A status screen can lose useful information when it uses one “success” flag for everything. A number can be reported active while a message fetch fails. A message fetch can succeed with an empty snapshot. An operation can have an uncertain outcome while the interface is still able to refresh an existing record.

Keep those facts separate. In particular, a failed poll must not overwrite a previously successful reading with zero messages or imply that another purchase should be made.

Give each fact its own history

A small read model can retain three independent streams:

For resource and message reads, retain both the last successful observation time and the latest attempt time/result. If a refresh fails after a successful read, the previous value is still a historical fact. Show it with its age and failed-refresh indicator, rather than presenting it as a new current reading.

An empty successful snapshot and a failed fetch are different. So are a reported expiry and an unreadable status. Do not infer any of them from another stream.

An offline reducer with explicit limits

Save the complete example as polling_model.py. It uses Python 3.10 or newer and only the standard library. The names are this article's teaching format, not a claim about any service's endpoint, event schema or complete lifecycle.

The at field orders observations within each stream. Supply a trustworthy observation timestamp with an explicit offset. Do not stamp a cached old result with a new clock value and treat it as a fresh source fact. An actual integration needs the service's revision/timestamp rules, or serialised reads with suitable stale-response protection; this reducer cannot create an authoritative ordering for overlapping responses.

"""A fictional local read model; it sends no requests or messages."""
from dataclasses import dataclass, field, replace
from datetime import datetime, timezone
import json


def instant(value):
    try:
        date = datetime.fromisoformat(value.replace("Z", "+00:00"))
        if date.tzinfo is None or date.utcoffset() is None:
            raise ValueError
        return date.astimezone(timezone.utc)
    except (AttributeError, TypeError, ValueError):
        raise ValueError("Use a timestamp with an explicit UTC offset") from None


@dataclass(frozen=True)
class Snapshot:
    value: object = None
    succeeded_at: str | None = None
    attempted_at: str | None = None
    latest_attempt_ok: bool | None = None


@dataclass(frozen=True)
class State:
    operation: Snapshot = field(default_factory=Snapshot)
    resource: Snapshot = field(default_factory=Snapshot)
    messages: Snapshot = field(default_factory=Snapshot)


def apply_event(state, event):
    kind, at = event["kind"], instant(event["at"])
    if kind in ("operation_confirmed", "operation_unknown"):
        stream, ok, value = "operation", True, kind.removeprefix("operation_")
    elif kind in ("resource_ok", "messages_ok", "resource_error", "messages_error"):
        stream, outcome = kind.split("_")
        ok = outcome == "ok"
        value = event.get("value") if ok else None
        if ok and stream == "resource" and value not in ("pending", "active", "expired", "failed"):
            raise ValueError("Unrecognised resource state in this teaching model")
        if ok and stream == "messages" and (type(value) is not int or value < 0):
            raise ValueError("Use a non-negative snapshot count")
    else:
        raise ValueError("Unrecognised event")
    previous = getattr(state, stream)
    if stream == "operation" and previous.value == "confirmed" and value == "unknown":
        return state
    if previous.attempted_at:
        earlier = instant(previous.attempted_at)
        if at < earlier:
            return state
        if at == earlier:
            if previous.latest_attempt_ok == ok and (not ok or previous.value == value):
                return state
            raise ValueError("Conflicting events at the same stream timestamp")
    stamp = at.isoformat()
    if ok:
        current = Snapshot(value, stamp, stamp, True)
    else:
        current = replace(previous, attempted_at=stamp, latest_attempt_ok=False)
    return replace(state, **{stream: current})


def view(state):
    def show(snapshot):
        return {"last_successful_value": snapshot.value,
                "last_successful_at": snapshot.succeeded_at,
                "last_attempt_at": snapshot.attempted_at,
                "latest_attempt_succeeded": snapshot.latest_attempt_ok}
    return {"operation": {"reported_outcome": state.operation.value,
                          "reported_at": state.operation.attempted_at},
            "resource": show(state.resource),
            "message_snapshot_count": show(state.messages)}


if __name__ == "__main__":
    # Fictional events only. An empty snapshot does not authorise a resend.
    events = [
        {"kind": "operation_confirmed", "at": "2026-10-23T09:00:00Z"},
        {"kind": "resource_ok", "value": "active", "at": "2026-10-23T09:01:00Z"},
        {"kind": "messages_ok", "value": 0, "at": "2026-10-23T09:02:00Z"},
        {"kind": "messages_error", "at": "2026-10-23T09:03:00Z"},
    ]
    state = State()
    for event in events:
        state = apply_event(state, event)
    print(json.dumps(view(state), indent=2))

Run it locally:

python3 polling_model.py

The fictional sequence records an acknowledged operation, an active resource, an empty successful message snapshot and then a failed message refresh. The output retains the zero from the earlier successful snapshot, its original timestamp, and latest_attempt_succeeded: false for the later attempt. It does not claim that the failed attempt found no messages.

The model intentionally performs no polling, retries, expiry calculation, sending or financial action. It replaces snapshot counts rather than adding them, so replaying the same snapshot does not manufacture more messages.

Handle order, duplicates and uncertainty deliberately

A repeated identical observation at the same stream timestamp leaves the state unchanged. An older observation cannot replace a newer one in that stream. Conflicting resource/message observations at the same timestamp raise an error for review instead of choosing whichever value is more convenient. The resource and message watermarks are independent: a newer message snapshot does not make an earlier resource observation irrelevant.

For the same acquisition operation, a later ambiguous report does not erase a definite earlier confirmation in this model. A confirmation still establishes neither resource activation nor message arrival. If the initial operation is unknown, keep its reference and use its documented recovery/status process. Do not turn a missing response into a second purchase.

This distinction matters beyond SMS. HTTP semantics separates idempotent methods from operations that cannot safely be retried merely because the connection failed. A read-model reducer does not make a side-effecting request idempotent. Any real polling loop also needs the service's access rules, bounded attempts and its rate-limit guidance; this example supplies none of those policies.

Make the screen say what was observed

Useful labels include “Last successful message check”, “Latest refresh failed” and “Reported expiry”. Avoid an unqualified “No messages” based on an error, or “Current” beside a reading whose freshness is unresolved.

Keep message contents and verification codes out of ordinary logs. The example stores only a fictional snapshot count and timestamps; it does not need a phone number, a code or a customer identifier. An actual application still needs authorised access, appropriate retention and the receiving service's rules.

A reported expired resource can coexist with a retained historical message snapshot. That does not promise the inbox remains accessible, that a later message will arrive, or that the same number can be kept. Product term and account-recovery requirements belong in the buyer's decision before purchase.

What was checked

On 23 October 2026, fourteen offline unittest cases passed with Python 3.12.14. They cover unknown initial values, independent resource/message facts, empty successful snapshots, failed-refresh retention, later arrivals, duplicate/older events, same-time conflicts, independent watermarks, uncertain/confirmed operations, expiry, invalid values and timezone normalisation. The standalone example was run, and the displayed Python block was compared with that executed file.

