Interface flapping detection

Alongside monitoring remote hosts, ProbeScope independently tracks the up/down state of the local network interface it's running on — the link itself, not just what's reachable through it.

What's monitored

• --interface en0 — pins ProbeScope to a specific interface for both pinging and interface state monitoring. Fails at startup if the interface isn't active.
• No --interface given — the default-route interface is auto-detected at startup (a UDP dial to a public address, then a reverse lookup of the source IP across local interfaces) and monitored the same way, purely for display/logging; pings are not pinned to it.

An interface qualifies as "active" when the operating system reports it as up, it's not the loopback interface, and it has at least one assigned IP address — checked both at startup and on every polling tick.

Polling and display

The interface's state is polled once per second, independent of any host's ping schedule. In the TUI title bar and the web console, it shows as a badge:

• en0 [up] — white text on green.
• en0 [dn] — white text on yellow (a warning to check local network config, not treated as a fleet-wide failure).

close

close

For an interface pinned explicitly via --interface, a genuine interface drop also surfaces through ping results themselves — pings on the stale source IP start producing errors, so affected hosts correctly show as down too, not just the badge.

Why this matters for triage

Without interface-level awareness, twelve hosts failing at once looks like twelve separate incidents. With it, the same event is immediately visible as one cause: your own network link, not the remote fleet. This is also exposed to the plugin engine (ctx.interface), so a rule can distinguish "my network dropped" from "the remote hosts are actually down" and avoid firing twelve redundant alerts for one root cause — see the plugins topic for the interface_correlation.star pattern this enables.

Persistent history

Every interface up/down transition — start time, end time, duration — is recorded the same way host periods are, when --db is enabled: see the history topic for schema and retention.