NX (protocol)

NX (protocol)
Name	NX (protocol)
Developer	NoMachine
Introduced	2003
Latest release	Proprietary and open implementations
Type	Remote desktop, application streaming
Website	NoMachine

NX (protocol) is a remote desktop and application streaming protocol originally developed by NoMachine to optimize X11 forwarding over high-latency networks. It provides compressed, multiplexed, and cached transport for graphical sessions, enabling interactive use of remote X Window System applications from clients on diverse platforms.

Overview

NX combines techniques from the X Window System, SSH, TLS, VNC, Remote Desktop Protocol, and ICA to reduce bandwidth and latency for remote graphical sessions. It uses a session layer that interposes between an X server and an X client to cache primitives and compress streams, borrowing ideas from Caché, Lempel–Ziv, and JPEG/PNG image codecs. NX sessions typically run over TCP with optional UDP for media, and can be tunnelled through Secure Shell or negotiated with SSL/TLS for encryption.

History and development

NX originated in 2003 as a proprietary acceleration layer for X11 forwarding created by NoMachine engineers influenced by earlier work on X11 over WAN problems and research from institutions like MIT and DEC. The project intersected with efforts by communities around XFree86, X.Org Foundation, and researchers at Carnegie Mellon University investigating remote display protocols. Over time, forks and reimplementations emerged, inspired by projects such as FreeNX, Neatx, and Xpra, with commercial evolutions by NoMachine and integration into products from vendors influenced by Sun Microsystems virtualization and Citrix Systems remote application delivery. Development also tracked advances in compression algorithms from labs such as Bell Labs and standards work at IETF related to tunnelling and session negotiation.

Protocol architecture and components

NX relies on a layered architecture comprising a transport layer that can use TCP or UDP, a security layer using SSH or TLS, a multiplexing/session layer that aggregates X protocol streams, and a rendering/codec layer that handles image and drawing primitive compression. Core components include the NX broker, NX server, and NX client, along with session agents adapted for environments like GNOME, KDE, Xfce, and desktop managers such as LightDM and GDM. The protocol integrates with system services such as systemd and display servers including X.Org Server and, in some bridges, Wayland compositors. It supports authentication mechanisms interoperable with Kerberos, LDAP, and Active Directory.

Performance and features

NX emphasizes low-latency interactive performance with features like caching of X11 drawing primitives, adaptive compression based on bandwidth estimates, and client-side rendering optimizations. It supports session suspension and resumption, file transfer, audio forwarding compatible with PulseAudio and ALSA, printer redirection for CUPS-managed devices, and clipboard sharing with desktop environments such as GNOME and KDE Plasma. Performance tuning often references benchmarking with tools from Phoronix Test Suite and comparisons against protocols like RDP, VNC, and SPICE in virtualized environments such as KVM, Xen, and VMware ESXi.

Implementations and clients

Multiple implementations exist in both proprietary and open-source forms. Primary commercial implementations are provided by NoMachine and integrations in virtualization stacks from Oracle and Red Hat partners. Open-source alternatives and related projects include FreeNX, Neatx, Xpra, and client libraries used in ThinLinc environments. Clients span platforms including Microsoft Windows, macOS, major Linux distributions like Ubuntu, Fedora, and Debian, as well as mobile clients for Android and iOS provided by vendors or community ports. Third-party integrations have appeared in products from Dell, HP, and cloud services by Amazon Web Services and Google Cloud Platform via virtual desktop solutions.

Security and authentication

NX commonly leverages SSH for transport-layer encryption and authentication, with alternative TLS-based tunnels using certificates issued by authorities such as Let’s Encrypt or enterprise Microsoft Certificate Services. It supports public-key authentication, password-based login, and federated authentication through SAML and OAuth gateways integrated with identity providers like Okta and Azure Active Directory. Security considerations align with best practices from CIS benchmarks and guidance from agencies like NIST for cryptographic configurations and threat modelling against vulnerabilities disclosed in communities such as CVE and advisories by vendors like Red Hat.

Adoption and use cases

NX is used for remote administration, graphical application access, thin client deployments in education settings at universities like Stanford University and research labs such as CERN, and enterprise remote work scenarios employed by firms including IBM and Siemens. It fits applications in cloud desktops, high-performance computing visualization connecting to clusters managed with Slurm Workload Manager or HTCondor, and embedded systems where lightweight remote access is needed. NX’s efficiency makes it suitable for satellite offices and mobile workers connecting over cellular networks provided by carriers like AT&T and Vodafone as well as for disaster recovery and telemedicine applications coordinated with organizations like WHO.

Category:Remote desktop protocols