Network Stack

NØNOS Network Stack

Version 0.8.0 | March 2026

NØNOS implements a complete network stack from device drivers through transport protocols to application interfaces. Privacy is built into every layer—onion routing is a first-class transport option, DNS queries go through encrypted channels, and MAC addresses randomize per session.

Network Architecture

Layer 2: Link Layer

Ethernet

The link layer handles Ethernet frame transmission and reception.

Frame Structure:

MTU: 1500 bytes (standard Ethernet)

ARP (Address Resolution Protocol)

ARP maps IP addresses to MAC addresses on the local network.

Process:

1. Need MAC for IP 192.168.1.1
2. Broadcast ARP request: "Who has 192.168.1.1?"
3. Owner responds: "192.168.1.1 is at aa:bb:cc:dd:ee:ff"
4. Cache result for future use

Commands:

# View ARP cache
arp -a

# Add static entry
arp -s 192.168.1.1 aa:bb:cc:dd:ee:ff

MAC Address Randomization

By default, NØNOS randomizes MAC addresses to prevent device tracking.

Modes:

Randomized Address Format:

• Locally administered bit set (bit 1 of first octet = 1)
• Unicast bit clear (bit 0 of first octet = 0)
• Example: 02:xx:xx:xx:xx:xx

Layer 3: Network Layer

IPv4

Full IPv4 implementation with routing and fragmentation.

Features:

Configuration:

# View interfaces
ifconfig

# Set IP manually
ifconfig eth0 192.168.1.100 netmask 255.255.255.0

# View routing table
route

IPv6

IPv6 support for dual-stack networking.

Features:

Status: Experimental. Use IPv4 for production.

ICMP

Internet Control Message Protocol for diagnostics.

Supported Messages:

Commands:

# Ping test
ping -c 4 example.com

# Traceroute
traceroute example.com

Routing

The kernel maintains a routing table for packet forwarding.

Table Format:

Commands:

# View routes
route -n

# Add default route
route add default gw 192.168.1.1

# Add network route
route add -net 10.0.0.0/8 gw 192.168.1.254

Layer 4: Transport Layer

TCP (Transmission Control Protocol)

Full TCP implementation for reliable stream communication.

Features:

State Machine:

CLOSED → (connect) → SYN_SENT → (recv SYN-ACK) → ESTABLISHED
LISTEN → (recv SYN) → SYN_RCVD → (recv ACK) → ESTABLISHED
ESTABLISHED → (close) → FIN_WAIT_1 → ... → TIME_WAIT → CLOSED

Congestion Control: NØNOS implements TCP congestion control to avoid network overload:

• Slow start
• Congestion avoidance
• Fast retransmit
• Fast recovery

UDP (User Datagram Protocol)

Connectionless datagram delivery.

Features:

Use Cases:

• DNS queries
• Real-time applications (where latency matters more than reliability)
• Discovery protocols

QUIC

Experimental QUIC support for HTTP/3.

Features:

Status: Experimental. Use for testing only.

Socket API

Applications use Berkeley sockets for network I/O.

Socket Types

Basic Operations

// Create socket
let sock = socket(AF_INET, SOCK_STREAM, 0);

// Connect to server
connect(sock, &server_addr);

// Send data
send(sock, data, flags);

// Receive data
recv(sock, buffer, flags);

// Close
close(sock);

Server Operations

// Create socket
let sock = socket(AF_INET, SOCK_STREAM, 0);

// Bind to port
bind(sock, &local_addr);

// Listen for connections
listen(sock, backlog);

// Accept connection
let client = accept(sock, &client_addr);

Multiplexing

// Wait for multiple sockets
select(nfds, read_fds, write_fds, except_fds, timeout);

// Or using poll
poll(fds, nfds, timeout);

Onion Routing

NØNOS includes a Tor-compatible onion routing implementation for network anonymity.

How It Works

Onion routing sends traffic through three relays (hops):

Traffic Flow:

Client → Guard → Middle → Exit → Destination

Each hop removes one layer of encryption. Three layers total.

