9.3 Device Health, Wi-Fi & ISP Network Telemetry
Key Takeaways
- ZDX harvests continuous endpoint OS telemetry—including CPU utilization, memory pressure, disk queue length, and network interface speed—to eliminate false network diagnoses when endpoint hardware is exhausted.
- Wi-Fi telemetry captures Received Signal Strength Indicator (RSSI), channel frequency (2.4 GHz vs 5 GHz vs 6 GHz), channel band congestion, and BSSID roaming transitions.
- An RSSI between -30 dBm and -65 dBm indicates strong Wi-Fi signal, -67 dBm to -75 dBm indicates fair signal, and values weaker than -80 dBm cause packet drops, retransmissions, and ZDX Score degradation.
- ZDX isolates the local home network last-mile by probing Default Gateway Round-Trip Time (RTT); gateway latency above 20-50ms indicates local router contention rather than upstream ISP failure.
- ISP and Autonomous System (AS) tracking maps middle-mile provider routing, enabling administrators to detect regional broadband outages or peering degradations across major carriers.
9.3 Device Health, Wi-Fi & ISP Network Telemetry
Quick Answer: A poor digital experience is frequently caused by endpoint hardware exhaustion or local Wi-Fi radio frequency (RF) degradation rather than network or SaaS outages. ZDX captures granular Endpoint Device Health (CPU utilization, RAM consumption, Disk I/O queue length, network adapter drivers), Wi-Fi Telemetry (RSSI in dBm, channel frequency, band congestion, BSSID roaming events), and Last-Mile / ISP Metrics (Default Gateway RTT, DNS server response time, ISP Autonomous System Number [ASN]).
1. Endpoint Device Health Telemetry
When a user reports that "the cloud application is frozen," the root cause is often local endpoint resource starvation. If an endpoint's CPU is pegged at 100% due to an antivirus scan or background indexing, the web browser cannot render the DOM or execute JavaScript, creating the illusion of a slow network connection.
+-----------------------------------------------------------------------------+
| ZDX ENDPOINT DEVICE HEALTH TELEMETRY |
+-----------------------------------------------------------------------------+
+-------------------------------------------------------------------------+
| OPERATING SYSTEM SENSORS |
+-------------------------------------------------------------------------+
| | | |
v v v v
+------------+ +------------+ +------------+ +------------+
| CPU METRICS| | RAM MEMORY | | DISK I/O | | ADAPTER |
+------------+ +------------+ +------------+ +------------+
| * Total % | | * % Used | | * Queue Len| | * Type |
| * Top Proc | | * Avail MB | | * Read Lat | | * Link Spd |
| * Throttled| | * Page Swp | | * Write Lat| | * Drops |
+------------+ +------------+ +------------+ +------------+
Core Endpoint Metrics & Thresholds:
- CPU Utilization & Process Breakdown:
- Normal (<70%): Sufficient CPU cycles available for application execution and browser rendering.
- Degraded (70%–89%): Moderate resource contention; intermittent UI stutter.
- Critical (>=90%): Severe CPU starvation. ZDX flags top resource-consuming processes (e.g.,
MsMpEng.exe,chrome.exe,zoom.exe), allowing service desk agents to identify the exact runaway process.
- RAM Memory Utilization & Paging:
- Measures total physical memory, active memory usage percentage, and virtual memory page swapping rates. High page fault rates indicate physical RAM exhaustion, causing disk thrashing.
- Disk I/O Latency & Queue Depth:
- High disk queue depth (>=2.0) and write latency (>25ms) highlight storage bottlenecks (such as heavy local backup synchronization or disk encryption tasks) that freeze application responsiveness.
- Network Adapter Health:
- Captures physical connection type (Wi-Fi 802.11ax/ac/n, Gigabit Ethernet, Cellular LTE/5G, Virtual VPN/TUN adapter), negotiated link speed (e.g., 1000 Mbps vs 10 Mbps negotiated in error), and local interface packet drops.
2. Wi-Fi RF Diagnostics & Signal Strength (RSSI)
In modern hybrid and remote work environments, over 80% of last-mile connectivity issues originate on local Wi-Fi networks. ZDX harvests real-time 802.11 radio frequency (RF) telemetry directly from the operating system wireless subsystem.
+-----------------------------------------------------------------------------+
| WI-FI SIGNAL STRENGTH (RSSI) SCALE |
+-----------------------------------------------------------------------------+
-30 dBm -60 dBm -67 dBm -75 dBm -90 dBm
+--------------------+--------------+--------------+--------------+
| EXCELLENT | GOOD | FAIR | POOR |
| (Max Speed) | (Streaming) | (Degraded) | (Disconnect) |
+--------------------+--------------+--------------+--------------+
* Close to AP * Healthy Web * Packet Drops * High Loss
* Negligible Noise * Low Latency * Buffering * Roaming Flaps
| RSSI Range (dBm) | Signal Quality Rating | Technical Characteristics & User Experience |
|---|---|---|
| -30 to -60 dBm | Excellent (Green) | Optimal signal strength. Maximum negotiated data rates, negligible frame retransmissions, ideal for 4K video and low-latency voice. |
| -61 to -67 dBm | Good (Green) | Minimum signal required for reliable enterprise voice/video collaboration and high-throughput web browsing. |
| -68 to -75 dBm | Fair / Degraded (Amber) | Noticeable signal attenuation. Wi-Fi data rates downshift, packet loss increases (1–3%), leading to voice clipping and buffering. |
| -76 to -90 dBm | Poor / Critical (Red) | Extremely weak signal. Heavy frame retransmissions, packet loss (>5%), severe latency spikes, and frequent disconnections. |
Additional Wireless RF Metrics Captured by ZDX:
- Wi-Fi Channel Band (2.4 GHz vs. 5 GHz vs. 6 GHz): 2.4 GHz bands suffer from severe co-channel interference and congested spectrum (only 3 non-overlapping channels: 1, 6, 11). 5 GHz and 6 GHz (Wi-Fi 6E/7) provide wider channel widths (40/80/160 MHz) and significantly higher throughput.
