Your laptop's network is under attack. Your antivirus doesn't care.
NullTrace is an intelligent endpoint protection system for Windows that defends against Layer 2/3 network attacks -- the ones traditional antivirus completely ignores.
You connect to airport Wi-Fi. Within seconds, an attacker on the same network:
- Poisons your ARP cache -- redirecting all your traffic through their machine
- Spoofs DNS responses -- sending you to fake banking sites with valid-looking URLs
- Downgrades your encryption -- stripping HTTPS to intercept credentials in plaintext
Your antivirus? Silent. It's scanning files for malware signatures. It has zero visibility into Layer 2/3 network attacks.
NullTrace watches the wire. 18 detection engines monitor every packet, every protocol, every handshake. When something is wrong, it doesn't just alert -- it kills the connection before damage is done.
- Windows 10/11
- Python 3.11+
- Npcap (packet capture driver -- free for personal use)
git clone https://github.com/CodedRichy/NullTrace.git
cd NullTrace
pip install -r requirements.txt
python setup.pypython nulltrace.py trustCaptures a cryptographic fingerprint of your current gateway. If anyone impersonates your router later, NullTrace kills the connection in milliseconds.
python nulltrace.py startDashboard opens automatically. That's it.
18 independent engines organized by severity and automated response level.
| Engine | Threat | How It Works |
|---|---|---|
| ARP Guard | ARP spoofing / MitM | Detects gateway MAC changes and unsolicited ARP replies |
| AP Verifier | Rogue access points / evil twins | Verifies AP identity against trusted BSSID fingerprints |
| Engine | Threat |
|---|---|
| DNS Sentinel | DNS poisoning and hijacking |
| LLMNR Guard | LLMNR / NBT-NS poisoning (Responder attacks) |
| WPAD Detector | WPAD proxy hijacking |
| mDNS Guard | mDNS poisoning via Responder |
| MITM6 Guard | IPv6 DNS takeover via DHCPv6 |
| RA Guard | IPv6 Router Advertisement spoofing |
| TLS Verify | TLS interception / rogue CA certificates |
| WPA Downgrade | WPA3 to WPA2 security downgrade |
| VPN Leak | DNS and IPv6 leaks bypassing VPN tunnel |
| Beacon Detector | Beacon frame fingerprinting anomalies |
| ICMP Redirect | ICMP redirect route manipulation |
| Engine | Threat |
|---|---|
| DHCP Watch | Rogue DHCP servers on the network |
| Port Scan | Network reconnaissance and port scanning |
| Engine | What It Checks |
|---|---|
| SMB Audit | SMB signing configuration and NTLM security |
| Hostname Guard | DHCP hostname leakage suppression |
| MAC Randomizer | MAC address randomization on public networks |
NullTrace Architecture
┌─────────────────────────────────────────────────────┐
│ GUARD SERVICE │
│ (runs as SYSTEM, ~200 LOC) │
│ │
│ Only 7 whitelisted commands: │
│ KILL_NIC RESTORE_NIC SET_MAC SET_STATIC_ARP │
│ BLOCK_MAC HARDEN_PROTOCOLS CAPTURE_PCAP │
└──────────────────────┬──────────────────────────────┘
│ Named Pipe IPC
│ \\.\pipe\nulltrace-guard
┌──────────────────────┴──────────────────────────────┐
│ SENTINEL PROCESS │
│ (runs as current user) │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │
│ │ 18 Detect│ │ Scapy │ │ Dashboard │ │
│ │ Engines │ │ Sniffer │ │ localhost:9637 │ │
│ └──────────┘ └──────────┘ └──────────────────┘ │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │
│ │ Toast │ │ SQLite │ │ System Tray │ │
│ │ Alerts │ │ Threat DB│ │ Icon │ │
│ └──────────┘ └──────────┘ └──────────────────┘ │
└─────────────────────────────────────────────────────┘
Why the split? The Guard runs with SYSTEM privileges but is intentionally tiny (~200 lines, 7 commands). It can't be tricked into running arbitrary code. The Sentinel holds all the intelligence but runs unprivileged -- if compromised, it can't touch your system. This is the principle of least privilege applied to endpoint security.
| Mode | When | What Happens |
|---|---|---|
| Public Wi-Fi | Untrusted network detected | MAC randomized before connecting. All 18 engines active. Aggressive response posture. |
| Trusted Network | nulltrace trust was run here |
Gateway identity verified via cryptographic fingerprint. Relaxed posture for known-safe networks. |
Neo-minimal web interface on localhost:9637 with two views:
- Basic -- Shield status icon, plain-English alerts, one-click network trust. Zero technical knowledge required.
- Advanced -- All 18 engine statuses, live packet log with WebSocket streaming, full network state, threat timeline, CSV export.
| Tool | Gap NullTrace Fills |
|---|---|
| CrowdStrike / SentinelOne | $30-185/yr. Enterprise-only. No Layer 2 detection. Not for personal laptops. |
| ESET / Norton / Defender | Alert-only for network attacks. High false positives. No automated remediation. |
| XArp | Dead project (last update 2019). ARP-only. No other attack vectors. |
| ArpWatch | Linux-only. Single vector. Requires manual log analysis. |
| Suricata / Snort | IDS/IPS for network perimeters, not endpoints. Expert-only configuration. |
NullTrace is the first tool that unifies Layer 2/3 defense into a single, automated, consumer-friendly package for Windows.
nulltrace/
guard/ SYSTEM service (~200 auditable lines)
executor.py 7 whitelisted commands only
service.py pywin32 Windows service wrapper
pipe_server.py Named pipe IPC listener
sentinel/ Detection brain + all user-facing components
engines/ 18 independent detection modules
dashboard/ FastAPI + WebSocket real-time UI
ui/ Web dashboard frontend
monitor.py Scapy packet sniffer + network state
alerts.py Windows toast notifications
config.py JSON config manager
main.py Sentinel orchestrator
shared/ Cross-component foundations
constants.py Severity levels, commands, app config
models.py Pydantic data models
db.py Thread-safe SQLite with analytics queries
tests/ 1,200+ lines across 15 test files
docs/ Design spec + implementation plan
| Package | Purpose |
|---|---|
| scapy | Packet capture, crafting, and protocol dissection |
| FastAPI | Dashboard REST API + WebSocket server |
| uvicorn | ASGI server for the dashboard |
| pywin32 | Windows service management and COM |
| winotify | Native Windows toast notifications |
| pydantic | Request/response data validation |
| psutil | Network interface enumeration |
| customtkinter | Native desktop GUI framework |
| pystray | System tray icon |
| Pillow | Icon rendering for system tray |
| pywebview | Native window for web-based GUI |
External requirement: Npcap must be installed for packet capture. Free for personal use.
pytest tests/ -v15 test files covering all engines, IPC, Guard executor, dashboard API, config management, alerts, and the Sentinel orchestrator. All system calls are mocked -- no real NIC/MAC changes during testing.
- CI/CD pipeline (GitHub Actions)
- Installer (MSI/MSIX) -- no Python required for end users
- v1.1: ML-based anomaly scoring (scikit-learn) layered on deterministic rules
- v2: Freemium model with cloud threat intelligence
- v3: Multi-device protection platform
Contributions welcome. NullTrace follows a test-first development approach -- every engine has corresponding tests.
- Fork the repo
- Create a feature branch (
git checkout -b engine/new-detector) - Write tests first, then implementation
- Ensure
pytest tests/ -vpasses - Submit a PR
See the Design Specification for architecture details before contributing.
Built by Rishi Praseeth Krishnan