The tests establish the behaviour of this local model. They do not test real delivery, receiving-service acceptance, API polling limits, a supplier integration or customer outcomes.

For the product decision, activation versus rental explains how the access terms differ. Number expiry and account recovery covers dependencies that can remain after the paid term. Check the actual supported service and duration in the SMS catalogue; a previous delivered message is not a guarantee of another one.

A travel-data estimate starts with two readings that mean the same thing. Subtracting a phone's current-period counter from a plan's remaining allowance will still produce a number. It will not produce a useful usage sample.

Keep a small journal before building a dashboard or choosing a travel allowance. Record where a reading came from, which SIM and period it describes, and when its source was last updated. Then reject pairs whose meaning has changed.

Record the counter's identity

The iPhone usage reference describes current-period statistics, resetting them, and viewing usage for the selected data line. Pixel's usage guidance lets you choose a time period and notes that carrier measurements can differ from the phone's. These are reasons to retain measurement context, rather than assume every screen has the same counter.

Use short local labels such as travel-data; a journal does not need a phone number, account identifier, installation QR code or location history.

For a phone counter you read directly, snapshot_at can be that observation's time. For a provider reading with an older update time, retain that older time. If you cannot establish the source time or unit basis, leave the pair unresolved. Do not label a screen's ambiguous “GB” as decimal merely to satisfy the script.

Select two readings before calculating a delta

Keep the full journal, but export exactly two selected rows for this check. The following sample.csv describes one fictional phone counter, on one line, within one period. Both units explicitly use decimal bytes; the example does not assert how a particular phone labels its units.

source,line,period,captured_at,snapshot_at,value,unit,reset
phone,travel-data,sample-A,2026-10-20T09:00:00Z,2026-10-20T09:00:00Z,1000,decimal_MB,no
phone,travel-data,sample-A,2026-10-22T09:00:00Z,2026-10-22T09:00:00Z,1.6,decimal_GB,no

The difference is 0.6 decimal GB between the two source snapshots. This is a calculation from invented inputs, not a measured consumption rate or a recommended allowance.

The checker below rejects a changed source, line or period; a reset at the end; an old or non-advancing source snapshot; and a decreasing counter. A blank counter remains unknown. A genuine zero delta requires two known, advancing snapshots with equal values.

A complete local checker

Save this as journal.py. It uses Python 3.10 or newer and only the standard library. It has no network, account or installation step.

"""Check two selected cumulative-usage readings; no network access."""
import argparse
import csv
from datetime import datetime, timezone
from decimal import Decimal, InvalidOperation
import json
import re


UNITS = {"bytes": Decimal(1), "decimal_MB": Decimal(1000000),
         "decimal_GB": Decimal(1000000000)}


def timestamp(value):
    try:
        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
        if parsed.tzinfo is None or parsed.utcoffset() is None:
            raise ValueError
        return parsed.astimezone(timezone.utc)
    except (AttributeError, TypeError, ValueError):
        raise ValueError("invalid_time") from None


def reading(row):
    required = ("source", "line", "period", "captured_at", "snapshot_at",
                "value", "unit", "reset")
    if any(not isinstance(row.get(key), str) or not row[key].strip()
           for key in required):
        raise ValueError("missing_value")
    if row["source"] not in ("phone", "plan_used"):
        raise ValueError("unknown_source")
    if row["reset"] not in ("yes", "no"):
        raise ValueError("unknown_reset")
    if row["unit"] not in UNITS:
        raise ValueError("unknown_unit")
    number = row["value"].strip()
    # Bound significant digits so conversion and subtraction remain exact
    # within Decimal's default precision; never round an oversized input.
    if (not re.fullmatch(r"[0-9]+(?:\.[0-9]+)?", number)
            or len(number.replace(".", "")) > 18):
        raise ValueError("invalid_counter")
    try:
        count = Decimal(number) * UNITS[row["unit"]]
    except InvalidOperation:
        raise ValueError("invalid_counter") from None
    if count != count.to_integral_value():
        raise ValueError("fractional_byte")
    captured, snapshot = timestamp(row["captured_at"]), timestamp(row["snapshot_at"])
    if snapshot > captured:
        raise ValueError("future_snapshot")
    return captured, snapshot, count


def assess_pair(before, after, *, max_age_seconds):
    if type(max_age_seconds) is not int or max_age_seconds <= 0:
        raise ValueError("Choose a positive integer snapshot-age policy")
    try:
        a_captured, a_snapshot, a_count = reading(before)
        b_captured, b_snapshot, b_count = reading(after)
    except ValueError as error:
        return {"usable": False, "reason": str(error)}
    for key in ("source", "line", "period"):
        if before[key] != after[key]:
            return {"usable": False, "reason": "changed_" + key}
    if after["reset"] == "yes":
        return {"usable": False, "reason": "reset_at_end"}
    if b_captured <= a_captured or b_snapshot <= a_snapshot:
        return {"usable": False, "reason": "no_forward_interval"}
    if any((captured - snapshot).total_seconds() > max_age_seconds
           for captured, snapshot in ((a_captured, a_snapshot), (b_captured, b_snapshot))):
        return {"usable": False, "reason": "stale_when_captured"}
    if b_count < a_count:
        return {"usable": False, "reason": "counter_decreased"}
    return {"usable": True, "delta_decimal_GB": format(
        (b_count - a_count) / UNITS["decimal_GB"], "f"),
        "from_snapshot": a_snapshot.isoformat(),
        "to_snapshot": b_snapshot.isoformat()}


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("csv_file")
    parser.add_argument("--max-age-seconds", required=True, type=int)
    args = parser.parse_args()
    with open(args.csv_file, newline="", encoding="utf-8") as stream:
        rows = list(csv.DictReader(stream))
    if len(rows) != 2:
        parser.error("Export exactly two selected readings")
    print(json.dumps(assess_pair(rows[0], rows[1],
                               max_age_seconds=args.max_age_seconds), indent=2))

Run the fictional sample:

python3 journal.py sample.csv --max-age-seconds 300

The 300 is an example policy: each snapshot must have been no more than five minutes old when captured. It is not a provider refresh promise, and it does not make an old journal entry current today. Choose and record a suitable policy for your source instead of copying the number without a reason.

A usable result contains delta_decimal_GB and the two source timestamps. An unusable result contains a reason and no delta. The script does not sum different sources, estimate missing traffic, create a daily average or claim the result matches billable usage. Conversion is limited to explicitly named units and at most eighteen input digits; oversized or fractional-byte inputs are rejected rather than rounded into an apparently precise result.

Interpret a rejected pair

• reset_at_end or counter_decreased: establish a new baseline. Do not turn the decrease into negative usage or assume a top-up erased earlier consumption.
• changed_source, changed_line or changed_period: choose a genuinely comparable pair. A provider's cumulative used counter is not interchangeable with a phone's counter.
• stale_when_captured or no_forward_interval: retain the uncertainty. Reading the same cached snapshot twice does not establish zero additional usage.
• missing_value, unknown_unit or invalid_time: recover the missing context before calculating. Do not fill it with zero, a guessed unit or an assumed timezone.

