From ab9d349639be5771e7fb0d508f1a61ca2984872b Mon Sep 17 00:00:00 2001 From: emrcbrn Date: Thu, 13 Aug 2026 11:54:38 +0200 Subject: [PATCH 1/2] docs: add Quantum Resistance check to client status and make its fields navigable Two related updates to the NetBird client status troubleshooting section, prompted by an incident where a peer stayed invisible until Quantum Resistance was turned off: - Document the `Quantum resistance` status field as a cause and fix. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch can keep a peer from connecting. Cross-link the Quantum-Resistance doc and its permissive mode. - Convert the flat peer-field list into per-field h3 subsections (Connection type, Direct, ICE candidate, Last WireGuard handshake, Quantum resistance, Transfer status) so each appears in the On this page nav. Co-Authored-By: Claude Opus 4.8 --- src/pages/help/troubleshooting-client.mdx | 39 +++++++++++++++-------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/src/pages/help/troubleshooting-client.mdx b/src/pages/help/troubleshooting-client.mdx index c73165b0..3d0d25be 100644 --- a/src/pages/help/troubleshooting-client.mdx +++ b/src/pages/help/troubleshooting-client.mdx @@ -144,20 +144,31 @@ As you can see, the output shows the peers connected, the NetBird IP address, th the connection type. The status will also report if there is an issue connecting to the relay servers, the management server, or the signal server. -As for Peers, the status will show the following information: - -* `Connection type`: P2P, Relayed, where relayed connections indicate a limitation in the network that prevents a direct - connection between the peers. To diagnose and fix a relayed connection, see - [Troubleshooting relayed connections](/help/troubleshooting-relayed-connections). -* `Direct`: true/false, where true indicates a direct connection between the peers without a local proxy. This case is - common when the local peer is allocating the relay connection. -* `ICE candidate (Local/Remote)`: relay/host, where relay indicates that the local peer is using a relay connection and - host indicates that the remote peer is using a direct connection. -* `Last Wireguard handshake`: Indicating the last time the Wireguard handshake was performed. Usually, this is performed - every 2 minutes, and if you don\'t see an update here or if the value is empty, that indicates that the connection - wasn\'t possible yet. -* `Transfer status (received/sent)`: Indicating the amount of data received and sent by the peer. This is useful to - check if the connection is being used. +As for peers, the status reports the following fields: + +### Connection type + +`P2P` or `Relayed`. A relayed connection indicates a network limitation that prevents a direct connection between the peers. To diagnose and fix a relayed connection, see [Troubleshooting relayed connections](/help/troubleshooting-relayed-connections). + +### Direct + +`true` or `false`. `true` indicates a direct connection between the peers without a local proxy, which is common when the local peer is allocating the relay connection. + +### ICE candidate (Local/Remote) + +For example `relay/host`, where `relay` indicates the local peer is using a relay connection and `host` indicates the remote peer is using a direct connection. + +### Last WireGuard handshake + +The last time the WireGuard handshake was performed, usually every 2 minutes. If you do not see an update here, or the value is empty, the connection was not possible yet. + +### Quantum resistance + +`true` or `false`, whether post-quantum encryption ([Rosenpass](/client/post-quantum-cryptography)) is active on the connection. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch, where the other side has it off, runs an older client, or is on mobile (unsupported), can keep a peer from connecting or showing up at all. If a peer is missing or stuck, match the setting on both sides, enable [permissive mode](/client/post-quantum-cryptography#enable-permissive-mode) so non-Rosenpass peers can still connect, or turn it off. + +### Transfer status (received/sent) + +The amount of data received and sent by the peer, useful to check whether the connection is being used. See more details about the status command [here](/get-started/cli#status). From 21d5476011e3084997e6e2c2161d8f135a174ff8 Mon Sep 17 00:00:00 2001 From: emrcbrn Date: Thu, 13 Aug 2026 12:25:05 +0200 Subject: [PATCH 2/2] docs: tighten status field descriptions per review - ICE candidate: describe relay/host as the local and remote ICE candidate types, and point to Connection type for whether the path is P2P or relayed, since a host candidate does not by itself mean the remote path is direct. - Last WireGuard handshake: distinguish an empty value (no handshake yet) from an old timestamp (a previous connection that is now stale). - Quantum resistance: call Rosenpass post-quantum key exchange rather than encryption. Co-Authored-By: Claude Opus 4.8 --- src/pages/help/troubleshooting-client.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/pages/help/troubleshooting-client.mdx b/src/pages/help/troubleshooting-client.mdx index 3d0d25be..6def2fe4 100644 --- a/src/pages/help/troubleshooting-client.mdx +++ b/src/pages/help/troubleshooting-client.mdx @@ -156,15 +156,15 @@ As for peers, the status reports the following fields: ### ICE candidate (Local/Remote) -For example `relay/host`, where `relay` indicates the local peer is using a relay connection and `host` indicates the remote peer is using a direct connection. +For example `relay/host`, where `relay` is the local ICE candidate type and `host` is the remote ICE candidate type. Use `Connection type` above to tell whether the selected path is direct (`P2P`) or `Relayed`. ### Last WireGuard handshake -The last time the WireGuard handshake was performed, usually every 2 minutes. If you do not see an update here, or the value is empty, the connection was not possible yet. +The last time the WireGuard handshake completed, usually refreshed every 2 minutes on an active connection. An empty value means no handshake has completed yet. An old timestamp means the peer connected before but the handshake is stale, so check whether it is still current. ### Quantum resistance -`true` or `false`, whether post-quantum encryption ([Rosenpass](/client/post-quantum-cryptography)) is active on the connection. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch, where the other side has it off, runs an older client, or is on mobile (unsupported), can keep a peer from connecting or showing up at all. If a peer is missing or stuck, match the setting on both sides, enable [permissive mode](/client/post-quantum-cryptography#enable-permissive-mode) so non-Rosenpass peers can still connect, or turn it off. +`true` or `false`, whether post-quantum key exchange ([Rosenpass](/client/post-quantum-cryptography)) is active on the connection. A peer with Quantum Resistance enabled only connects to peers that also have it enabled, so a mismatch, where the other side has it off, runs an older client, or is on mobile (unsupported), can keep a peer from connecting or showing up at all. If a peer is missing or stuck, match the setting on both sides, enable [permissive mode](/client/post-quantum-cryptography#enable-permissive-mode) so non-Rosenpass peers can still connect, or turn it off. ### Transfer status (received/sent)