Devices

The device list is the inventory: everything Nyxtrace has ever seen on the network, with what it knows about each one.

The list

Filterable by free text, VLAN, device type, minimum risk score and last-seen time. Each row carries the display name with the source it came from (via NetBox, via hypervisor, via controller, via DHCP, via mDNS, via resolver, via DNS — see where a name comes from), the type, how that type was decided, the addresses, the VLANs, tags, first and last seen, the current score and the open incident count. A device the NetBox connector knows shows its NetBox role in a muted line under the name.

How the type was decided is shown, not hidden. A device type is either observed — with a confidence value — or human_confirmed, which means someone looked and said so. A confirmed classification has confidence 1 and is never overwritten by an automated judgement afterwards.

The device detail

The head of the page: name, addresses, MAC addresses, VLAN, type, owner, an optional link into your own inventory system, and the score with its history.

Below that:

Pattern of life. A week grid — hour of day by day of week — showing bytes or new destinations per cell. This is the single most useful view for a homelab: a camera that uploads at 03:00 every night looks like a pattern, and a camera that uploaded at 03:00 for the first time last night looks like a hole in one.

Peers. The internal devices this one talks to, with volumes.

Destinations. The external addresses and domains it reached, each with a first-seen timestamp — and a threat-intelligence marker if you have a list configured and it matched. Only addresses of class external are listed as destinations; a private, reserved or documentation counterpart is counted in a footnote and left to the flow list, and the device’s broadcast, multicast and link-local chatter is one line beneath the panel — Local broadcast/multicast traffic: 1.1 KiB (mdns, ssdp) — instead of a list of group addresses posing as destinations. See address classes.

Services, domains, fingerprints, user agents. Bounded aggregates from the typed source views, each with an observation count and a last-seen time. The raw payloads behind them are never returned through the browser API. A name in the Domains (DNS) panel that the network’s own resolver refused — through the Pi-hole or AdGuard Home connector — carries a muted blocked by resolver mark next to the threat-intelligence marker. It is the resolver’s verdict, not a finding.

Identity. The anchors that make up this device’s identity, with class, value, source, weight, first and last seen, how many separate days each was observed, and two markers: whether the address is a randomised privacy address, and whether the anchor class can only confirm an identity rather than establish one. Plus every merge event, with its rule, confidence, anchors and — if one happened — the split that reverted it. See device identity.

A confidence below 0.90 means the identity is derived rather than proven, and the interface says so rather than presenting it as fact.

When the NetBox connector knows one of the device’s addresses, a NetBox block in the same panel shows the record’s role, site, tenant, status and description, with a link to the object in NetBox.

When the Proxmox VE connector knows one of the device’s addresses, a Proxmox block follows: whether the guest is a virtual machine or a container, its name, the VMID, the node it runs on, its status, pool, tags, the operating system the guest agent reported, and the connector instance it was read through — with a link Open in Proxmox VE to the guest in the cluster’s own interface. A guest the cluster no longer reports is not shown after three full snapshots (72 h); the name it gave stays in the alias list as a former name. Several addresses are described by the first one the hypervisor knows.

When the DHCP leases connector holds a lease that still binds for one of the device’s addresses, a DHCP block follows it: the hostname the device asked for, the MAC, the vendor class (option 60) where the server kept it, the client identifier where there is one, Lease until as a relative and an absolute time — no end for an infinite lease — and the connector instance it was read through. An expired lease is not shown; the name it gave stays in the alias list as a former name. Several addresses are described by the freshest live lease.

Incidents. This device’s incident history, chronologically.

Editing a device

An analyst may set the display name, the device type, the owner and the tags. Doing so records the classification source as human_confirmed, sets confidence to 1, bumps the revision and appends to the workflow history.

Concurrent edits are caught rather than merged: a write carries the revision it was based on, and a conflicting write is rejected so you can re-read and decide, instead of one person’s change silently overwriting another’s.

Truncation is stated

The peer and destination detail walks a bounded number of flows. If it reaches that bound, the response says so with an explicit marker rather than presenting a partial list as complete. The typed aggregates stay server-side and complete.