net-benchmark dns benchmark --use-defaults
net-benchmark dns benchmark --use-defaults --doh
net-benchmark dns benchmark --use-defaults --dot --dnssec-validate
net-benchmark dns compare Cloudflare Google Quad9 --dnssec-validate
net-benchmark dns monitoring --use-defaults --interval 30

full documentation: DNS Benchmark guide

net-benchmark http benchmark --use-defaults
net-benchmark http benchmark --use-defaults --iterations 5
net-benchmark http benchmark --targets "https://api.example.com" --method POST --body '{}'
net-benchmark http compare api.example.com api2.example.com --iterations 3
net-benchmark http top --use-defaults --limit 5
net-benchmark http monitoring --use-defaults --interval 30

full documentation: HTTP Benchmark guide

net-benchmark http load-test -t https://api.example.com/health --mode throughput --duration 30
net-benchmark http load-test -t https://api.example.com --mode sustained --rps 150 --duration 300
net-benchmark http load-test -t https://api.example.com --mode ramp-up --ramp-concurrency 500
net-benchmark http load-test -t https://api.example.com --threshold 'p95_latency<500' --threshold 'dropped_rate<1'
net-benchmark http load-test -t https://api.example.com --workers 4 --emit-summary node-a.json
net-benchmark http merge-load-test ./nodes/*.json -o ./merged

since 0.5.2, load can be generated from several parallel workers — separate processes on one machine, or separate machines entirely — with a synchronised start and a statistically correct merge. merge-load-test recomputes p95_latency and p99_latency from the merged latency histogram rather than averaging per-worker percentiles; std_latency, jitter, consistency_score and the phase p95s do not survive a merge and are rejected as unknown metrics, so evaluate those per worker.

full documentation: http load testing

# certificate expiry, weak keys/signatures, deprecated TLS, all flagged by default
net-benchmark ssl check --targets "example.com,api.example.com"

# chain of trust, revocation, protocol/cipher enumeration, CT transparency, grading
net-benchmark ssl check --targets example.com \
  --verify-chain --check-revocation --enumerate-protocol --grade

# CI gate: fail the build on an expiring certificate
net-benchmark ssl check --targets ./targets.txt --threshold 'cert_expiry_days>30'

# mail server STARTTLS on a non-standard port
net-benchmark ssl check --targets mail.example.com:2525 --starttls smtp

Opt-in checks add: chain-of-trust validation and OCSP/CRL revocation, protocol/cipher enumeration, Certificate Transparency, CA/Browser Forum linting (pip install net-benchmark[lint]), deep handshake introspection including post-quantum groups (pip install net-benchmark[crypto]), grading against the published SSL Labs and Server Side TLS rubrics, JARM fingerprinting, and more. Full documentation: SSL Check guide