Data sources

Nyxtrace sees exactly what its sources give it. This page is the honest map of that: what each source contributes, and what it structurally cannot see. The system view shows the same limits at runtime, per sensor, with a freshness figure.

The sources

Source	Delivers	Trust	Sees
Firewall NetFlow / IPFIX	Flow records with byte and packet counters	exporter	All routed traffic, per selected interface
Firewall Suricata (EVE)	Signature alerts, protocol events, DHCP events	firewall_app	The firewall’s application view of routed sessions
Recursive resolver query log	DNS questions and answers	firewall_app	Every name your clients resolve through it
Hypervisor mirror + Zeek	Packet-level session metadata	packet	Traffic inside a mirrored segment, including intra-VLAN
Connectors	Device facts, names, controller state	inventory	Whatever the foreign system knows

Each source is registered separately, with its own token, its own tenant, its own allowed record kinds and its own trust class. Two firewall nodes are two sensors, not one — their observations stay separate rather than being summed.

What each source cannot see

NetFlow cannot see intra-VLAN traffic. A flow record exists because a packet was routed. Two devices in the same VLAN talking to each other never reach the router, so they never appear. NetFlow counters are also unidirectional per record, and the exporter’s own direction is preserved rather than guessed at.

Suricata on the firewall only sees what the firewall forwards. Same blind spot as NetFlow, plus: in passive IDS mode it reports, it does not block. Nothing in Nyxtrace asks it to.

A resolver query log only sees resolution through that resolver. A device using a hardcoded public resolver, or DNS-over-HTTPS, resolves invisibly. You will still see the resulting flow — you just will not get a name for the destination.

A hypervisor mirror only sees traffic on that hypervisor. Physical devices talking to each other on a switch, other hosts, and any VM you did not select are outside it.

Every source is blind to what is off the wire. Encrypted payloads stay encrypted. Nyxtrace reads names, certificate fingerprints, sizes and timings.

The one thing coverage cannot fix

Physical intra-VLAN traffic that crosses neither a monitored hypervisor nor a firewall is invisible, full stop. There is no software setting that changes that; it needs a mirror or a tap at the switch. Nyxtrace’s job here is to make the gap visible rather than to pretend the picture is complete, which is why capture loss and per-source freshness are first-class health values.

Direction and duplication

The same routed exchange between two devices on a mirrored host can legitimately appear on both sides of the router, as two distinct segment observations. Those are not duplicate packets, and Nyxtrace does not treat them as one: correlation joins them into one canonical flow, takes counters from a single preferred observation, and keeps the rest as evidence.

Ingest boundary

All sources funnel through Vector, which is transport only, and post to the Go core’s internal listener on loopback:

• Parse failures are quarantined locally, not dropped.
• Individual malformed records are recorded in a durable ledger with a reason and the original line, while their valid siblings continue.
• The whole batch is still acknowledged, so the transport does not loop or discard a buffer over one bad line.
• Retryable failures block rather than drop, as long as the disk buffer has room.

The counts show up in health as unparsed_last_5m and rejected_last_5m. A nonzero, steady rejected count is a configuration problem to fix, not noise to tune out. See the ingest API for the record shapes.