net-benchmark dns benchmark --use-defaults
net-benchmark dns benchmark --use-defaults --doh
net-benchmark dns benchmark --use-defaults --dot --dnssec-validate
net-benchmark dns compare Cloudflare Google Quad9 --dnssec-validate
net-benchmark dns monitoring --use-defaults --interval 30

full documentation: DNS Benchmark guide

net-benchmark http benchmark --use-defaults
net-benchmark http benchmark --use-defaults --iterations 5
net-benchmark http benchmark --targets "https://api.example.com" --method POST --body '{}'
net-benchmark http compare api.example.com api2.example.com --iterations 3
net-benchmark http top --use-defaults --limit 5
net-benchmark http monitoring --use-defaults --interval 30

full documentation: HTTP Benchmark guide

net-benchmark http load-test -t https://api.example.com/health --mode throughput --duration 30
net-benchmark http load-test -t https://api.example.com --mode sustained --rps 150 --duration 300
net-benchmark http load-test -t https://api.example.com --mode ramp-up --ramp-concurrency 500
net-benchmark http load-test -t https://api.example.com --threshold 'p95_latency<500' --threshold 'dropped_rate<1'
net-benchmark http load-test -t https://api.example.com --workers 4 --emit-summary node-a.json
net-benchmark http merge-load-test ./nodes/*.json -o ./merged

since 0.5.2, load can be generated from several parallel workers — separate processes on one machine, or separate machines entirely — with a synchronised start and a statistically correct merge. merge-load-test recomputes p95_latency and p99_latency from the merged latency histogram rather than averaging per-worker percentiles; std_latency, jitter, consistency_score and the phase p95s do not survive a merge and are rejected as unknown metrics, so evaluate those per worker.

full documentation: http load testing

# certificate expiry, weak keys/signatures, deprecated TLS, all flagged by default
net-benchmark ssl check --targets "example.com,api.example.com"

# CI gate: fail the build on an expiring certificate
net-benchmark ssl check --targets ./targets.txt --threshold 'cert_expiry_days>30'

# mail server STARTTLS on a non-standard port
net-benchmark ssl check --targets mail.example.com:2525 --starttls smtp

Chain-of-trust and revocation reporting need Python 3.13+ (SSLObject.get_unverified_chain()); on 3.11/3.12 the leaf certificate is still fully checked. Full documentation: SSL Check guide