The Waterfall Score guide: what's normal per phase
Lobe’s Waterfall Score grades a HAR capture by checking every request’s DNS, TCP, TLS, TTFB, and download time against a network-appropriate baseline — the same thresholds below, in milliseconds. Nothing hidden: this is the exact table the grader uses.
The thresholds, by network category
A request is flagged when a phase exceeds its category’s expected maximum. Loopback, LAN, and remote get different budgets because the network floor is different — a 40ms TLS handshake is unremarkable over the public internet and a real anomaly on localhost.
| Category | DNS | TCP | TLS | TTFB | Download | Total |
|---|---|---|---|---|---|---|
| loopback | ≤1ms | ≤2ms | ≤10ms | ≤50ms | ≤20ms | ≤80ms |
| LAN | ≤20ms | ≤10ms | ≤40ms | ≤100ms | ≤50ms | ≤200ms |
| remote | ≤100ms | ≤100ms | ≤200ms | ≤500ms | ≤500ms | ≤1500ms |
How the grade is calculated
The score is the percentage of requests in the capture with no phase over its baseline — a request that’s clean on DNS/TCP/TLS/TTFB/download counts, one flagged phase and it doesn’t. That percentage maps to a letter grade:
- A — 95–100% of requests clean
- B — 80–94%
- C — 60–79%
- D — 40–59%
- F — under 40%
Warm, reused connections skip the DNS/TCP/TLS checks entirely — those phases are ~0 by definition once a connection is already established, so judging them against a cold-connection baseline would produce false positives on multiplexed HTTP/2 traffic. Only TTFB and total time are judged on reused connections.
Category is classified per host, not per capture
localhost and 127.0.0.1 are loopback; private ranges (10.x, 192.168.x, 172.16–31.x) and .local hostnames are LAN; everything else is remote. A single HAR mixing first-party API calls with third-party scripts gets each host graded against its own category’s budget.
Run your own capture through it: getlobe.dev/waterfall — free, no account, nothing saved.