This is a consistency check on the information you supplied. It cannot detect an unrecorded reset, a mislabelled line or a provider counter whose meaning changed without a new period label. Keep those limits visible with any exported result.

What was checked

On 23 October 2026, fifteen offline unittest cases passed with Python 3.12.14. They cover known unit conversion, valid zero, missing values, resets/decreases, changed identities, snapshot-age boundaries, duplicate and reversed times, timezone offsets, invalid counters and fractional bytes. The standalone CSV command was also run, and the complete displayed Python block was compared with the executed file.

These checks validate the local input rules, not device-counter accuracy, plan availability, network performance or the amount a provider will charge.

Once you have a representative comparable sample, use the eSIM data calculator to make your own trip assumptions explicit. If the sample includes laptop sharing, the hotspot guide explains how to avoid counting the same work twice. Coverage, validity and activation conditions still need their own plan checks.

Choose a Python HTTP client for the application you need to run, then preserve its request policy. Redirects, timeout phases, environment routing and error handling can change when a working Requests integration moves to HTTPX.

Short answers

Should I use HTTPX or Requests?

Keep Requests when its synchronous interface fits a maintained application. Consider HTTPX when you need its native async client or optional HTTP/2, then test the workflow before migrating. Neither choice guarantees faster requests or better proxy results.

Can I replace requests.get with httpx.get?

Do not assume identical behaviour. Requests GET follows redirects by default; HTTPX does not. Timeout defaults, response-error checks, proxy arguments and exception classes also differ. Make the intended policy explicit.

Does HTTPX use the same proxies argument as Requests?

No. Current HTTPX Client uses proxy= for one gateway; Requests uses a proxies dictionary. Complex HTTPX routing uses its supported transport configuration. Configure the client version actually installed.

Choose for the application you need to maintain

Requests fits a synchronous job that already works with its API and dependencies. HTTPX is useful when the application needs a native async client, an explicit transport configuration or optional HTTP/2. Migrating just to obtain a different library name adds work without establishing a better result. Decide which interface the application needs, then test the behaviour that matters to that job.

This comparison concerns the documented default clients, rather than every third-party adapter. If the question is simply how to connect through a gateway, use the complete Requests proxy setup or HTTPX proxy setup. Their credentials, certificate trust and proxy arguments are deliberately different.

Practical differences to review before choosing a client

The HTTPX compatibility guide documents the API differences. Its native async interface is a reason to consider a migration, not evidence that a particular workload will run faster. HTTP/2 support is opt-in and does not guarantee that every response uses HTTP/2. No throughput benchmark is claimed here.

Make redirects and accepted responses explicit

A Requests GET can receive a redirect and return the response from a later request. An HTTPX GET normally returns the redirect itself. A simple rename can therefore change both the visible status and the number of requests. Use allow_redirects=False with Requests or follow_redirects=False with HTTPX when the job must inspect the first response. If redirects are part of the intended workflow, enable them deliberately and review allowed destinations and request limits.

There is another migration trap: Requests raise_for_status() raises for 4xx and 5xx responses; HTTPX raises for responses outside 2xx. In our local 302 check, Requests returned without an exception and HTTPX raised HTTPStatusError. Neither behaviour defines your application’s success. A job expecting one JSON document can require status 200 and specific content before accepting the result. See the Requests response checks and HTTPX status checks.

Keep response errors separate from transport errors. An HTTP 429 is a response requiring the service’s rate-limit policy; a failed connection or tunnel may have no destination response at all. An exception handler copied from Requests will not automatically catch HTTPX’s exception classes. Record the client’s error category without printing a credential-bearing URL or the raw exception. Use 429 troubleshooting for retry decisions.

Transfer the timeout policy rather than a number

Requests accepts a connection/read tuple, such as (2, 3). HTTPX separates connect, read, write and connection-pool waits, so httpx.Timeout(3, connect=2, pool=1) gives those phases different example limits. These numbers demonstrate configuration; they are not recommended limits for every network. Select budgets from your authorised job’s requirements.

A read limit is a wait for incoming data, not a deadline for the entire download. A response that keeps supplying chunks can last longer. Give the worker a separate overall deadline and cap its queue, attempts and response size. HTTPX’s timeout reference explains the phases; Requests documents its timeout boundaries. Changing clients does not create an overall job deadline.

Preserve the intended network and trust policy

Both clients can read environment proxy configuration. A worker shell, notebook and deployed service may therefore use different routes. Make the policy explicit before comparing results. trust_env=False disables environment-derived behaviour; it also affects certificate or authentication configuration, depending on the client. Do not use it to bypass an organisation’s required proxy or approved CA policy.

The HTTPX environment reference covers its proxy and certificate variables. Requests documents environment proxies in advanced usage and its Session trust setting. The existing Portproof setup guides supply complete explicit gateway and trust settings. Keep TLS verification enabled, and keep gateway credentials separate from destination login.

A Python Session or Client owns connections and cookies; it is not the gateway’s sticky-session setting. Reusing a connection can preserve a tunnel, so a new function call does not guarantee a new exit address. Preserve the generated gateway username for the intended workflow and consult rotation and sticky sessions. Dedicated-device rental and shared traffic billed by GB also remain separate products.

Use the same small response contract in both clients

The following helpers expect a synthetic JSON document with ready equal to true. Both reject a redirect or any status other than 200 before reading the body. They cap collected decoded content at 64 KiB, disable redirects, add no retry, and close the response and client on success or failure. The output reports status and a category; it never prints the URL or a response body.

Install the versions used in the local fixture

python -m pip install "requests==2.34.2" "httpx==0.28.1"

comparison_check.py — one controlled read with either client

import json

import httpx
import requests


def read_result(response, chunks):
    status = response.status_code
    if status != 200:
        return {"status": status, "accepted": False, "reason": "status"}
    body = bytearray()
    for chunk in chunks:
        if len(body) + len(chunk) > 65536:
            raise ValueError("Response exceeds 64 KiB")
        body.extend(chunk)
    payload = json.loads(body)
    accepted = isinstance(payload, dict) and payload.get("ready") is True
    return {"status": status, "accepted": accepted,
            "reason": "accepted" if accepted else "content"}


def requests_check(url):
    status = None
    try:
        with requests.Session() as client:
            client.trust_env = False
            with client.get(url, timeout=(2, 3), allow_redirects=False,
                            stream=True, verify=True) as response:
                status = response.status_code
                return read_result(response, response.iter_content(8192))
    except requests.RequestException as error:
        return {"status": status, "accepted": False,
                "reason": type(error).__name__}
    except ValueError:
        return {"status": status, "accepted": False, "reason": "ValueError"}


def httpx_check(url):
    status = None
    try:
        with httpx.Client(trust_env=False, follow_redirects=False,
                          verify=True,
                          timeout=httpx.Timeout(3, connect=2, pool=1)) as client:
            with client.stream("GET", url) as response:
                status = response.status_code
                return read_result(response, response.iter_bytes(8192))
    except httpx.HTTPError as error:
        return {"status": status, "accepted": False,
                "reason": type(error).__name__}
    except ValueError:
        return {"status": status, "accepted": False, "reason": "ValueError"}

For a local fixture URL, call either requests_check(url) or httpx_check(url). These are isolated direct-connection examples with environment settings disabled. They do not configure a Portproof gateway or replace the complete setup guides. The Requests tuple limits connection/read waits; HTTPX also limits write/pool waits. The decoded-content cap does not measure billable proxy traffic or impose a whole-job deadline.

