Go ahead — kill a link.
Nexus Atlas is a Rust daemon that bonds every link a platform carries — satellite, cellular, microwave, radio, mesh, wired — into one encrypted Layer-3 connection, measuring each path several times a second and deciding per packet. Cut any of them below and watch the traffic reweight.
Bring the radio nobody else will bond.
Fibre and Ethernet, satellite, cellular, microwave, Wi-Fi, HaLow, 802.11s mesh, MANET and serial telemetry radios down to 64 kbps — all join the same bond on the same terms, each scored on its own. Which of them is carrying depends on where you are; that the connection carries on does not.
[[link]] max_range_m with a warn radius at 60% of it. Inside the warn radius a bearer scores at full weight; past it its cost rises with distance, which is why its strand thins before the arc; beyond max range it is out of the bond. The bearer set, the distances and the split are illustrative; the behaviour is not. “Contested airspace” here means only that the short-reach civil bearers are gone — the picture makes no claim about the RF environment out there.Nothing failed. The split moved anyway.
Fly further out and each bearer’s usable rate falls at its own pace, so the scheduler reweights continuously. The fat short-reach link fades first; the thin long-reach one is still carrying at the far end. No threshold, no failover event, no gap in between.
Every hop is itself a bond.
Multi-hop routing and per-hop bonding are two independent layers of survival. Lose an airframe and Dijkstra SPF threads the route around it. Lose one radio of a bonded hop and nothing reroutes at all — that hop simply carries on, thinner.
One path, K paths, or the ones you pin.
At the default path_redundancy = 1, one route carries and SPF recomputes another over whatever survives when it dies — costing you however long detection takes. Raise K and that many next hops carry the same packet at once: a route can fail with nothing lost and no wait for the recompute, because the receiver was already holding a copy that came another way. Or pin the hops yourself on a segment you know better than the algorithm does, and that path stops adapting at all.
One copy per packet, on the best route available. Cheapest possible — and when its relay dies, everything already in flight is gone and everything sent until the dead-probe timer expires goes with it: five missed probes, about 1.25 s at the shipping defaults.
Two routes leaving on different first hops, both carrying the same packet. The receiver keeps whichever copy arrives first and drops the later one before reassembly, so the application is handed exactly one. Cutting a relay on one route costs nothing measurable, because the copy on the other route was already travelling.
Every packet on all five routes. No more protection than two routes give you against a single relay failure, at two and a half times the bill — which is why the adaptive strategies escalate the links of a hop to two or three instead of flooding every route. bonding & scheduling ↗
Move the traffic before the link breaks.
Nodes that have a fix carry position and velocity in the routing flood, and signal is tracked as a trend rather than a reading. A link about to stretch out of range, or fade below its floor, gets a rising cost — so traffic leaves while it still works. Advisory only: prediction never kills a link.
Range says it’s fine. The mountain disagrees.
Two ground stations twelve kilometres apart with a massif between them have no path at any transmit power — distance alone will never tell you that. The elevation model will, and the only nodes that can carry the traffic are the ones in the air, moving. Watch the route re-form through whichever relays currently have sightlines.
One packet’s journey, in seven stages.
Applications write into a normal Linux network interface and never learn what happens next. Each stage is a page on this site; each page ends in configuration you could type.
atlas0; the daemon reads raw IPv4 packets.
ClassifyDSCP + flow heuristics pick one of six service classes (opt-in).
FragmentPayloads split at 1428 B — 1500 less IP, UDP and our own 44 — reassembling out-of-order on arrival.
EncryptNoise IK sessions — X25519, ChaCha20-Poly1305, BLAKE2s.
ScheduleEight strategies decide per packet, on live per-link measurements.
TransmitPlain UDP out of per-link sockets — direct, punched, or relayed.
DeliverDedup, reassembly, TUN egress — or an onward hop through the mesh.
Eight subsystems, one decision loop.
Every capability below is real code in the daemon, and each has its own page: the mechanics, the numbers we have measured, and the configuration that turns it on.
Bonding & scheduling
Isolated per-link sockets and queues, evidence-required liveness, eight per-packet strategies including three adaptive escalation modes, gradual non-binary failover.
Mechanics & demosTransport classes
Six delivery contracts on one tunnel: strict priority, deadline budgets, store-carry-forward, per-class multipath, Reed–Solomon recovery, adaptive per-class escalation.
The six lanesMesh & routing
A link-state mesh with no controller: LSDB flooding, Dijkstra SPF, multi-hop relay to 8 hops, duplicate delivery over independent first hops, encrypted gossip, signed config epochs.
