When you see a disconnect mid-trade, the first question is whether it happened on the VPS or somewhere between you and the VPS. Our diagnostic tool answers that for you in about 30 seconds.
Run the tool
#1. Download QuantVPS-NetworkDiagnostic.zip on your VPS.
#2. Double-click the zip → And then Double-click the QuantVPS-NetworkDiagnostic
#3. The scan runs, then two windows open automatically:
Your browser, showing the HTML report (verdict + table of events).
Event Viewer, pre-navigated to Custom Views → QuantVPS Network Issues so you can browse the live event log.
Don't click anywhere else for the first few seconds, the script needs focus to navigate Event Viewer to the right view. If something steals focus, you'll just see Event Viewer at its default state; just click Custom Views → QuantVPS Network Issues in the left pane manually.
The tool scans the last 2 weeks of Windows event logs and writes the report to your Desktop. The custom view it installs is permanent, so you can browse network events any time without re-running the tool. No internet access required, nothing uploaded.
Reading the report
The report opens with a colored verdict at the top:
Verdict | What it means | What to do |
No network events detected (green) | The VPS held its connection through the scan window. | The drop happened on your local internet, your broker's data feed, or your trading platform. |
N network events detected (amber) | Medium-severity events were logged. | Check whether the timestamps line up with your broker's disconnect log. Send both to support if they do. |
N critical network events detected (red) | The VPS logged a critical network event (NIC drop, IP conflict, etc.). | Open a support ticket — we can fix this. |
Below the verdict the report shows an info panel pointing you back to the live Event Viewer custom view, then a stats row, then a table of every matching event with timestamp, severity, source, and the original message.
Match it against your broker
The report alone tells you what the VPS logged. To know whether a specific drop you saw was VPS-related, line up timestamps from three sources:
The exact time you saw the drop — screenshot it or note it down before you do anything else.
Your broker's disconnect log — NinjaTrader, Tradovate, Rithmic, IBKR, TradingView and most others timestamp session drops.
The Event Viewer report from the tool.
Then:
Broker drop + report shows an event at the same time → VPS-side. We can fix this.
Broker drop + empty report → the VPS held; the drop was upstream (your local internet, ISP, or the broker).
No broker drop + report shows events → brief blip the broker session survived. Usually nothing to act on.
Contact support
Open a ticket and attach:
The HTML report (
QuantVPS-NetworkDiagnostic-YYYY-MM-DD_HHMM.htmlfrom your Desktop).A screenshot or log entry from your broker showing the disconnect, with a clear timestamp.
The exact time(s) you saw the issue, in the same time zone as the report (e.g. "1:42 PM ET on May 3").
The report shows what the VPS logged; your broker's log shows what the trading session experienced. Together they let us pinpoint whether the disconnect was VPS-side, network-path-side, or broker-side — and we can act on the first two.
If the report is empty but you're sure a disconnect happened, the issue is almost certainly your local internet. Try restarting your router or switching to a mobile hotspot to confirm before sending us a ticket.
Scanning a different time window
The tool defaults to the last 2 weeks, which covers almost every case. To use a different window, open Command Prompt as administrator in the folder where you saved the file and run:
QuantVPS-NetworkDiagnostic.bat -HoursBack 720
Common values: 24 = last day, 168 = last week, 336 = last 2 weeks (default), 720 = last 30 days.
Event ID reference
For anyone who wants to investigate specific events directly in Event Viewer, here's what the tool scans for:
Event ID(s) | Log | Source | What it tells you |
27 | System | NIC driver / | Network link disconnected. Highest-signal event for VPS disconnects. |
10000 / 10001 | Microsoft-Windows-NetworkProfile/Operational | NetworkProfile | Network connected / disconnected. |
4199 | System | Tcpip | IP address conflict — another machine claimed your address. |
1014 | System | DNS Client | DNS resolution timeout. Often DNS-only, not a full disconnect. |
55 | Microsoft-Windows-UniversalTelemetryClient/Operational | UTC | "Is the Internet available: true/false." Connectivity status check. |
4960–4965 | Security | IPsec Driver auditing | IPsec dropped inbound packet (integrity / replay / sequence). |
5453 | Security | Microsoft-Windows-Security-Auditing | IPsec/IKE service not started; negotiation failed. |
5024–5039 | Security | Windows Firewall auditing | Firewall service start, policy retrieval / parse failures. |
5827 / 5828 | System | Netlogon | Vulnerable secure-channel connection denied (CVE-2020-1472). |
6273 / 6274 | Security | Microsoft-Windows-Security-Auditing | NPS denied / discarded access (RADIUS, VPN, 802.1x). |
6145 | Security | Microsoft-Windows-Security-Auditing | Errors processing Group Policy security settings. |
1030 / 1053 / 1054 / 1058 | Application | Userenv / Group Policy | Group Policy processing failures (often domain-controller reachability). |
2021 / 2022 | System | Srv | Server unable to find a free connection / work item — load or resource exhaustion. |
A few worth knowing:
Event ID 27 from a NIC driver source (e.g.
e1iexpress,e2fnexpress) is the single highest-signal event for a VPS disconnect.Event ID 10000 in NetworkProfile/Operational means "Network connected" — it's not a DCOM error.
5827 / 5828 are written to the System log, not Security.
1030 / 1053 / 1054 / 1058 are written to the Application log, not the System log.