Each helper opens a client for one diagnostic read. In an application processing related requests, move that client’s lifetime outside the loop and preserve response cleanup. Do not create an AsyncClient inside every iteration of a hot loop. Start with one authorised task before adding concurrency or implementing a retry policy.

What we checked locally

On 23 October 2026, we ran the exact displayed Python helpers with Python 3.12.14, Requests 2.34.2 and HTTPX 0.28.1 against a synthetic loopback HTTP origin. No live proxy, real credential or external destination was used. Separate checks observed the clients’ default GET redirect behaviour and their handling of an unfollowed 302.

Observed results from the isolated client-behaviour fixture

These checks establish the named clients’ local HTTP behaviour. They do not test TLS, authenticated CONNECT, async cancellation, live proxy availability, exit geography, throughput or customer conversion. The setup guides record their own separate proxy/TLS checks.

Migrate one observable workflow before scaling

1. Define the accepted response: status, content type or body shape, and any required application field. Keep rejected tasks in the record.
2. Copy the intended redirect, proxy, trust, timeout and cookie policies into the new client’s supported interface. Check the installed version and remove obsolete arguments.
3. Review existing exception handlers and retries. Do not multiply an adapter retry policy by an outer loop or automatically replay an uncertain purchase or form submission.
4. Run a small controlled read and compare request count, response acceptance and cleanup. A successful echo or parsed JSON alone does not establish every later application request.
5. Measure one representative permitted workflow, then use the traffic planning guide and current pricing for shared traffic sold by GB. A library migration alone provides no bandwidth saving or performance guarantee.

Use these clients for authorised QA, monitoring and research that respects the destination’s terms and access rules. A working connection does not grant permission to collect information or send requests. See the acceptable-use policy.

Configure GNU Wget 1 to use an authenticated HTTP proxy, check an HTTPS destination and keep the password out of command history. Start with one bounded echo request before downloading a permitted dataset.

Short answers

How do I set a proxy in Wget?

GNU Wget 1 reads http_proxy and https_proxy settings from its environment or configuration file. The example below supplies both in a separate configuration file and removes conflicting inherited proxy settings.

Which password option authenticates the proxy?

Use proxy_user and proxy_password for the gateway. Website credentials and --ask-password serve a different purpose; they do not replace these proxy settings.

Can an HTTP proxy carry an HTTPS download?

Yes. Wget requests a CONNECT tunnel through the HTTP gateway, then verifies the destination certificate. The initial proxy authentication is not encrypted by that destination TLS connection.

Which Wget proxy setting should you change?

Start with the URL you are downloading, then the gateway it should use. An HTTPS download needs https_proxy; setting only http_proxy does not configure that destination scheme. The gateway value can still begin with http://. GNU’s proxy reference documents these lower-case variables and their configuration-file equivalents.

Choose the route — Use http_proxy for an HTTP destination and https_proxy for an HTTPS destination. The example sets both explicitly in its temporary configuration. Copy the HTTP gateway from your connection builder; the destination’s https:// prefix does not turn a SOCKS listener into an HTTP proxy.

Authenticate the gateway — Use proxy_user and proxy_password. Keep the complete generated proxy username, including its pool, country and session choices. Website authentication is separate: changing a destination login does not repair a rejected proxy login.

Check exclusions and inherited settings — Inspect the job’s own routing configuration. no_proxy can exclude a destination; startup-file settings can override environment values. A scheduled task can have a different environment from your terminal. Do not paste an environment dump containing secrets into a support ticket.

Use the bounded example below when you need a controlled authentication check. It avoids putting a password in a URL or command argument. If that succeeds but your normal Wget job fails, compare the job’s destination scheme, configuration source and exclusions before changing the credential. A successful echo is evidence for that request only.

Check that you are running GNU Wget 1

This guide uses GNU Wget 1.25.0 and a Python wrapper on macOS or Linux. Wget 2 is a separate implementation; BusyBox and shell aliases can also behave differently. Check the actual executable before adopting flags from a tutorial. The wrapper finds wget on PATH and checks its version output.

Check the installed executable

wget --no-config --version

Install GNU Wget through your operating system’s trusted package source if needed. The wrapper requires Python 3.10 or newer and uses only its standard library. We tested with Python 3.12.14 and an isolated Wget build using OpenSSL. Windows users need a suitable Unix environment for this pipe-monitoring example.

Separate the gateway URL from the destination

Copy the full username from the connection builder, choosing an available pool and country. Use the proxy password supplied for that connection. The website account password and developer API key are different credentials. The hostname and port in this page’s example come from the site’s gateway configuration.

For an HTTPS destination, https_proxy can still contain an http:// gateway URL: the setting selects traffic by destination scheme. Wget then uses CONNECT. An HTTP destination uses http_proxy without destination TLS. Both settings here point to the same authenticated HTTP gateway. For SOCKS configuration, follow the separate curl guide.

Run one bounded echo check

Save the following as wget_check.py, then run python3 wget_check.py in an interactive terminal. Paste the complete username at the first prompt and enter the password at the hidden prompt. An existing PROXY_USER environment variable supplies the username instead. Neither prompt writes the password into a shell command.

wget_check.py

import getpass
import ipaddress
import json
import os
from pathlib import Path
import selectors
import shutil
import subprocess
import tempfile
import time
import warnings
from urllib.parse import urlsplit