What Each Node Sees:

No single node can correlate you with your traffic.

Circuit Construction

Circuits use the ntor handshake for key agreement:

1. Generate ephemeral X25519 keypair for each hop
2. Send CREATE cell with handshake data (84 bytes)
3. Receive CREATED cell with response (64 bytes)
4. Derive forward/backward keys using HKDF

Cell Format:

Cell Types:

Encryption Layers

Traffic is encrypted three times:

Outgoing (to destination):

1. Encrypt with exit node key
2. Encrypt with middle node key
3. Encrypt with guard node key

Incoming (from destination):

1. Guard decrypts one layer
2. Middle decrypts one layer
3. Exit decrypts one layer

Cipher: AES-128-CTR for each layer

Directory and Consensus

The onion network uses directory authorities to maintain relay information.

Consensus Documents:

• List of all relays with their keys and capabilities
• Signed by multiple directory authorities
• Refreshed periodically

Relay Flags:

Using Onion Routing

# Enable onion routing (if not default)
onion enable

# Check circuit status
onion status

# Force new circuit
onion newcircuit

# Disable onion routing
onion disable

When onion routing is enabled, all network traffic routes through circuits by default.

DNS Privacy

DNS queries can reveal browsing patterns. NØNOS implements encrypted DNS.

DNS-over-HTTPS (DoH)

DNS queries encapsulated in HTTPS:

Advantages:

• Encrypted (TLS)
• Looks like normal HTTPS traffic
• Harder to block

Configuration:

# Set DoH server
dns server https://dns.example.com/dns-query

# Check DNS status
dns status

DNS-over-TLS (DoT)

Dedicated encrypted DNS channel on port 853:

Advantages:

• Encrypted (TLS)
• Lower latency than DoH
• Standard port for DNS

Note: DoT is identifiable by port, DoH is not.

Onion DNS

When onion routing is active, DNS can route through the onion network:

1. DNS query encrypted in onion circuit
2. Exit node makes DNS request
3. Response returns through circuit

No correlation between your IP and DNS queries.

Network Security

Connection State

All connection state is volatile:

• TCP connections in RAM
• Routing tables in RAM
• ARP cache in RAM

On shutdown, no network history remains.

Firewall

NØNOS includes a basic firewall:

# Block incoming port
firewall block incoming 22

# Allow outgoing
firewall allow outgoing all

# View rules
firewall list

Default Policy:

• Allow all outgoing (subject to capabilities)
• Block all incoming (except established connections)

Network Capabilities

Network access requires capabilities:

Without NET_ACCESS, a process cannot open sockets at all.

Network Configuration

DHCP

Automatic IP configuration:

# Enable DHCP
dhcp eth0

# View lease
dhcp status eth0

Static Configuration

Manual IP configuration:

# Set IP
ifconfig eth0 192.168.1.100 netmask 255.255.255.0

# Set gateway
route add default gw 192.168.1.1

# Set DNS
dns server 1.1.1.1

WiFi

Wireless network connection:

# Scan for networks
wifi scan

# Connect to network
wifi connect "NetworkName" --password "secret"

# View status
wifi status

# Disconnect
wifi disconnect

Network Commands

Diagnostic Tools

Transfer Tools

Examples

# HTTP request
curl https://example.com

# Download file
wget https://example.com/file.tar.gz

# Raw socket connection
netcat -c example.com 80
GET / HTTP/1.0
Host: example.com

Network Performance

Throughput

With standard drivers:

Onion Routing Overhead

Onion routing adds latency:

Trade-off: Anonymity costs performance.

Debugging

Network Diagnostics

# Check interface status
ifconfig -a

# Check connectivity
ping -c 4 8.8.8.8

# Check DNS
nslookup example.com

# Check routing
traceroute example.com

# View connections
netstat -an

Common Issues

Protocol Support Summary

Implemented

Not Implemented

AGPL-3.0 | Copyright 2026 NØNOS Contributors