Abstract
The claim begins with a question, not a headline.
Research question / RQ-09
Can external network intelligence become a bounded local decision while preserving IPv4/IPv6 correctness, update isolation, and epistemic caution?
Geo and reputation context is useful only if lookup is predictable and provenance remains visible. Hyx compiles external datasets into local range tables, keeps request-time lookup offline, and treats category membership as evidence rather than guilt.
Method
Inspect parsing, merge, mapped-address routing, binary lookup, differential tests, update behavior, and verified-bot matching; then run focused suites and available release benchmarks.
Finding
Sorted, merged local tables turn enrichment into a deterministic memory lookup. Correctness is constrained with naïve-oracle comparisons and explicit IPv4/IPv6 boundaries.
Disclosure boundary
The study names public data classes and observable lookup behavior but does not expose production list composition, update cadence, or private weighting policy.
System boundary
External data is compiled before it reaches the hot path.
S-01 / system topology
fetch / normalize / verify / swap / lookup
Acquire
Public reputation lists and geolocation databases enter a controlled update path with source-specific parsing and validation.
Normalize
CIDRs become ordered ranges; adjacent or overlapping intervals can be merged while IPv4 and IPv6 remain distinct address spaces.
Publish
A completed table replaces the previous snapshot so requests never traverse a partially updated dataset.
Enrich
Binary local lookup attaches category, location, ASN, or verified-bot context without a request-time external service call.
Controlled measurement
The available benchmark is fast but too small to stand in for the main tables.
M-01 / host-local evidence
release mode / scoped result
| Measurement | Observed | Scope |
|---|---|---|
| 01Verified-bot lookup | 9.61ns | 8-bot table · 104M lookups / second |
| 02FireHOL focused suite | 31 passed | 2 benchmarks ignored by default |
| 03GeoIP focused suite | 13 passed | 2 benchmarks ignored by default |
| 04FireHOL large-list benchmark | not observed | required netset absent |
| 05GeoIP/MMDB benchmark | not observed | required database absent |
The verified-bot table ran in release mode. FireHOL large-list and GeoIP/MMDB benchmarks skipped because their external datasets were unavailable on this host.
Findings
The table can be exact even when the source is uncertain.
Lookup is local
No remote enrichment dependency sits between a request and its network context once a snapshot is published.
Range math is testable
Optimized lookups are compared with straightforward reference implementations across overlap and boundary cases.
Mapped IPv4 is deliberate
IPv4-mapped IPv6 addresses route into the intended address family rather than missing or colliding with native IPv6 ranges.
Category is not verdict
A list can be stale, broad, or wrong. Membership becomes one named signal for policy and attribution, not automatic guilt.
Correctness and safety
Updates fail outside the request path; old snapshots remain coherent.
Parse before publish
Malformed source data cannot create a half-built table visible to requests.
Differential oracle
Optimized range lookup is checked against a naïve reference across generated addresses and boundary conditions.
Family isolation
IPv4, native IPv6, and mapped IPv4 handling are explicit rather than dependent on byte-order accidents.
Fail-coherent snapshot
An update failure leaves the prior completed table usable instead of turning enrichment into an availability failure.
The repository supports bounded, correct local enrichment and a very fast small verified-bot lookup. It does not support a public large-table performance comparison on this host because the required third-party datasets were absent.
Interpretation
The evidence boundary is part of the result.
Main benchmarks skipped
The FireHOL netset and GeoIP MMDB files were unavailable, so no large-list or flat-table-versus-MMDB number is reported.
Source uncertainty
Reputation and geolocation datasets can be delayed, coarse, overbroad, or inconsistent with rapidly changing network ownership.
Small bot table
The 9.61ns measurement covers eight verified-bot entries and cannot predict lookup cost for every production dataset.
Evidence register
Every public claim keeps its provenance attached.
Focused suites
FireHOL reported 31 passing tests and GeoIP 13, with zero failures across range, family, parser, and lookup behavior.
Flat tables
Both subsystems use sorted local ranges and binary lookup, with explicit IPv4, IPv6, and mapped-address behavior.
Differential testing
Optimized lookups are constrained by tests against naïve reference implementations and edge-address cases.
Benchmark disclosure
The verified-bot benchmark measured 9.61ns; the primary external-dataset benchmarks explicitly skipped on this host.
References / Harvard style
MaxMind DB
MaxMind (2026) MaxMind DB File Format Specification. Available at: maxmind.github.io (Accessed: 11 July 2026).
Open source ↗Reference / 02FireHOL IP lists
FireHOL (n.d.) FireHOL IP Lists. Available at: iplists.firehol.org (Accessed: 11 July 2026).
Open source ↗Reference / 03IPv6 addressing
Hinden, R. and Deering, S. (2006) IP Version 6 Addressing Architecture. RFC 4291. Internet Engineering Task Force.
Open source ↗Research archive
Return to the systems studies.
Mechanisms, measurements, and the limits required to interpret both.