Network and privacy

This page says when NULLos goes onto the network, how you switch the network on and off, and how we check the network traffic. To be honest, it also covers what happens before NULLos: your computer's firmware can send packets before the start.

The rule: silent out of the box

Out of the box NULLos does not send a single packet unless you do something: no DHCP, no DNS, no time query (NTP), no mDNS, no update check, no telemetry, no standing connection. The network only comes when you switch it on.

If network features are added later, for example an automatic updater, then only like this: visible, can be switched off, only to fixed destinations named here such as nullos.de, and without a device ID.

Switching the network on and off

On the console:

While the network is off, programs such as dl, fz, vc or ssh report ("network is off – switch it on with net up"):

Netz ist aus – mit net up einschalten

Connections to your own computer (127.0.0.1, ::1) always work.

net status shows the state in its first line, for example netz aus (einschalten: net up) ("network off (switch on: net up)"). On the desktop it is shown at the top right of the bar („Netz aus“). Checked on 31 Oct 2026 with 0.3.4 in QEMU.

How we check the network traffic

We start NULLos in QEMU with a network card and capture every packet the virtual machine sends:

• Network: QEMU's user network (-netdev user), card virtio-net without boot ROM.
• Capture: directly at the VM's network card (filter-dump), from power-on, as a PCAP file.
• Analysis: with tcpdump and Wireshark.
• Before every release this check runs automatically: NULLos starts, up to the login, then 300 seconds without any input. Every packet of the VM is counted. Out of the box, none is allowed.

What you see in the capture and what it means:

None of these addresses belongs to a manufacturer: with the first byte 52, the bit „locally administered“ is set.

QEMU's user network answers by itself, on your computer, not from your home network. But QEMU could forward connections through your computer to the outside. That is why the check counts every packet, including those to addresses outside the QEMU network.

What goes onto the network before NULLos

Before NULLos starts, your computer's firmware (UEFI) runs. Many firmwares bring their own network drivers and can send packets already then. That is outside NULLos; no operating system can prevent it. You can only switch it off in the firmware itself.

In QEMU (measured)

In QEMU the firmware is OVMF from the TianoCore/EDK II project. It comes with QEMU (with Homebrew, the file edk2-x86_64-code.fd) and brings its own driver for virtio-net and its own network stack. Before NULLos runs, it sends two IPv6 packets: a multicast listener report (MLD) and a check of its own address (DAD).

You can switch this off with an extra QEMU option (OVMF documentation):

-fw_cfg name=opt/org.tianocore/IPv6Support,string=no

Measured on 31 Oct 2026 with QEMU 11.1.2: without the option two packets before NULLos, with it none. To start QEMU without any network card, use -nic none.

Switches by manufacturer

Menus differ by model and firmware version. Each row applies to the manual named. „unknown“ means: the manual does not give the factory setting.

We did not find official instructions for VMware Fusion or for UTM without a network device.

If something cannot be switched off

Some features cannot be switched off, or only partly, for example Intel AMT before release 12. If you want to be sure, capture the traffic at your router if it can do that, or on a second computer, and look at what your computer sends before and after NULLos starts.