class CheckFailure(Exception):
    pass


def check():
    wget = shutil.which("wget")
    if not wget:
        raise CheckFailure("Install GNU Wget 1 and check your PATH")
    version = subprocess.run([wget, "--no-config", "--version"],
                             capture_output=True, text=True, timeout=5)
    if not version.stdout.startswith("GNU Wget 1."):
        raise CheckFailure("This example requires GNU Wget 1")
    server = os.environ.get("PROXY_SERVER", "http://gw.portproof.org:7000")
    parsed = urlsplit(server)
    if (parsed.scheme != "http" or not parsed.hostname or not parsed.port
            or parsed.username is not None or parsed.password is not None
            or parsed.path not in ("", "/") or parsed.query or parsed.fragment
            or any(ord(c) <= 32 or ord(c) == 127 for c in server)):
        raise CheckFailure("Use an HTTP gateway URL without credentials")
    user = os.environ.get("PROXY_USER") or input("Full proxy username: ")
    warnings.simplefilter("error", getpass.GetPassWarning)
    password = getpass.getpass("Proxy password: ")
    for value in (user, password):
        if (not value or value != value.strip()
                or any(ord(c) < 32 or ord(c) == 127 for c in value)):
            raise CheckFailure("This config method requires nonempty credentials without edge whitespace or controls")
    if ":" in user:
        raise CheckFailure("A Basic-auth username cannot contain a colon")
    env = {k: v for k, v in os.environ.items()
           if k.lower() not in {"http_proxy", "https_proxy", "ftp_proxy",
                                "all_proxy", "no_proxy", "wgetrc"}}
    with tempfile.TemporaryDirectory(prefix="wget-check-") as folder:
        config = Path(folder) / "wgetrc"
        fd = os.open(config, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
        with os.fdopen(fd, "w", encoding="utf-8") as stream:
            stream.write(f"use_proxy = on\nhttp_proxy = {server}\nhttps_proxy = {server}\n"
                         f"no_proxy =\nproxy_user = {user}\nproxy_password = {password}\n")
        command = [wget, f"--config={config}", "--quiet", "--no-netrc",
                   "--no-hsts", "--no-cookies", "--tries=1", "--timeout=5",
                   "--max-redirect=0", "--output-document=-"]
        if os.environ.get("PROXY_CA_BUNDLE"):
            command.append("--ca-certificate=" + os.environ["PROXY_CA_BUNDLE"])
        command.append("https://api.portproof.org/v1/echo-ip")
        with subprocess.Popen(command, stdout=subprocess.PIPE,
                              stderr=subprocess.DEVNULL, env=env) as process:
            deadline = time.monotonic() + 20
            data = bytearray()
            try:
                with selectors.DefaultSelector() as ready:
                    ready.register(process.stdout, selectors.EVENT_READ)
                    while True:
                        left = deadline - time.monotonic()
                        if left <= 0 or not ready.select(left):
                            raise CheckFailure("Overall download deadline reached")
                        chunk = os.read(process.stdout.fileno(), 4096)
                        if not chunk:
                            break
                        data.extend(chunk)
                        if len(data) > 65536:
                            raise CheckFailure("Echo body exceeds 64 KiB")
                process.wait(timeout=max(0.001, deadline - time.monotonic()))
                if process.returncode:
                    raise CheckFailure(f"Wget exited with status {process.returncode}")
            finally:
                if process.poll() is None:
                    process.kill()
                process.wait()
        payload = json.loads(data)
        if not isinstance(payload, dict) or not isinstance(payload.get("ip"), str):
            raise ValueError("Echo response has no IP string")
        address = ipaddress.ip_address(payload["ip"])
        print("Exit address:", address)


if __name__ == "__main__":
    try:
        check()
    except CheckFailure as error:
        print(error)
        raise SystemExit(1)
    except (OSError, ValueError, subprocess.SubprocessError, getpass.GetPassWarning) as error:
        print("Check failed:", type(error).__name__)
        raise SystemExit(1)

The wrapper prints a validated exit address only after Wget succeeds and the response contains an IP string. That address describes this request; it does not establish country accuracy, future availability or access to another site. Next, test one permitted operation from the application that will perform the real work.

Use a temporary file for proxy credentials

The password goes into a mode-0600 file inside a private temporary directory, rather than the gateway URL or process arguments. It remains plaintext in that protected file while Wget runs. Handled failures and timeouts remove the directory; forced termination can leave it behind, so use a trusted account and temporary storage.

This method passes raw punctuation directly to Wget’s configuration parser. Do not URL-encode the password or add quotation marks around it. The parser trims surrounding whitespace, so the wrapper rejects leading or trailing whitespace and control characters instead of silently changing credentials. If those characters are required, use a client with a separate authentication object, such as HTTPX.

The script rejects a colon in a Basic-auth username. It also stops if hidden password entry is unavailable. For unattended work, replace the prompts with your established secret-manager lookup and retain the same validation and file protections. Keep generated configuration files out of repositories, archives and diagnostic attachments.

Control inherited proxy and configuration settings

GNU’s proxy documentation describes the lower-case environment variables and configuration settings. A job scheduler or service may inherit different values from your terminal. The wrapper clears inherited proxy variables for its child process, uses a dedicated configuration file and disables netrc credentials, cookies and HSTS persistence for this check.

An empty no_proxy setting prevents an exclusion from changing this diagnostic’s route. The local fixture also supplied conflicting environment proxies and WGETRC settings; the chosen gateway still received the request. Apply explicit routing only where it fits your network policy. The application troubleshooting guide explains how to compare processes.

Bound attempts, elapsed time and response data

Wget receives one URL, one permitted attempt and no redirects. Its five-second timeout limits network waiting; it is not an overall runtime limit. The wrapper separately stops the download after twenty seconds, including a response that keeps delivering small chunks. Password entry and the preliminary version check happen before that download deadline.

The wrapper also stops when the echo body exceeds 64 KiB. That bounds the diagnostic’s buffered response, not billable traffic: headers, buffering and protocol overhead remain separate. For larger files, choose deliberate download limits and measure account usage. Wget’s quota option is not a reliable single-file cutoff; see its download options.

Read failures by connection stage

A process exit code is not an HTTP response status. In particular, Wget status 4 does not distinguish a failed connection from every rejected tunnel. Keep the exact redacted error and use the CONNECT diagnostic to record the tunnel status separately. GNU’s exit-status reference defines the broader categories; the observations below are from the named local fixture.

Wget status 4 — In our HTTPS fixture, rejected CONNECT requests with 407 or 503 and stalled downloads returned this network-error status. It does not identify authentication failure by itself. Check the gateway, generated username and proxy password, then use the 407 diagnostic. If the gateway is not reached at all, the connection-refused guide isolates that stage with curl.

Wget status 5 — Untrusted and mismatched destination certificates returned this status locally. Correct the hostname or trust chain. An approved PROXY_CA_BUNDLE supplies a CA file to this example; certificate verification stays enabled.

Wget status 8 — Destination 403, 407 and 429 responses inside an established HTTPS tunnel returned this status, as did a refused redirect. Respect access restrictions and retry guidance. A destination 407 is distinct from a gateway rejecting CONNECT.

What the local tests established

On 1 October 2026, the example ran against local HTTP and HTTPS origins through an authenticated fixture proxy. Checks covered punctuation, routing overrides, rejected tunnels, certificate rejection, destination errors, redirects, malformed echo responses, oversized bodies and timeouts. The HTTPS origin received no proxy credentials, and handled exits removed the private configuration and closed the connection.

These checks establish the named client behaviour, without measuring live pool performance. Wget does not rotate addresses itself: choose gateway rotation or a sticky session in the username, as explained in the session guide. Before scaling, define permitted destinations, finite retries and a measured traffic budget.

Use Wget for authorised research, monitoring and QA that follows destination rules and the acceptable-use policy.

In our fictional example, the item price rises from EUR 24 to EUR 25. Delivery falls from EUR 4 to an explicitly stated EUR 0, so the delivered total falls from EUR 28 to EUR 25. Keep the product, variant, quantity, seller, delivery destination and tax treatment comparable. Missing delivery is unknown; it is not free.

