ===== --- round : fixed local UDP port 46001 --- stun.miwifi.com:3478 -> mapped 117.188.24.89:16993 stun.hitv.com:3478 -> mapped 117.188.24.89:16994 stun.qq.com:3478 -> TIMEOUT stun.l.google.com:19302 -> mapped 117.188.24.89:17011 stun.nextcloud.com:443 -> mapped 117.188.118.254:43681 => STUN replies received means UDP egress AND UDP return path work. --- round : fixed local UDP port 46002 --- stun.miwifi.com:3478 -> mapped 117.188.24.89:17013 stun.hitv.com:3478 -> mapped 117.188.24.89:17014 stun.qq.com:3478 -> TIMEOUT stun.l.google.com:19302 -> mapped 117.188.24.89:17041 stun.nextcloud.com:443 -> mapped 117.188.118.254:43705 => STUN replies received means UDP egress AND UDP return path work. --- NAT verdict --- local port 46001 -> public ip 117.188.118.254,117.188.24.89 mapped ports: 16993,16994,17011,43681 local port 46002 -> public ip 117.188.118.254,117.188.24.89 mapped ports: 17013,17014,17041,43705 NAT verdict : SYMMETRIC NAT (mapping changes per destination) -> hole punching unreliable, relay needed ===== 6. local proxy / tunnel clients already present ===== listening local TCP ports (common proxy ports): (if 7890/7897/7892 etc are LISTENING, a Clash-style proxy client is running) installed software matching VPN / proxy / remote-control / streaming keywords: Clash Verge ToDesk WireGuard 火绒安全软件 ===== 7. security / endpoint-management agents (may block drivers or audit traffic) ===== AMD Crash Defender Service | AMD Crash Defender Service | Running aTrustService | aTrustService | Stopped edr_monitor | edr_monitor | Stopped HipsDaemon | Huorong Internet Security Daemon | Running HRWSCCtrl | Huorong Windows Security Center | Running MDCoreSvc | Microsoft Defender Core 服务 | Stopped mpssvc | Windows Defender Firewall | Running savsvc | EDR Antivirus Service | Stopped Sense | Windows Defender Advanced Threat Protection Service | Stopped WdNisSvc | Microsoft Defender 防病毒网络检查服务 | Stopped WinDefend | Microsoft Defender 防病毒服务 | Stopped ===== 8. summary ===== IPv6 available : NO Admin rights : False NAT verdict : SYMMETRIC NAT (mapping changes per destination) -> hole punching unreliable, relay needed How to read the TCP section: * www.baidu.com:443 OPEN -> 443 egress is fine (v1 result was false) * portquiz.net:* OPEN -> arbitrary TCP ports allowed * everything TIMEOUT -> real port whitelist, relay over 443 only