Setting up a measurement node

One command and your machine measures along in the network — without giving away anything about itself.

A measurement node measures outward: reachability, latency, paths through the network, name resolution. It is something different from the security agent — and since phase 90 a device type of its own, not a switch on an existing device.

What it does, and what it does not #

It runs with exactly one capability: CAP_NET_RAW, to send ICMP packets. Nothing else. The security agent needs root because it reads the system; here that would be a privilege escalation without purpose.

Setting one up #

Under Sonar → Nodes → Set up a measurement node you get an enrolment token. It is valid for one hour and exactly once.

curl -sSL https://get.node64.de/sonar.sh | NODE64_SONAR_TOKEN=… sh

As a container — no --privileged, no host network mode, no mounted root filesystem:

docker run -d --name node64-sonar --restart unless-stopped \
  -e NODE64_SONAR_TOKEN=… \
  --cap-add NET_RAW \
  -v node64-sonar-state:/var/lib/node64-sonar \
  node64/sonar:latest

Both agents may run on the same machine. They share nothing: own binaries, own directories, own configuration, own services. Stopping the measurement network does not stop the security check.

How many nodes you get #

As many as you like. Since 22 August 2026 the measurement network has no limit from the price list — not even on the Free plan.

Until then there were numbers here: two, five, ten. The reasoning was that a single account should not dominate the network. The thought is right, only the plan was the wrong tool — a limit that counted what someone pays, and held back precisely those who want to contribute a lot.

Against domination of the network there is the rule that actually means it: a single source may only contribute up to a fixed share of the overall picture. It counts measurements, not invoices. On top of that come the same caps as everywhere else in the network — per target, per probe, per account and globally — and automatic abuse detection.

Measurement nodes also count separately from devices — running three servers and two nodes uses no device slots.

Location #

A node without a location cannot be drawn on the map and is useless as a reference point. Three ways:

1. From the browser — one click; the browser asks for permission itself.
2. From an address — street, postcode, town become coordinates.
3. By hand — latitude and longitude directly.

Where nothing is given, NODE64 estimates: from the node's DNS name, otherwise from the address database. An estimate looks different in the list from a statement — it carries a question mark. And it never overwrites what you entered yourself.

Updating #

An arrow icon next to the reported version in the node list means a newer one exists. The same script as for setting up fetches it — no token needed, because the node is already registered and stays that way:

curl -sSL https://get.node64.de/sonar.sh | sh

This replaces the program and the service and leaves the registration untouched — the machine's fingerprint stays the same, so does its identity, reliability and role. A token is only needed to register anew.

No auto-update. The agent never fetches anything on its own — nothing happens unattended. Same decision as for the security agent: whoever types the command decides when.

If the icon is missing, the running version is current — or NODE64 doesn't know it yet (right after setup, for instance). No icon then doesn't mean "outdated but unnoticed" — it means "nothing to compare".

Reinstalling #

The node recognises itself by a fingerprint of the machine. A reinstallation — whether to update or for another reason — therefore creates no second node — identity, reliability and role stay. The reputation builds up over months and is the actual value of a probe.

Removing #

curl -sSL https://get.node64.de/sonar.sh | sh -s -- --uninstall

The state under /var/lib/node64-sonar stays behind — it carries the identity. Anyone who really wants everything gone deletes the directory by hand.