A second fictional observation returns USD when the acceptance rule requires EUR. Keep that attempt with its rejection reason, but do not store it as a new comparable price. Its traffic still belongs in your measured sample.

Estimate from the whole sample

The walkthrough uses a separate, invented workload sample: 10,800,000 transferred bytes and 120 accepted observations. These are teaching inputs, not results from the three offers above or from a retailer test.

That gives 90,000 bytes per accepted observation. A schedule of 1,000 products across two markets, checked four times daily for 30 days, contains 240,000 planned observations:

• 240,000 × 90,000 bytes = 21.6 GB.
• Adding a chosen 20% allowance gives 25.92 GB.

Here, 1 GB means 1,000,000,000 bytes. Failed attempts and retries belong in the sample total once. The allowance is a planning choice, not a guarantee or a bill. Measure a permitted sample with your intended collection method and reconcile your counter with settled provider usage before buying for a larger run.

Explore the four-scene walkthrough.

Open the traffic planner with your own measurements.

For the complete local Python offer-validation fixture, see our existing article, Competitor price monitoring with Python.

Disclosure: Prepared for Portproof, which sells shared mobile and residential proxy traffic by the GB. Your software handles collection, product matching and alerts. All prices and workload inputs in this walkthrough are fictional; no retailer or proxy service was tested. AI assisted the preparation and technical review.

A price monitor can fetch a page successfully and still record the wrong price. It may have received a different pack size, another seller's offer, an unavailable item or a cookie-preference page. HTTP 200 describes successful HTTP processing; your collector must decide whether the response contains a comparable offer.

Start with that decision before choosing a browser, proxy route or collection schedule.

Define what counts as the same offer

For each monitored product, specify the SKU, variant, pack quantity, seller, currency, delivery destination and tax treatment. Decide how promotions and membership conditions affect eligibility. A headline price for a smaller pack or a members-only discount should not silently replace an ordinary offer.

In this example, an accepted offer must describe fictional SKU EXAMPLE-500, orange variant, a 500 ml pack, seller fictional-test-shop, EUR currency, destination TEST-POSTCODE, tax included and InStock availability. Both item price and shipping must be present. The comparable value is their sum.

This is a deliberately small normalised JSON format. It does not extract prices from arbitrary retail HTML. A real implementation still needs permission to use its source, a parser for that source and explicit rules for its offer conditions.

Test plausible failures locally

Copy the complete local fixture at the end of this article into local_price_observation_fixture.py. It runs with Python 3.9 or later and only the standard library:

python3 local_price_observation_fixture.py

It opens a temporary HTTP listener on 127.0.0.1, makes one request per case and closes the listener. Inherited proxy settings are explicitly disabled. It uses no browser, external shop, account or credential, and performs no retries.

The recorded run on 5 October 2026 produced:

Nine responses return HTTP 200. Only two satisfy the offer requirements. These cases were selected to exercise failures; their proportion is not a real-shop success rate.

Treat missing amounts as missing

The validator checks status, content type, document shape, offer identity and stock before calculating a total. For this EUR example, amounts must be non-negative strings with exactly two fractional digits and at most ten whole-number digits. Other currencies require their own rules.

This excerpt is the fixture's amount parser, not the complete validator:

import re
from decimal import Decimal

def amount(value):
    if not isinstance(value, str) or not re.fullmatch(
        r"(?:0|[1-9][0-9]{0,9})\.[0-9]{2}", value
    ):
        raise ValueError("missing-or-invalid-amount")
    result = Decimal(value)
    if not result.is_finite() or result < 0:
        raise ValueError("missing-or-invalid-amount")
    return result

An explicit shipping value of "0.00" is accepted. Missing shipping is rejected rather than treated as free delivery. Boolean values, negative amounts and non-finite or exponent-formatted values are rejected. Python's decimal arithmetic preserves decimal values without binary floating-point rounding in this calculation.

That distinction changes the result:

The item price rose by €1, while the comparable delivered total fell by €3. Keep the components as well as the total so an alert can explain why it changed.

Use a browser when the source requires it

An authorised feed or HTTP response may already contain the necessary fields. If a permitted source renders them through JavaScript, use a browser and validate its extracted data with the same acceptance rules. The Puppeteer proxy setup guide covers routing and a bounded connection check separately.

domcontentloaded does not establish that a delayed offer is ready. Wait for the required source-specific state with a time limit, then check identity and values. Preserve cookies and market settings deliberately. A browser context, a provider's sticky session and an HTTP connection are different things; changing a route does not reset storefront cookies or guarantee a new connection for every request.

Keep proxy credentials restricted to recognised proxy authentication challenges. Do not let an arbitrary shop's authentication challenge receive them. The Python measurement above exercises none of this browser behaviour.

Budget for accepted observations

The fixture reads 1,718 response-body bytes across all eleven cases. Dividing by two accepted offers gives 859 body bytes per accepted offer. Counting only the two valid responses would discard the cost of rejected attempts.

Those local body bytes exclude headers, TLS, browser subresources and provider metering. They are not a usable real-shop bandwidth forecast. Run a separate permitted sample using the intended collection method, count failed and retried traffic too, and reconcile the counter with the provider's usage meter. Put that sample into the price-monitoring traffic calculator, keeping different markets or workflows separate when their costs differ.

Bound simultaneous tasks, response sizes and request durations. Record HTTP 429 instructions; the fixture's Retry-After: 60 is recorded without retrying. The 429 specification describes rate limiting and possible retry instructions. Stop refused requests and investigate permissions rather than changing routes to repeat them.

Choose a route after establishing source permission, market requirements and session lifetime. The price-monitoring use case explains HTTP versus browser workflows and shared mobile versus residential pools. A route choice cannot certify the resulting currency, delivery context or offer.

Store the source URL, collection time, extraction version and comparison context with every accepted observation. Keep rejected attempts with a reason and no invented price. Then alerts and cost estimates can use the same definition of a valid observation.

Complete local fixture

Save this entire block as local_price_observation_fixture.py, then run the command above. The script needs permission to open a temporary listener on 127.0.0.1. It makes no external shop requests, requires no proxy credentials, and disables inherited proxy settings for its local requests.

