Nexus Atlas is a userspace Layer-3 transport: it owns a TUN interface, and every physical path is just a UDP socket it measures and schedules — fiber and Ethernet, satellite, cellular, microwave, Wi-Fi, 802.11ah HaLow, 802.11s mesh, MANET and serial telemetry radios, Bluetooth, and custom SDR waveforms alike. The rule is simply that it carries a UDP datagram; the bond neither knows nor cares what the physics underneath look like. This page walks a packet end to end, then opens the engine.
Applications see a normal network interface (atlas0, e.g. 10.0.100.1/24). The kernel routes into it; the daemon does the rest. Every number here is the shipping default.
The daemon reads raw IPv4 packets from the TUN device. Destination lookup is longest-prefix match over per-peer allowed_ips — malformed CIDRs are load-time errors, never runtime panics. (IPv6 inside the tunnel is the one long-standing documented gap; the underlay speaks IPv6.)
With [qos] enabled, a DSCP-first classifier (then port heuristics, then fallback) assigns one of six classes. The class and reliability mode pack into a previously unused header byte — wire-compatible with non-QoS builds, and with QoS off the data path is byte-identical to the pre-QoS engine. transport deep-dive ↗
Inner packets larger than the fragment payload split into fragments sharing an ID, reassembled out of order on the far side, with a janitor reaping half-arrived buffers. The payload ceiling is 1428 B — a 1500 B underlay path less 28 B of IP and UDP and our own 44 — and it is fixed, not negotiated: the daemon shrinks it when a relay link is present so relayed datagrams still fit, but it does not grow to exploit a jumbo-frame underlay. A full-size video frame still crosses a PPP link over a 64 kbps serial radio.
Out of the box, sessions come from a Noise IK handshake — X25519 key agreement, ChaCha20-Poly1305 AEAD, BLAKE2s — with deterministic tie-breaking when both sides initiate at once, and make-before-break rekeying every 2 minutes or 1 GiB with zero measured loss. security ↗
The whole security layer is a module, not a hard-coding. Identity, handshake, cipher suite and peer authorization sit behind narrow interfaces; the rest of the engine only ever asks for “make me a session with this peer” and “seal this fragment”. Nothing about scheduling, fragmentation, routing or traversal knows which algorithms answered. That seam is the point: cryptography is one of the few things an operator is frequently not free to choose, and a transport that welds one suite into its data path is unusable the moment a national standard, an accreditation regime or an internal policy says otherwise.
What that means concretely. Within the Noise framework the primitive set is a parameter of the same handshake, so moving to a different key agreement, AEAD or hash — an accredited module, a mandated national algorithm set, or the X25519 + ML-KEM-768 hybrid — is a build-time change rather than a redesign. Replacing the handshake framework outright with something else entirely is a bounded integration at that same boundary, not a fork of the engine. Today the default build ships the suite above; the FIPS-validated and post-quantum variants are specified engineering, not shipped features Roadmap — so if a programme is obliged to run a particular suite, that is precisely where the work lands, and the answer is an integration conversation rather than a “no”. One honest constraint comes with it: there is no cipher negotiation on the wire by explicit decision — one protocol version, one build across the fleet — so a suite is a fleet-wide choice, not a per-session one.
Authorization is pluggable today, separately from the crypto. The handshake proves a peer holds its key; deciding whether that key may join the network — and with which addresses — is a swappable component behind a single trait. Three providers ship (a static allowlist, a hot-reloaded keyfile, an external command hook), and an embedder can replace the module wholesale with their own PKI, an HSM, a corporate identity service or a bespoke enrolment protocol without touching the data path. So an operator runs the cryptography and the authorization scheme they want — or the ones their organisation and accreditation oblige them to run. Every failure mode fails closed. the providers ↗
Eight strategies decide per packet — not per flow — using each link’s live EWMA RTT, jitter, windowed loss and declared capacity. Redundancy is a first-class outcome: the adaptive modes escalate from one to two to three simultaneous paths and step back down. bonding & scheduling ↗
Each [[link]] is a UDP socket bound to its device (SO_BINDTODEVICE) with its own bounded send queue (32 packets, drop-on-full, non-blocking) and its own rebind watchdog — a wedged or re-enumerated USB radio recovers without touching the other links. Relay links ride 66-byte encrypted envelopes through a relay server instead of a direct endpoint. traversal ↗
Receive-side: AEAD verification, a 2048-entry per-session anti-replay window (checked after authentication), fragment reassembly, TUN egress. If the inner destination is another mesh node, the packet is instead re-fragmented and re-encrypted toward the next hop — relays are trusted fleet members, stated plainly. mesh ↗
Splitting an oversized packet is ordinary. What is not ordinary is that the scheduler decides per fragment rather than per flow — so fragment #0 can leave on the Ethernet link and fragment #1 on the satellite. Arriving out of order is therefore the normal case on every packet rather than a fault to recover from, and the reassembly buffer is built around that, with a janitor so a half-arrived packet costs memory for a bounded time and no longer.
