The two-layer model
Network privacy answers two separate questions. Keep them apart and the tool choice becomes clear. Fuse them into one "observer" and you make a category error that no amount of mixing can fix.
| Layer | Question it answers | Tools |
|---|---|---|
| Transport | Who can see that I am talking, and to whom? | mixnet, dVPN |
| Hygiene | What does my request pattern leak to the destination? | traffic-shape discipline (nym-swizzle) |
The transport layer chooses how your packets reach the destination. It hides your IP address, and against a network observer it can also hide your timing. The hygiene layer is client discipline that you owe regardless of transport. It shapes the requests themselves, so the destination learns less from the pattern of what you send.
The category error
The destination is the server on the other end of your session. For most applications it is the primary adversary, because you must talk to it directly and it is cheap to run or compromise. It sees the source IP of whatever connects to it, the arrival time of every request, and the full content of each request. Transport can change that source IP. It cannot change the other two.
Mixing does not change this.
Mixing delays and cover traffic change what a network observer can infer. The destination sees only what arrives, and when it arrives. No amount of mixing protects you against the server you are talking to.
What protects you against the destination is different: hide your IP (transport), then discipline the timing and content of your requests (hygiene).
Watch it happen
The diagram below shows the mixnet reaching a clearnet destination. Sphinx packets take three mix layers with per-hop delays, Poisson sending, and cover traffic. The exit gateway then forwards to the destination over the public internet, so the connection arrives from the exit gateway's IP.
This diagram is the clearnet-exit case: you reach a third-party destination. Client-to-client (end-to-end) mode is a different shape, with no exit gateway and no clearnet destination. It is shown in When there is no destination below.
The exit gateway is the last Nym hop. It runs two proxy services: a Network Requester (SOCKS, application layer) and an IP Packet Router (raw IP). Which one carries your traffic depends on how you connect.
The mixing is real, and it is strong against the network. Now look at what each actor actually observes.
What each actor sees
Read the two verdicts together. The local network observer (L3L) gets P1 ✅: it sees only constant-size packets at a Poisson rate with cover traffic. So it cannot tell the destination, the volume, or the activity. The destination (L2) gets P2 ❌: the client's connection is an ordinary end-to-end connection, so every request and its full content arrive together. A fixed exit gateway behaves like a single dVPN exit at the destination.
Same transport. Opposite outcomes. The mixing bought everything against the network and nothing, on content, against the destination. That gap is the category error, and it is why transport alone is never the whole answer.
When there is no destination
The whole argument above assumes you exit to a clearnet destination. When both ends run Nym, that assumption drops. Traffic never leaves the mixnet, and there is no exit gateway. The endpoint is a Nym client reached end to end that never learns your IP. Replies return through the mixnet via SURBs. The L2 adversary is the untrusted server you must exit to. End to end, that party does not exist.
This is the strongest position the network offers, and it is a different shape from everything above. Not "hide better from the destination", but "have no untrusted destination at all". See end to end for the assessment, and Exit Gateway Services for the clearnet-exit path it replaces.
The two layers
Layer 1, Transport. What the configuration chooses. It provides V1 identity protection against the destination (relay, short-lived connections, exit rotation). It also provides V2 in-transit timing protection against network observers (mixing, Poisson sending, cover traffic; mixnet only).
Layer 2, Baseline hygiene. Transport-independent client discipline, owed by
every application. It provides V2 timing protection against the destination
(randomised request times, requests decorrelated from activity milestones). It
also provides V3 content protection against the destination (request-shape
discipline: padding, batching, decoy requests). The nym-swizzle
library provides these primitives.
The vantage points named here (L2, L3L, L3G) and the vectors (V1, V2, V3) are defined in the threat-model actors and vectors pages.