From e12f6bad65cfb22b57288d633881ebd60745927c Mon Sep 17 00:00:00 2001 From: Bruno Mercier Costa <94469565+emrcbrn@users.noreply.github.com> Date: Mon, 17 Aug 2026 10:35:21 +0200 Subject: [PATCH] docs: add Quantum Resistance check to client status and make its fields navigable (#921) * docs: add Quantum Resistance check to client status and make its fields navigable Two related updates to the NetBird client status troubleshooting section, prompted by an incident where a peer stayed invisible until Quantum Resistance was turned off: - Document the `Quantum resistance` status field as a cause and fix. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch can keep a peer from connecting. Cross-link the Quantum-Resistance doc and its permissive mode. - Convert the flat peer-field list into per-field h3 subsections (Connection type, Direct, ICE candidate, Last WireGuard handshake, Quantum resistance, Transfer status) so each appears in the On this page nav. Co-Authored-By: Claude Opus 4.8 * docs: tighten status field descriptions per review - ICE candidate: describe relay/host as the local and remote ICE candidate types, and point to Connection type for whether the path is P2P or relayed, since a host candidate does not by itself mean the remote path is direct. - Last WireGuard handshake: distinguish an empty value (no handshake yet) from an old timestamp (a previous connection that is now stale). - Quantum resistance: call Rosenpass post-quantum key exchange rather than encryption. Co-Authored-By: Claude Opus 4.8 --------- Co-authored-by: Claude Opus 4.8 --- src/pages/help/troubleshooting-client.mdx | 37 +++++++++++++++-------- 1 file changed, 24 insertions(+), 13 deletions(-) diff --git a/src/pages/help/troubleshooting-client.mdx b/src/pages/help/troubleshooting-client.mdx index c73165b0..6def2fe4 100644 --- a/src/pages/help/troubleshooting-client.mdx +++ b/src/pages/help/troubleshooting-client.mdx @@ -144,20 +144,31 @@ As you can see, the output shows the peers connected, the NetBird IP address, th the connection type. The status will also report if there is an issue connecting to the relay servers, the management server, or the signal server. -As for Peers, the status will show the following information: +As for peers, the status reports the following fields: -* `Connection type`: P2P, Relayed, where relayed connections indicate a limitation in the network that prevents a direct - connection between the peers. To diagnose and fix a relayed connection, see - [Troubleshooting relayed connections](/help/troubleshooting-relayed-connections). -* `Direct`: true/false, where true indicates a direct connection between the peers without a local proxy. This case is - common when the local peer is allocating the relay connection. -* `ICE candidate (Local/Remote)`: relay/host, where relay indicates that the local peer is using a relay connection and - host indicates that the remote peer is using a direct connection. -* `Last Wireguard handshake`: Indicating the last time the Wireguard handshake was performed. Usually, this is performed - every 2 minutes, and if you don\'t see an update here or if the value is empty, that indicates that the connection - wasn\'t possible yet. -* `Transfer status (received/sent)`: Indicating the amount of data received and sent by the peer. This is useful to - check if the connection is being used. +### Connection type + +`P2P` or `Relayed`. A relayed connection indicates a network limitation that prevents a direct connection between the peers. To diagnose and fix a relayed connection, see [Troubleshooting relayed connections](/help/troubleshooting-relayed-connections). + +### Direct + +`true` or `false`. `true` indicates a direct connection between the peers without a local proxy, which is common when the local peer is allocating the relay connection. + +### ICE candidate (Local/Remote) + +For example `relay/host`, where `relay` is the local ICE candidate type and `host` is the remote ICE candidate type. Use `Connection type` above to tell whether the selected path is direct (`P2P`) or `Relayed`. + +### Last WireGuard handshake + +The last time the WireGuard handshake completed, usually refreshed every 2 minutes on an active connection. An empty value means no handshake has completed yet. An old timestamp means the peer connected before but the handshake is stale, so check whether it is still current. + +### Quantum resistance + +`true` or `false`, whether post-quantum key exchange ([Rosenpass](/client/post-quantum-cryptography)) is active on the connection. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch, where the other side has it off, runs an older client, or is on mobile (unsupported), can keep a peer from connecting or showing up at all. If a peer is missing or stuck, match the setting on both sides, enable [permissive mode](/client/post-quantum-cryptography#enable-permissive-mode) so non-Rosenpass peers can still connect, or turn it off. + +### Transfer status (received/sent) + +The amount of data received and sent by the peer, useful to check whether the connection is being used. See more details about the status command [here](/get-started/cli#status).