Requirements
Appliance
Section titled “Appliance”Nyxtrace is one machine — physical or a VM. The reference profile below is what a few hundred devices and a mirrored server VLAN need comfortably; Zeek is the part that wants cores, and ClickHouse is the part that wants disk.
| Resource | Minimum | Reference profile |
|---|---|---|
| CPU | 8 cores | 16 cores |
| RAM | 16 GiB | 32 GiB (ballooning off if virtualised) |
| Disk | 250 GiB | 500 GiB |
| Management NIC | 1, with an address | 1 |
| Capture NIC | optional | 1 passive interface, no address, MTU 9000 |
The capture NIC is only needed if you mirror traffic to the appliance. Firewall NetFlow, Suricata EVE and resolver query logs arrive over the management interface, so an appliance without a capture NIC is a valid, useful installation — it just cannot see intra-VLAN traffic.
If the appliance is a VM, do not overcommit its CPU. Zeek dropping frames is a silent loss of evidence, and the only thing that tells you is the capture-loss figure in health.
Operating system
Section titled “Operating system”Debian 13, installed fresh, with systemd-networkd active.
The installer refuses to apply if the capture NIC is managed by NetworkManager,
because it renames that interface by MAC through a systemd.link unit and
configures it with no addressing and no ARP. That rename needs a reboot to take
effect, and the installer will tell you so rather than restarting your network
manager behind your back.
Nyxtrace installs and pins its own versions of ClickHouse, Grafana, Zeek, the NetFlow collector and Vector. It does not use whatever happens to be in the distribution.
Network access
Section titled “Network access”The appliance needs very little, and it should be given very little.
| Direction | What | Why |
|---|---|---|
| in | TCP, one port per firewall node | Suricata EVE and resolver query records, over syslog |
| in | UDP, one port per firewall node | NetFlow / IPFIX |
| in | TCP 3001, from your reverse proxy only | The web interface |
| out | HTTPS to your identity provider | OIDC discovery and login |
| out | HTTPS to your notification endpoint | Alerts, if configured |
| out | HTTPS to license.nyxtrace.com |
Instance registration, the daily heartbeat and the update notice — switchable off on Free |
| out | HTTPS to license.nyxtrace.com |
The Pro licence check and entitlement renewal — required on Pro, unused by the free core |
Blocking that last pair does not break the appliance: the free core runs with no outbound access at all, and a Pro installation keeps every module for 72 hours of grace before the paid parts go read-only while ingest and detection continue.
Everything else stays on loopback. The Go API, ClickHouse and Grafana are loopback-bound by default and are not reachable from the network at all; Grafana is administered through an SSH tunnel.
The web interface also binds to loopback by default. Making it reachable is a deliberate configuration step: you set the bind address and the list of source networks allowed to reach port 3001, and the appliance’s own firewall table admits that port from nothing else.
Identity provider
Section titled “Identity provider”Login is OIDC only. There are no local accounts and no password database in Nyxtrace.
You need an OIDC provider that can issue a confidential client, plus two groups mapped onto Nyxtrace roles — one for administrators and one per tenant. Any standards-compliant provider works; the appliance only needs the discovery document, a client ID and secret, and a callback URL.
Traffic sources
Section titled “Traffic sources”At least one of these, and realistically the first two:
- A firewall that can export NetFlow or IPFIX per interface, and can run Suricata in passive IDS mode. OPNsense and pfSense are the documented paths.
- A recursive resolver that can log queries, so DNS names attach to flows.
- A hypervisor or switch that can mirror traffic to the capture NIC, for packet-level visibility inside a VLAN.
GeoIP databases
Section titled “GeoIP databases”Geographic and ASN attribution needs a MaxMind-compatible City database and a
MaxMind-compatible ASN database, supplied by you. DB-IP Lite (CC-BY 4.0,
attribution required) and a licensed MaxMind account both work. Without them,
the product runs and the geo fields stay null — the globe simply does not
invent locations. See GeoIP.
What you also need, honestly
Section titled “What you also need, honestly”Two to four weeks of patience. The learning phase is not a formality. Until a device has a baseline, its model results are recorded and deliberately suppressed, and the incident list stays empty on purpose.
A backup target. Restoring a Nyxtrace appliance means restoring ClickHouse and the state database consistently. Backup and restore describes what a restore has to prove before you rely on it.