Skip to content
nyxtrace.docs

Address classes

Every address that appears on a flow, a graph node or a device detail carries a class. The class answers one question the product used to get wrong: what kind of address is this?

Why this exists

Section titled “Why this exists”

An earlier version used a single test everywhere: an endpoint was an inventory device if the inventory knew its address, and everything else was declared an external endpoint. The inventory is only ever populated for addresses inside a configured VLAN, so the limited broadcast address, every multicast group, every link-local address and every private address in an unconfigured VLAN became a foreign peer. It was handed to GeoIP, which had no country for it, and it appeared on the globe, in the country list, in the external-destination list, in the device detail’s peer list and in search. The detectors saw the same addresses as destinations and could report new external destination 239.255.255.250 for a television waking up.

The report that triggered the change was an operator seeing 255.255.255.255 — External endpoint — Geo unknown — 1.1 KiB in the situation view.

The classes

Section titled “The classes”

The classification is pure and deterministic: it depends only on the address and on the site’s configured VLAN prefixes, nothing else.

Class Meaning
internal Inside one of the site’s configured VLAN ranges.
private_unmapped RFC 1918, unique local fc00::/7 or carrier-grade NAT 100.64.0.0/10, not covered by any configured VLAN. Local infrastructure the site has not described — never an internet peer.
broadcast 255.255.255.255, or the all-ones host address of a configured IPv4 VLAN prefix.
multicast 224.0.0.0/4 and ff00::/8.
link_local 169.254.0.0/16 and fe80::/10.
loopback 127.0.0.0/8 and ::1.
unspecified 0.0.0.0 and ::.
reserved 240.0.0.0/4, 0.0.0.0/8, 192.0.0.0/24, 100::/64, 2001:20::/28.
documentation 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32.
external A routable address elsewhere on the internet.
unknown The value did not parse as an address. Deliberately not external: an unparseable value must not become a country on the globe.

The RFC 2544 benchmark range 198.18.0.0/15 is deliberately not reserved. A benchmark address in real traffic is a misconfiguration an operator should see, not one the product should hide.

The order of the tests is the meaning of the result. Unspecified, loopback, broadcast, multicast and link-local are decided before the site lookup, because the subnet broadcast of a configured VLAN is inside that VLAN and must not come back as a device address. The site lookup comes next, so an operator who configures documentation space as their own VLAN gets internal rather than documentation.

Sub-labels

Section titled “Sub-labels”

A well-known group address additionally carries a label naming the local service behind it, so a summarised row can say what the traffic is instead of showing a bare group address:

Label Addresses
mdns 224.0.0.251, ff02::fb
ssdp 239.255.255.250, ff02::c, ff05::c
llmnr 224.0.0.252, ff02::1:3
igmp 224.0.0.1, 224.0.0.2, 224.0.0.22, ff02::1, ff02::2, ff02::16
ospf 224.0.0.5, 224.0.0.6, ff02::5, ff02::6
vrrp 224.0.0.18, ff02::12
ntp 224.0.1.1
broadcast 255.255.255.255 and the subnet broadcast of a configured VLAN

Why broadcast and multicast are never “external”

Section titled “Why broadcast and multicast are never “external””

A broadcast, a multicast group and a link-local address are not destinations anybody talked to. They are how a device announces itself — a DHCP renewal, an mDNS query, an SSDP discovery — and a page that ranks them next to a real CDN is wrong about what it is showing. GeoIP has no country for them, and the honest answer is not unknown country but not a place at all.

Three predicates carry that policy, so no view re-derives it:

  • External is the single gate for the globe, the country list, the arc groups, the external-endpoint list, the destinations page and the GeoIP lookup. The databases are never even opened for anything else.
  • Local noise is broadcast, multicast and link_local. It is summarised on the device detail and hidden from the network map unless you ask for it.
  • Routable destination additionally excludes loopback, unspecified and unknown. It gates the destination-shaped detectors.

What you see

Section titled “What you see”

Network map. Local broadcast, multicast and link-local groups are drawn as one grouped node per class rather than as peers, and they are hidden by default. The Show local noise switch in the layer card of the network map shows them, with the number of hidden nodes in brackets. The globe never shows them.

Device detail. Instead of listing each group address as a destination, the device detail collapses them into one line under the destination panel: Local broadcast/multicast traffic: 1.1 KiB (mdns, ssdp) — the volume with the protocols in brackets, or the classes when no protocol is known. The volume stays visible, the peer list stays truthful. Private, reserved and documentation counterparts are a separate case: they are real counterparts, just not on the internet, so the panel names how many there are and leaves them to the flow list.

Detectors. The beaconing and scan detectors drop a non-routable destination before grouping, and the rarity detector’s destination features do the same. Feature kinds that are not addresses — domain, JA4, user agent — pass through untouched. A device sending five evenly spaced packets to five ports of the mDNS group is neither a beacon nor a scan nor a first sighting. See detection models.

API fields

Section titled “API fields”

The class is on the wire, additively, in three places:

  • A graph node carries address_class and address_label (nullable). Its kind — local_broadcast, local_multicast, link_local, internal_endpoint, private_endpoint, reserved_endpoint or external_endpoint — is derived from the class and is a rendering hint; the class is the authority. external is true exactly when address_class is external. country_code, asn, asn_name, latitude and longitude are null for every other class.
  • A flow’s src and dst carry the same two fields, and geo is null unless dst.address_class is external.
  • The device detail’s top_destinations rows carry address_class, and the broadcast, multicast and link-local counterparts of the window are collapsed into one local_noise object — bytes, peer_count, address_classes, protocols, first_seen — which is null when the window held none. Its protocols omit broadcast, because a subnet broadcast has no protocol of its own.

A client must show only external endpoints on the globe, in the country list, in the arc groups, in the external-endpoint list and in the top-destination list. See the endpoint reference.