One codebase.
Every environment.
LYNX is built on standard C17 with a strict platform abstraction layer. No vendor SDK, no proprietary dependencies. The same detection engine runs on a developer laptop, an embedded MIPS firewall, and a rack-mounted appliance.
LYNX Desktop
Full inspection on any hardware
A CLI tool — run it like Snort. Point it at an interface or a PCAP file. All 12 inspection layers active, TinyLlama FP reduction included. Runs on Linux, Windows, and macOS with zero OS-specific configuration.
Best for development, testing, and server deployments
LYNX Embedded
Statically linked for MIPS hardware
A single static binary cross-compiled for Cavium OCTEON MIPS64. Runs on Cyberoam CR1500ia and compatible hardware-firewall platforms. Memory-constrained profile: embedded C decision tree for ML, behavioral engine with 1-hour window, no TinyLlama.
Deploy to existing hardware firewalls — no new appliance needed
LYNX Appliance
Full stack with web dashboard
Custom hardware firewall profile with DPDK enabled, the full ML stack, federated learning client, and the LYNX web dashboard — real-time WebSocket alerts, virtual scroll for 100k+ rows, Canvas charts, and a live health indicator.
Complete SOC-ready solution for enterprise and MSSP deployments
Feature matrix
| Feature | Desktop | Embedded (MIPS) | Appliance |
|---|---|---|---|
| Packet capture | libpcap + DPDK | libpcap | DPDK kernel-bypass |
| ML pre-filter | ONNX Runtime | C decision tree | ONNX Runtime |
| TinyLlama FP reduction | ✓ Full | ✗ Disabled | ✓ Full |
| Behavioral engine | ✓ Full | ✓ 1h window | ✓ Full |
| Federated learning | ✓ | ✓ | ✓ |
| Web dashboard | ✓ | ✓ Lightweight | ✓ Full React UI |
| Default degrade level | L0 — Full | L1 — Async off | L0 — Full |
| Typical RAM usage | ~2 GB | ~200 MB | ~4 GB |
| Max concurrent flows | 2M default | 200k | 5M+ |