Inspect Your Fleet
Read what the shell reports about this machine, its peers, the round trip to one of them, who holds an address.
On this page (6)
Inspect Your Fleet Documentation
Four reads answer most questions about a fleet, in this order: what this node is, what the peers are, whether one of them answers, and who holds an address you did not expect. Every command here reads; none of them change anything.
1. Read this node and its peers
whisper whale status
One screen: this node's identity and connection, then every peer in the fleet. --self and --peers are both on by default, so pass one of them to narrow the screen to that half. The RTT column stays - until something measures it, so a number there is always a real round trip; add --probe to measure every peer now.
Without a key in effect the node half still answers and the fleet half says so, which makes this the first thing to run on a machine you have just set up.
2. Print the address on its own
whisper whale ip
Instant, and it changes nothing: it brings no connection up and verifies nothing, which is what makes it safe to call from a script. --assert <ip> exits 0 only when this node's address is exactly that one, so a deployment can gate on identity in one line.
3. Measure one peer
whisper whale ping db-01
Name the peer any way you have it: an agent id, a /128, a short name from your fleet, or an FQDN with or without the trailing dot. The probe is a TCP connect rather than an ICMP echo, because a connect carries more: a refusal proves the packet reached the peer and came back. So there are four outcomes, and they mean different things.
| Outcome | What it proves |
|---|---|
open | Something reached the peer and something is listening. |
refused | A path exists and nothing is listening on that port. |
no reply | Nothing came back. |
no route | This host could not even send. |
-c sets how many probes to send and --port sets the port; 443 is the default.
4. Check what answered for this host
whisper whale netcheck
This measures what works between this host and the Whalenet service over both address families, and how fast each answer came back. It sends a real DNS question that is answered, rather than a datagram nobody replies to, and it needs no key. Nothing here says anything about the path between two peers; for that, read status or ping above.
5. Find out who holds an address
whisper whale whois 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
No key and no account: both halves are public. The name half is DNSSEC-validated in this process, from the IANA root trust anchor compiled into the binary, walking ip6.arpa. It does not read a resolver's AD bit and does not trust the resolver that answered. Give it an address or a name, with or without a trailing dot, and it works for any address on the internet rather than only your own nodes. Add --json for the verbatim registry object, and see verify an identity for the same checks run with nothing but dig and curl.
Flags that apply to all of them
--json emits the raw control-plane envelope for scripting, --quiet prints only the load-bearing value, and --no-color (or the NO_COLOR environment variable) drops the formatting. Where a read needs a key, supply it with whisper login, the WHISPER_API_KEY environment variable, or --key; keys and scopes covers which scope each read wants.