Skip to content
nyxtrace.docs

What is Nyxtrace

Nyxtrace is a passive Network Detection & Response system for homelabs and small networks. It reads metadata about the traffic on your network, stores the evidence, learns what each device normally does, and raises an incident when a device stops behaving like itself.

It runs as a single appliance you install and own: your network data stays on that machine, and there is no mandatory account.

Two things do talk to us, and both are stated up front rather than discovered later. Every installation registers itself and sends one small daily heartbeat — version, operating system, plan and bucketed counts, never addresses, names, flows or incident content — which the free plan can switch off with NDR_TELEMETRY=off; see instance registration and telemetry. And the Pro modules check their licence online against our licence server, which the free core never does; see licensing.

What it actually does

Section titled “What it actually does”

It watches metadata, not payloads. The sensors record who talked to whom, when, for how long, over which service, with which certificate fingerprint and which DNS name — not the contents of the conversation. That is deliberate: it keeps the data set small enough to retain for weeks and keeps the system usable on encrypted traffic, which is nearly all of it.

It keeps an inventory. Every device that appears on the network gets an identity with a first-seen and a last-seen timestamp, its addresses, its VLANs, the services it uses, the destinations it reaches, and a type. A device is not a MAC address and not an IP address; see device identity.

It learns a baseline per device. Bytes, flow counts and destination counts per hour-of-week, the destinations and domains a device has ever reached, the regularity of its periodic contacts, and how it compares with behaviourally similar devices. All of that is statistics running on your own hardware, not a model trained elsewhere.

It raises incidents with evidence. An incident names the models that fired, links to the exact source records behind them, and keeps a revision history of every status change a person made. Nothing is summarised away: you can always get back to the raw observation.

It can explain an incident in prose. The optional analyst turns an incident’s evidence into a narrative, hypotheses with confidence values, and recommendations. It is off by default, it runs against a budget you set, and it can never approve or execute anything.

It proposes responses; a person decides. Quarantining a device or blocking a destination is recorded as a proposal with a reason and a written rollback plan. Approval is a separate act by a separate role. Execution is a separate module again.

What it is not

Section titled “What it is not”
Not Because
A cloud service The appliance holds your data, and your network data never leaves it. What does leave is the daily heartbeat and, on Pro, the licence check — both documented field by field.
An inline device Sensors observe copies of traffic. Nyxtrace is never in the path of a packet, so it cannot break your network by failing.
An endpoint agent Detection works from network metadata. An optional endpoint agent is on the roadmap, not in the product.
An antivirus or IPS It does not block by signature. It tells you when something changed and gives you the evidence.
Instant Behavioural models need a baseline. See the learning phase.

Who it is for

Section titled “Who it is for”

Someone who runs their own network — a homelab with a handful of VLANs, a few dozen to a few hundred devices, a firewall that can export flow data, and the willingness to read what the system reports. If you would enjoy knowing that a camera started contacting a new destination every 90 seconds last Tuesday, this is for you.

Honest limits

Section titled “Honest limits”
  • Encrypted traffic stays encrypted. Nyxtrace reads the envelope: names, fingerprints, sizes, timings. It does not decrypt.
  • Coverage is only as good as the sources. Traffic that never crosses a monitored path is invisible. The data sources page states the blind spots per source explicitly, and so does the system view in the product.
  • A first-seen destination is not an attack. Rarity is the strongest single signal in a home network, and it is also the loudest. The learning phase and the scoring rules exist to keep that useful rather than exhausting.
  • Free does not mean feature-complete. The core is genuinely usable on its own; the analyst, response execution, most third-party connectors and the mail module are Pro. See Free vs Pro.

Where to go next

Section titled “Where to go next”