Inside the meshPrediction
Signal trends, shared position and velocity, per-link range envelopes — and a terrain engine in development. Traffic moves before the link breaks; prediction only ever advises.
Predict, don’t reactTraversal & relays
NAT classification from the data socket, relay links as ordinary bond members, hole punching as a scheduler decision, deterministic relay election, signed discovery.
Reachability mechanicsSecurity
The Noise IK family with zero-loss rekey, pluggable peer authorization that fails closed, hop honesty stated plainly, SBOM/SLSA-provenanced releases, hardened deployment.
Crypto & assuranceOperations
One binary, one validated file, commit-confirmed applies with a deadman revert, signed fleet epochs, an offline provisioning wizard, a dashboard on every node, CLI and REST.
Run itIntegrations
Adapters that pull telemetry straight out of the radio — serial, Wi-Fi, Ethernet, Bluetooth — an adaptive video chain, Linux from ~15 g boards up, and Android in evaluation.
Hardware & adaptersNo controller. No cloud. And the limits, out loud.
Technical readers don’t trust sites that only list strengths. Here is both columns of the ledger.
What holds with everything cut off
- Every node is autonomous: no controller, no orchestrator, no licence server, no phone-home. The daemon runs air-gapped indefinitely.
- The mesh is its own control plane — configuration spreads peer-to-peer over the encrypted tunnels themselves, as Ed25519-signed epochs.
- A partitioned network keeps operating on both sides of the split and reconciles when it heals.
- Licensing follows the same posture: signed offline licence files, no activation server — and expiry never stops traffic.
Boundaries, stated plainly
- Linux is the supported platform today (x86-64 and ARM64); Android runs the same engine in evaluation builds.
- The inner tunnel is IPv4; the underlay — link binds and peer endpoints — speaks IPv6 since mid-2026.
- Transport classes, mesh, traversal and prediction are opt-in by design: switched off, the data path is byte-identical.
- Mesh relays are trusted members of your own fleet (traffic is re-encrypted per hop); hosted traversal relays forward envelopes they cannot open. Two different trust models — both stated precisely.
- At default settings, hard dead-link detection is ≈1.25 s (5 missed probes at 250 ms); the sub-second figure is the reweighting cadence. Tuned profiles go faster and are labelled as tuned.
Built for the places where one link is one failure.
The engineering is environment-agnostic; the business cases are not. Each context below is argued properly — for decision makers — on the business site.
Contested spectrum
Diversity across links and bands: when one band degrades, quality scoring shifts classes onto links that still deliver — while any usable path remains.
Defence & security ↗Platforms that move
Endpoint roaming, predictive handover, and a compute floor around 15 grams — the airframe carries the network it needs.
Uncrewed systems ↗Networks in a disaster
Bond whatever remains, mesh what you brought, and let store-carry-forward hold the data through the blackout.
Public safety ↗Infrastructure at the edge
VSAT through weather, SCADA in priority classes, telemetry with no gaps — monitoring that outlives the link.
Critical infrastructure ↗Where Atlas wins — and where it doesn’t.
Nine alternatives, compared by mechanism, with a concession block for every one of them. The short version:
| Question | Typical alternative | Nexus Atlas |
|---|---|---|
| What happens as a link degrades — before it fails? | Nothing until a threshold trips, then everything at once | Continuous quality scoring; load shifts gradually on a typically configured 0.1–0.75 s cadence |
| Can it bond dissimilar bearers — VSAT beside a 64 kbps serial radio? | Rarely; most bond same-kind links only | Yes — declared capacity from a few kbps to multi-gigabit, each link scored on its own terms |
| What infrastructure must stay reachable? | An orchestrator or a vendor cloud | None — there is no controller to pay for or to lose |
Every claim you can click.
Thirteen interactive simulations across the site — kill links, flood classes, jam bands, push configs — plus the scripted namespace demos that ship with evaluation builds.
One product, six destinations.
This site carries the engineering truth. The rest of the story lives with its audience.
The case, the problems solved, the engagement path — for decision makers.
Mechanisms, measured numbers, live demos, boundaries stated plainly.
The portal for integrating engineers: quickstart, full reference, evaluation access.
nexusatlas.netTraversalThe managed reachability service: relays, gateways, private estates.
console.nexusatlas.netOperationsEnrol nodes and run the estate: live map, per-link telemetry, alerts, audit.
nexusatlas.appDownloadsThe apps: Linux tour, Android tour, evaluation builds.