The ceiling is 1428 bytes: an assumed 1500-byte underlay path, less 28 bytes of IPv4 and UDP, less our own 44 bytes of header and tag. It is a compile-time constant — not a negotiation, and not a function of the tunnel MTU, which the fragmenter never reads. So it never grows to exploit a jumbo-frame underlay.
One fragmenter serves every link, so the moment a relay link is configured the ceiling drops by the 66-byte relay envelope — to 1362 bytes, on the direct links too. About 4.6% of payload buys a relay path that can never black-hole an oversized datagram; sizing it per link would mean re-fragmenting at send time, once per link, for every packet. traversal ↗
Dedup is the last step of the lifecycle above, and it is the step that makes redundancy affordable: send the same packet down two routes that share no intermediate node, keep whichever copy lands first, discard the rest. Cut a relay under one of them and there is nothing to reroute — the other copy is already on the wire.
One copy per packet, on the best route available. Cheapest possible — and when its relay dies, everything already in flight is gone and everything sent until the dead-probe timer expires goes with it: five missed probes, about 1.25 s at the shipping defaults.
Two routes leaving on different first hops, both carrying the same packet. The receiver keeps whichever copy arrives first and drops the later one before reassembly, so the application is handed exactly one. Cutting a relay on one route costs nothing measurable, because the copy on the other route was already travelling.
Every packet on all five routes. No more protection than two routes give you against a single relay failure, at two and a half times the bill — which is why the adaptive strategies escalate the links of a hop to two or three instead of flooding every route. bonding & scheduling ↗
The control loop around the data path: measurement in, topology shared, decisions out. Nothing here requires a controller — every box runs on every node.
Per-(peer, link) probes on each link’s own clock — 250 ms default, per-link configurable — smoothed with EWMA (α = 0.2), windowed jitter and loss, dead after 5 consecutive misses. A link is never assumed alive before its first completed round-trip, and sequence numbers ride real fragments so data loss is measured directly.
A link-state database flooded to established peers — per-link cost and RSSI, served prefixes, node names, optional position and velocity — with aging, refresh and tombstones. Dijkstra runs over it for multi-hop routes; the dashboard’s topology view reads the same structure.
The per-packet chooser: cost models over live measurements, hysteresis and dwell timers so escalation is instant but de-escalation is deliberate, and per-class policy overrides when QoS is on.
CRDT membership with authenticated join, encrypted gossip (v2: ChaCha20-Poly1305 with per-opcode domain separation), and Ed25519-signed configuration epochs with a commit-confirmed apply lifecycle on every node.
Netcheck (NAT classification from the data socket), relay clients, rendezvous and hole punching, deterministic relay election — all opt-in; with [traversal] off, none of it runs.
A once-per-second stats snapshot every consumer shares — CLI, dashboard, REST, the video governor — plus a Unix socket where radio adapters inject RSSI, noise and buffer depth from the hardware itself.
The fleet runs one binary everywhere by policy; there is deliberately no version negotiation. Mixed builds fail loudly instead of corrupting silently.
The service-class byte packs into a semantically unused header field; the FEC flag took a spare bit. Both shipped without a version bump — old nodes simply ignore them.
Rekey initiations carry their marker inside the encrypted Noise payload; builds that predate it degrade to their peer-restart path instead of misparsing.
