New: a threat-model-first guide to choosing your network defence, plus the nym-smoldvpn dVPN package and nym-swizzle sender hygiene.
Network
Configurations
Mixnet · single exit

Mixnet · single exit

IP hidden · P1@L2Req-unlink · P2@L2Local net · P1@L3LGlobal net · P1@L3GFast

Sees

  • Exit gateway IP
  • All requests and contents

Can't see

  • Client IP

Residual / countermeasure

  • The client's connection to the destination is an ordinary end-to-end connection arriving from the exit gateway's IP. Per-packet unlinkability in transit does not become request unlinkability at the destination.
  • With a fixed exit, P2 behaves like the single dVPN exit case. Rotate the exit per request to restore it.

Sees

  • Constant-size packets at a Poisson rate with cover traffic
  • That the client uses the Nym mixnet

Can't see

  • The destination, the volume, or the activity

Sees

  • Per-packet timing (hampered by mixing delays and cover traffic)

Residual / countermeasure

  • How far bulk transfers of many packets can be correlated over time is an open question. The mixnet is strongest for small, independent messages and weakest for bulk transfers.

Pros

  • Client IP heavily obfuscated (timing + location) by the Nym network

Cons / mitigations

  • Slow (5-hop + mixing delays)
  • A fixed exit gateway is a linking key at the destination

Fit

  • Client identity and IP heavily hidden from the destination
  • Not for bulk or latency-sensitive transfers

Verdicts and the latency implied by the path are an illustrative model, not measured values.