NullTrace
Antivirus watches files. NullTrace watches the wire. Windows endpoint protection for the Layer 2 and Layer 3 attacks that traditional endpoint security is not looking for — ARP poisoning, DNS spoofing, rogue access points, IPv6 takeover.
By the Numbers
- 18 — Independent detection engines
- 4 — Defense layers: harden, detect, respond, forensics
- 7 — Whitelisted commands the privileged service will execute. Nothing else.
- ~200 — Lines in the SYSTEM-level service, kept deliberately small
The Problem
A coffee-shop network can be hostile without a single malicious file touching disk. ARP poisoning silently reroutes traffic through an attacker. DNS spoofing sends a bank domain somewhere else. A rogue access point clones an SSID and waits. Endpoint antivirus, which is built around files and processes, sees none of it.
The tools that do see it — Wireshark, arpwatch, custom scripts — assume the operator already knows what an ARP table is. NullTrace targets the person who does not.
Architecture
Two processes, split along the privilege boundary. Guard runs as a SYSTEM service and is kept small on purpose: roughly 200 lines, and it will execute exactly seven whitelisted commands. Sentinel runs unprivileged, hosts all 18 detection engines and the dashboard, and can ask Guard for a privileged action but can never dictate an arbitrary one. They speak JSON over a named pipe.
That split is the security design. A detection engine parsing hostile packets is the component most likely to be compromised, so it is also the component with no privileges. Compromising Sentinel buys an attacker seven commands, not the machine.
Response is graduated rather than binary: reinforce hardening first, isolate through a VPN if that fails, and disconnect the interface only as a last resort. Detection rules are deterministic for v1 — no ML in the path where a false positive costs a user their network connection.
The Engines
Each engine is a self-contained class over a shared base, registered at startup: arp_guard, dns_sentinel, mitm6_guard, wpad_detector, llmnr_guard, mdns_guard, ra_guard, icmp_redirect, dhcp_watch, ap_verifier, beacon_detector, wpa_downgrade, mac_randomizer, port_scan, smb_audit, tls_verify, vpn_leak, and hostname_guard.
Tech Stack
Python 3.10+ · FastAPI · Windows services · named pipes · deterministic rule engines