Defaults in parentheses where configurable; everything on this table is the shipping implementation, not a target.
| Property | Value |
|---|---|
| Implementation | Rust, userspace, tokio async runtime; one binary per architecture (x86-64, ARM64) on glibc with OpenSSL 3 — Debian 12, Ubuntu 22.04, RHEL 9 or newer; no kernel module, no DKMS |
| Interface | Linux TUN (atlas0), inner IPv4, MTU 1420 (configurable) |
| Links per daemon | No fixed limit; 6 dissimilar types bonded on one node in the field (2× serial radio, Bluetooth-PPP, Wi-Fi ad-hoc, 802.11s mesh, Ethernet) |
| Declared link capacity | typically 64 kbps – 1.5 Gbps, per link |
| Cryptography | Noise IK · X25519 · ChaCha20-Poly1305 · BLAKE2s |
| Rekey | every 120 s or 1 GiB (configurable) · make-before-break · 0 measured loss |
| Anti-replay | 2048-entry sliding window per session, post-authentication |
| Overhead | 44 B/fragment protocol (+28 B UDP/IPv4 = 72 B on-wire) · 66 B relay envelope |
| Probing | 250 ms default, per-link override · EWMA α 0.2 · dead after 5 misses (≈1.25 s) |
| Scheduling | 8 strategies, per-packet; per-class policies with QoS on |
| Mesh | LSDB flood · Dijkstra SPF · relay TTL 8 hops · dual-SPF multipath |
| Reweighting cadence | typically configured 0.1–0.75 s — a response cadence, not a recovery guarantee |
| Footprint | Runs on single-board computers around 15 g; the same binary runs on servers |
| Test estate | Unit, integration and full-system coverage on every change — end-to-end suites drive real daemons through link loss, key rotation, config rollback and carrier-NAT traversal; dependency and licence auditing gate every merge |
| Licence | Proprietary, subscription — persistent nodes licensed, ephemeral nodes free; signed offline licence files, no kill switch |
| Crate | What it is |
|---|---|
| nexus-atlas-proto | Wire types and serialization — headers, probes, mesh, relay envelopes; no I/O |
| nexus-atlas-core | The engine: data path, crypto, scheduler, link monitor, LSDB/SPF, mesh, traversal, config lifecycle |
| atlasd | The daemon binary — keygen · run · status · stats · monitor · web · enroll · config … |
| nexus-atlas-qos | Traffic classes: classifier, priority queues, deadlines, per-class multipath, adaptive escalation |
| nexus-atlas-fec | Systematic GF(256) Reed–Solomon erasure coding, implemented from scratch, pure and deterministic |
| nexus-atlas-bundle | Store-carry-forward bundle queue with pluggable backends (memory / write-ahead-log file) |
| nexus-atlas-terrain | DEM line-of-sight, Fresnel and diffraction analysis → a terrain risk score (crate built; engine wiring in development) |
| nexus-atlas-stun | Minimal STUN — RFC 8489 binding + RFC 5780 OTHER-ADDRESS — for netcheck and the relays |
| nexus-atlas-relay | The relay server binary: STUN observation pair + authenticated opaque-envelope forwarder + rendezvous |
Plus nexus-atlas-web (the dashboard SPA the daemon embeds) and a shared telemetry crate the four external radio adapters build on — see integrations.
The whole product on one page, before the detail below takes it apart. Applications never learn any of it exists; everything from the tunnel interface down to the peers is what the daemon does on their behalf.
Five layers between an application socket and a peer on the far side of the bond. Only the two solid bands are the daemon; everything above and below belongs to somebody else — the kernel, the radios, the peers. Every name set in monospace is a real crate or module in the workspace, so this picture and the table above describe the same thing.
Unchanged, and unaware.
Ordinary sockets in ordinary programs. Nothing links against Atlas, nothing is recompiled for it, and no application ever learns that it has more than one path.
The TUN interface the daemon owns — inner IPv4, MTU 1420 by default, one address per node. The kernel routes into it and that is the entire integration surface. tun_device.rs
the kernel routes into atlas0; the daemon reads raw IPv4 packets out of it
One library crate, nexus-atlas-core. The atlasd binary is a thin CLI over it, and the Android app embeds the same code through a JNI bridge.