#!/usr/bin/env python3
"""Synthetic local observations: no live proxy, shop, credentials or retry."""
import copy
import json
import re
import threading
from decimal import Decimal, InvalidOperation
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.error import HTTPError
from urllib.request import ProxyHandler, build_opener

BASE = {"sku": "EXAMPLE-500", "variant": "orange", "pack_ml": 500,
        "currency": "EUR", "seller": "fictional-test-shop",
        "destination": "TEST-POSTCODE", "tax": "included",
        "availability": "InStock", "price": "24.00", "shipping": "4.00"}
CASES = []
def case(name, changes, status=200):
    offer = copy.deepcopy(BASE)
    offer.update(changes)
    CASES.append((name, status, json.dumps(offer, separators=(",", ":")).encode()))
case("valid-first", {})
case("valid-next", {"price": "25.00", "shipping": "0.00"})
case("wrong-sku", {"sku": "EXAMPLE-999"})
case("wrong-variant", {"variant": "apple"})
case("wrong-currency", {"currency": "USD"})
case("missing-price", {"price": None})
case("missing-shipping", {"shipping": None})
case("missing-stock", {"availability": None})
CASES.append(("consent-page", 200, b"<html>Choose your cookie preferences</html>"))
CASES.append(("rate-limit", 429, b"slow down"))
CASES.append(("refusal", 403, b"not permitted"))

class Fixture(BaseHTTPRequestHandler):
    def do_GET(self):
        name = self.path.removeprefix("/")
        chosen = next((row for row in CASES if row[0] == name), None)
        if chosen is None:
            self.send_error(404)
            return
        _, status, body = chosen
        self.send_response(status)
        self.send_header("Content-Type", "text/html" if name == "consent-page" else "application/json")
        self.send_header("Content-Length", str(len(body)))
        if status == 429:
            self.send_header("Retry-After", "60")
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *args):
        pass

def amount(value):
    if not isinstance(value, str) or not re.fullmatch(r"(?:0|[1-9][0-9]{0,9})\.[0-9]{2}", value):
        raise ValueError("missing-or-invalid-amount")
    result = Decimal(value)
    if not result.is_finite() or result < 0:
        raise ValueError("missing-or-invalid-amount")
    return result

def validate(status, content_type, body):
    if status != 200:
        return None, "http-" + str(status)
    if content_type != "application/json":
        return None, "unexpected-content-type"
    try:
        row = json.loads(body)
        if not isinstance(row, dict):
            return None, "unexpected-document"
        for key in ("sku", "variant", "pack_ml", "currency", "seller", "destination", "tax"):
            if row.get(key) != BASE[key]:
                return None, "mismatch-" + key
        if row.get("availability") != "InStock":
            return None, "missing-or-unavailable-stock"
        total = amount(row.get("price")) + amount(row.get("shipping"))
        return str(total), None
    except (ValueError, InvalidOperation, TypeError):
        return None, "missing-or-invalid-amount"

def main():
    rows = []
    # ProxyHandler({}) avoids inherited proxy settings for this loopback-only fixture.
    opener = build_opener(ProxyHandler({}))
    with HTTPServer(("127.0.0.1", 0), Fixture) as server:
        worker = threading.Thread(target=server.serve_forever, daemon=True)
        worker.start()
        try:
            for name, _, _ in CASES:
                target = "http://127.0.0.1:" + str(server.server_port) + "/" + name
                try:
                    response = opener.open(target, timeout=2)
                except HTTPError as error:
                    response = error
                with response:
                    body = response.read(4097)
                    if len(body) > 4096:
                        raise RuntimeError("fixture body exceeded bound")
                    status = response.status
                    total, reason = validate(status, response.headers.get_content_type(), body)
                    rows.append({"case": name, "status": status, "body_bytes": len(body),
                                 "valid": reason is None, "delivered_total": total, "reason": reason,
                                 "retry_after": response.headers.get("Retry-After")})
        finally:
            server.shutdown()
            worker.join(timeout=3)
    valid = sum(row["valid"] for row in rows)
    body_bytes = sum(row["body_bytes"] for row in rows)
    summary = {"scope": "synthetic loopback fixture; response body bytes only, not billed traffic",
               "requests": len(rows), "http_200": sum(row["status"] == 200 for row in rows),
               "valid_observations": valid, "response_body_bytes": body_bytes,
               "body_bytes_per_valid_observation": body_bytes / valid,
               "rows": rows}
    assert (summary["requests"], summary["http_200"], valid) == (11, 9, 2)
    assert [row["delivered_total"] for row in rows[:2]] == ["28.00", "25.00"]
    assert rows[9]["retry_after"] == "60"
    print(json.dumps(summary, indent=2))

if __name__ == "__main__":
    main()

A small HTTPS request can succeed through a proxy while a larger download fails. Reporting only the successful check hides the question you were trying to answer: did the intended transfer finish?

Keep four observations together: the proxy's CONNECT response, the destination's HTTP response, the bytes actually received and the elapsed time. The curl exit code adds a fifth check, because an HTTP response can arrive before a transfer fails.

Here is a method for one bounded download. It keeps certificate verification enabled, sends credentials through an in-memory pipe and deletes the downloaded test data afterwards.

A 200 MB sample and a refusal

On 3 October 2026, a Portproof test recorded the following outcomes. The larger request asked for bytes 0-199999999: 200,000,000 bytes, or 200 decimal MB, approximately 190.7 MiB.

The first destination refused the request after the tunnel was established. The test recorded that failure, then a separate request to another endpoint completed the requested range. Neither request used automatic retries. Both discarded the test data afterwards.

The completed transfer is one observation on one route at one time. It establishes that this sample finished. It does not establish country, a typical transfer time or future availability. An accompanying small connection check reported country_verified: false; no exit address is published here.

Choose a destination you control

Use an HTTPS test file on an origin you own or have permission to test. Make it at least 200,000,000 bytes long and configure the origin to serve byte ranges. Avoid signed URLs or URLs containing credentials when sharing a report.

The endpoint needs to return 206 Partial Content for the requested range. If it ignores the range, redirects or returns less data, this script reports an incomplete sample. Confirm the file and range behaviour on your origin before using a metered proxy connection.

The size limit is a limit on the download body, not a bill estimate. Protocol overhead, connection checks and failed attempts may also consume traffic. Leave appropriate headroom in your account. You can start with a smaller authorised sample by changing MAX_BYTES; record the change beside the result.

Run one request, with hidden credentials

You need Python 3.9 or later and curl 8.4.0 or later on macOS or Linux. Check python3 --version and curl --version first. The recorded local checks of the earlier wrapper revision used Python 3.9.6 and curl 8.7.1. It uses only Python's standard library.

Save this as measure-proxy.py. It prompts for the HTTP proxy URL and your HTTPS test-file URL, then asks for the username and password separately with echo disabled. Keep credentials outside both URLs.