- Channel Congestion & Interference: Identifies whether the current wireless channel is oversaturated by neighboring residential or rogue enterprise access points.
- BSSID & Roaming Flapping: ZDX logs the specific MAC address (BSSID) of the connected Access Point. In corporate campus environments, ZDX detects aggressive roaming / ping-ponging—where an endpoint continuously flaps between two adjacent APs with similar signal strength, dropping TCP sessions and voice packets during each re-association.
3. Gateway, ISP Transit & DNS Server Telemetry
To separate local home router faults from regional ISP outages, ZDX continuously evaluates three key network telemetry checkpoints:
+-----------------------------------------------------------------------------+
| LAST-MILE & UNDERLAY TELEMETRY CHECKPOINTS |
+-----------------------------------------------------------------------------+
[Endpoint] ===== (Wi-Fi / LAN) =====> [Default Gateway] <-- Checkpoint 1: Gateway RTT
|
v
[Local ISP DNS] <-- Checkpoint 2: DNS Latency
|
v
[ISP Core / AS] <-- Checkpoint 3: ISP ASN Transit
1. Default Gateway Round-Trip Time (Gateway RTT):
- Mechanics: The endpoint sends continuous micro-probes to its local default gateway IP (e.g.,
192.168.1.1or10.0.0.1). - Diagnostic Value:
- If Gateway RTT is low (<2–5ms), the local home Wi-Fi/LAN environment is completely healthy.
- If Gateway RTT is high (>50–200ms) or dropping packets, the issue is local (e.g., family streaming 4K video, microwave RF interference, or an overloaded consumer router).
2. ISP & Autonomous System Number (ASN) Tracking:
- ZDX identifies the public egress IP and maps it to the upstream ISP Name and ASN (e.g., Comcast AS7922, AT&T AS7018, Vodafone AS1273, Deutsche Telekom AS3320).
- Administrators can filter enterprise-wide digital experience dashboards by ISP to immediately confirm if a widespread Microsoft 365 slowdown is caused by a regional outage within a specific service provider (e.g., Verizon Fios in the US Northeast).
3. Local & Public DNS Server Telemetry:
- ZDX records the primary and secondary DNS server IP addresses configured on the endpoint network adapter and measures the exact round-trip response time for DNS resolution.
- Identifies unoptimized routing where remote workers use legacy corporate VPN DNS servers that backhaul queries thousands of miles instead of utilizing fast local ISP or public resolvers (e.g.,
1.1.1.1,8.8.8.8).
4. Telemetry Correlation Matrix
The following matrix illustrates how ZDX correlates multiple telemetry feeds to pinpoint the true bottleneck:
| Symptom / Observation | CPU / RAM | Wi-Fi RSSI | Gateway RTT | Cloud Path ISP Hop | TTFB | Root Cause Identification |
|---|---|---|---|---|---|---|
| Scenario A | 98% (Critical) | -45 dBm | 1.2 ms | 15 ms (0% Loss) | 42 ms | Endpoint Device Starvation (Runaway process) |
| Scenario B | 18% (Normal) | -82 dBm (Poor) | 140 ms (Spike) | 160 ms (Drops) | 180 ms | Local Wi-Fi RF Weakness (User too far from AP) |
| Scenario C | 12% (Normal) | -48 dBm | 1.5 ms | 240 ms (15% Loss) | 280 ms | ISP Middle-Mile Underlay Congestion |
| Scenario D | 15% (Normal) | -50 dBm | 1.1 ms | 18 ms (0% Loss) | 2100 ms (High) | SaaS Application / Database Backend Stalled |
5. Exam Tips & High-Frequency Distinctions
[!IMPORTANT] Isolating Wi-Fi vs. ISP Issues:
- If Gateway RTT is high (>50ms) and RSSI is weak (e.g., -82 dBm), the problem is Local Wi-Fi / LAN.
- If Gateway RTT is low (<3ms), RSSI is strong (-50 dBm), but Hop 2 or Hop 3 RTT is high (>150ms), the problem is ISP / Last-Mile Transit, NOT local Wi-Fi.
[!TIP] BSSID Roaming Flapping: On the exam, if an in-office enterprise user experiences sporadic audio drops while walking between conference rooms, look for BSSID Roaming Flapping in the ZDX device health view, which highlights rapid AP re-associations.
A remote employee reports that video calls frequently freeze. In ZDX, the administrator observes that the user's Wi-Fi RSSI is -84 dBm and the Default Gateway RTT averages 165ms, while the endpoint CPU utilization is 14%. What is the primary cause of the degradation?
Which wireless diagnostic metric captured by ZDX allows administrators to detect that an enterprise laptop is rapidly flapping between two physical access points in an office building?
An administrator notices that hundreds of remote employees in the same metropolitan area using the same residential internet provider are reporting slow Salesforce performance. In ZDX, which metric view enables the administrator to group and verify that the slowdown is isolated to that specific service provider?
What is the primary indicator in ZDX that an application performance issue is caused by endpoint hardware contention rather than network or cloud application faults?