Noise IK sessions — X25519, ChaCha20-Poly1305, BLAKE2s. Sealing and opening happen here and nowhere else, behind an interface the rest of the engine cannot see past.
Splits inner packets at 1428 bytes and reassembles them out of order on the far side, with a janitor reaping half-arrived buffers.
Eight strategies choosing links per packet rather than per flow, from live RTT, jitter, windowed loss and declared capacity.
A 2048-entry sliding window per session, checked after authentication — never before it.
A shared time window on the receive side that drops the second and later copies of a packet sent down more than one route.
Service classes, priority queues, deadline budgets and store-carry-forward. Switched off, the data path is byte-identical to the pre-QoS engine.
Per-(peer, link) probes on each link's own clock, EWMA-smoothed, dead after five consecutive misses. It also holds whatever the radio adapters have told it.
The link-state database flooded to established peers — costs, served prefixes, names, optional position — with Dijkstra SPF run over it.
Next-hop selection when the inner destination belongs to another node rather than to this one.
Operator-declared end-to-end paths that bypass SPF entirely, for when the topology is a policy decision.
CRDT membership with authenticated join, encrypted gossip, and signed configuration epochs with a commit-confirmed apply on every node.
NAT classification from the data socket, rendezvous, hole punching and relay election. Switched off, none of it runs.
sealed fragments, each already assigned to the link the scheduler chose for it
Still inside the process — the part that touches the operating system.
One UDP socket per [[link]], bound to its own device, each with its own bounded send queue that drops rather than blocks, and a watchdog that swaps in a fresh socket when an interface is re-enumerated. Two links on one device need distinct ports. transport.rs
44 bytes per fragment — 8 outer header, 20 inner header, 16 bytes of AEAD tag. UDP and IPv4 add 28 more, so the honest on-wire figure is 72. One protocol version, checked on decode, with no negotiation. nexus-atlas-proto
Handshake, make-before-break rekeying on an interval or a byte count, and deterministic tie-breaking when both ends initiate at once. Rekey markers ride inside the encrypted payload, so adding them cost no wire change. engine/handshake.rs
one UDP datagram per fragment, out of the socket bound to that bearer
Not ours. Anything that carries a datagram qualifies, and the bond scores each on its own terms.
Give it its own probe interval or the physics reads as loss.
Endpoint roaming keeps the session alive across a carrier address change.
Behaves like fibre right up until the weather arrives.
A re-enumerated USB radio is rebound without disturbing the other links.
PPP over an adapter's pseudo-terminal; a 64 kbps link is a first-class member. adapters ↗
the same bonded session, spread across whichever bearers are alive right now
The far side. Every node runs this identical stack — there is no controller and no server tier.
All five bearers above carry the same encrypted session to the same peer. There is no failover event to observe, because there was never a single link to fail over from.
Peers that can reach each other exchange fragments directly, on whichever bearer is cheapest at that instant, re-decided packet by packet.
A peer with no path of its own is reached through a fleet member that has one. Forwarding is hop by hop: the middle node decrypts and re-encrypts, so a relay is a trusted member, not a blind pipe. Relayed traffic lives to 8 hops. mesh ↗
atlasd process; dashed bands are outside it and belong to the kernel, the hardware or another machine. Names in monospace are the actual crates and modules — nexus-atlas-core is the engine library, and the boxes marked opt-in do nothing at all until a configuration file asks for them.Three honest boundaries that save everyone a meeting.
Atlas doesn’t transmit RF; it rides whatever presents IP/UDP and bonds it with everything else — including MANET radios, which keep their own PHY expertise. The radio stays the radio.
What it rides on802.11s is one possible underlay, not the product. Atlas is the layer above: measurement, crypto, per-packet choice, and multi-hop routing across dissimilar bearers. Guidance on combining the two honestly: the mesh page.
There is no Atlas cloud your traffic must visit. Hosted relays and gateways exist for reachability — opt-in, and just as happily replaced by relays you run yourself. How reachability works
An evaluation build, your links, and an afternoon: the packet lifecycle on this page becomes numbers in your own dashboard.