#!/usr/bin/env python3
"""One bounded HTTPS download; credentials go to curl through an in-memory pipe."""
import base64
import datetime
import getpass
import json
import os
import re
import shutil
import subprocess
import tempfile
import warnings
from pathlib import Path
from urllib.parse import urlsplit

MAX_BYTES = 200_000_000  # Decimal MB: 200 MB, approximately 190.7 MiB.


def checked_url(value, scheme):
    if any(ord(char) < 33 or ord(char) > 126 for char in value):
        raise ValueError("Use a URL without spaces or control characters.")
    parsed = urlsplit(value)
    if (parsed.scheme != scheme or not parsed.hostname or parsed.username is not None
            or parsed.password is not None or parsed.fragment):
        raise ValueError("Use the required scheme and keep credentials outside URLs.")
    if scheme == "http" and (not parsed.port or parsed.path not in ("", "/") or parsed.query):
        raise ValueError("The proxy must be an HTTP host and explicit port.")
    return value


def config_value(value):
    return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'


def measure(proxy, username, password, target, max_bytes=MAX_BYTES, test_ca=None):
    proxy = checked_url(proxy, "http")
    target = checked_url(target, "https")
    if (not username or not password or ":" in username
            or any(ord(char) < 32 or ord(char) == 127 for char in username + password)):
        raise ValueError("Supply valid separate proxy credentials.")
    curl = shutil.which("curl")
    if not curl:
        raise ValueError("Install curl 8.4.0 or newer.")
    version = subprocess.run([curl, "--disable", "--version"], check=True,
                             capture_output=True, text=True, timeout=5).stdout
    match = re.search(r"curl (\d+)\.(\d+)\.(\d+)", version)
    if not match or tuple(map(int, match.groups())) < (8, 4, 0):
        raise ValueError("curl 8.4.0 or newer is required for the transfer size limit.")
    basic = base64.b64encode((username + ":" + password).encode()).decode()
    config = "\n".join([
        "proxy = " + config_value(proxy),
        'proxy-header = "Proxy-Authorization: Basic ' + basic + '"',
        "url = " + config_value(target), "",
    ])
    started = datetime.datetime.now(datetime.timezone.utc).isoformat()
    with tempfile.TemporaryDirectory(prefix="proxy-sample-") as directory:
        body = Path(directory) / "body.bin"
        command = [curl, "--disable", "--globoff", "--config", "-", "--silent", "--fail",
                   "--noproxy", "", "--proto", "=https", "--retry", "0",
                   "--connect-timeout", "5", "--max-time", "60",
                   "--range", "0-" + str(max_bytes - 1),
                   "--max-filesize", str(max_bytes), "--output", str(body),
                   "--write-out", "%{http_connect} %{response_code} %{size_download} %{time_total} %{ssl_verify_result}"]
        if test_ca is not None:  # Used only by the loopback verification fixture.
            command.extend(["--cacert", str(test_ca)])
        completed = subprocess.run(command, input=config, capture_output=True, text=True,
                                   timeout=65, env={"PATH": os.environ.get("PATH", "")})
        fields = completed.stdout.strip().split()
        if len(fields) != 5:
            raise ValueError("curl did not return the expected diagnostic fields.")
        connect, status, downloaded, seconds, verified = fields
        file_bytes = body.stat().st_size if body.exists() else 0
        report = {"started_at_utc": started, "curl_exit": completed.returncode,
                  "connect_status": int(connect), "target_status": int(status),
                  "download_bytes": int(float(downloaded)), "file_bytes": file_bytes,
                  "total_seconds": float(seconds), "tls_verify_result": int(verified)}
        report["completed_sample"] = (completed.returncode == 0 and connect == "200"
            and status == "206" and verified == "0" and report["download_bytes"] == max_bytes
            and file_bytes == max_bytes)
    return report  # The temporary body is deleted before the caller receives this.


def main():
    proxy = input("HTTP proxy URL, without credentials: ").strip()
    target = input("Your authorised HTTPS test-file URL: ").strip()
    with warnings.catch_warnings():
        warnings.simplefilter("error", getpass.GetPassWarning)
        username = getpass.getpass("Proxy username (hidden): ")
        password = getpass.getpass("Proxy password (hidden): ")
    report = measure(proxy, username, password, target)
    print(json.dumps(report, indent=2))
    raise SystemExit(0 if report["completed_sample"] else 1)


if __name__ == "__main__":
    try:
        main()
    except (ValueError, OSError, subprocess.SubprocessError, getpass.GetPassWarning):
        raise SystemExit("Test stopped. Check configuration and tool versions; no automatic retry.")

Run it in an interactive terminal:

python3 measure-proxy.py

For the proxy URL, use the connection host and HTTP port from your account, for example http://proxy.example.com:8080. For the target, use your own HTTPS file URL. These are configuration values, not a claim that the example host exists.

The credential-derived Basic header is supplied with curl's proxy-header option through --config -. It is addressed to the proxy, rather than inserted into a destination header or command argument. The configuration is never written to a file. The payload is held briefly in a temporary directory so its file size can be checked independently, then removed. A privileged local process could still inspect process memory; do not run this on a shared machine you do not trust.

This example uses an HTTP proxy endpoint: gateway authentication happens before TLS to the destination. Destination HTTPS does not encrypt that earlier exchange. Use the intended gateway over a trusted connection; this wrapper does not implement or test an HTTPS proxy endpoint.

The script ignores curl's default configuration, chooses the proxy explicitly and clears NO_PROXY exclusions for this request. URL globbing is disabled with --globoff, so braces and brackets in the supplied target cannot expand into multiple downloads. There are no redirects or retries. Connection establishment has a five-second limit, and the full curl operation has a sixty-second limit. TLS uses curl's normal trust store. The optional test_ca function parameter belongs to the local verification harness, which creates its own certificate; the interactive command does not use it.

Interpret the whole report

completed_sample: true requires all of these: curl exits successfully, CONNECT is 200, the destination returns 206, TLS verification succeeds, and both the transferred byte count and temporary file size match the requested size. A shorter successful response remains an incomplete sample.

If completed_sample is false, retain the report and inspect the failing stage before choosing another request. Exit 1 from the Python script means the sample did not satisfy those checks; curl_exit is the underlying curl result.

The CONNECT response code and the destination response code describe different stages. A zero destination status means curl received no destination HTTP response; it is not an HTTP status sent by the server.

Do not read TLS result 0 in isolation. In the refused-tunnel cases, TLS to the destination never began, so that field alone cannot establish a verified HTTPS exchange. Keep certificate verification enabled while investigating.

Check the interpretation locally

Five earlier loopback checks used an authenticated test proxy and a temporary HTTPS origin. All listeners were local, credentials were synthetic and the proxy accepted only its own test origin. No live gateway or browser was involved.

These values were measured with curl 8.7.1. The fixture did not use --fail, so its destination 403 still had exit 0. The download wrapper does use --fail, so its destination 403 has exit 22. Recording the options resolves the apparent disagreement. Other curl versions can report different tunnel-failure exit codes.

The earlier wrapper revision passed seven loopback checks: a complete range, destination refusal, two tunnel refusals, an untrusted certificate, an oversized body and a short body. Those checks used a 4,096-byte bound. They confirm the wrapper's reporting and credential routing; they do not repeat the live 200 MB measurement.

Keep a useful record

Save the emitted JSON together with your Python/curl versions, UTC date, requested byte range and an ordinary description of the authorised target. Keep usernames, passwords, Basic headers, signed URLs and exit addresses out of a public report.

For a shorter diagnostic, the curl proxy guide shows a single-request check. The CONNECT troubleshooting guide helps interpret tunnel failures. Once you have a representative sample, the bandwidth calculator turns your measured bytes into workload estimates; it does not measure success rates for you.

The curl options are documented in the official manual. The important habit is to preserve a failed request alongside a successful one and label the scope of each observation.

Prepared and technically reviewed with AI assistance for Portproof. The measured results are from the specific runs described above; the tests and their limits are stated explicitly. No client or destination performance guarantee follows from them.