Teams migrate from NetX Duo as Eclipse support model shifts

Embedded teams are reevaluating their TCP/IP middleware as the Eclipse Foundation’s support model for the former Azure RTOS components matures. The shift is prompting some developers to migrate from NetX Duo to wolfIP, a commercially backed alternative with built-in TLS and FIPS-validated cryptography.

What changed with NetX Duo

NetX Duo, the TCP/IP stack originally part of Microsoft’s Azure RTOS, moved to the Eclipse Foundation in 2025 under the Eclipse ThreadX project. The latest release, version 6.5.1, remains actively maintained, but governance now rests with a community-driven roadmap rather than a single vendor. While the stack is not deprecated, the absence of a published long-term support policy or commercial support contracts has become a concern for device manufacturers facing decade-long product lifecycles and heightened supply-chain scrutiny under regulations like the EU Cyber Resilience Act.

Why teams are migrating

Engineers cite three main drivers for replacing NetX Duo. First, the stack’s interdependence with other Azure RTOS components—ThreadX, USBX, and FileX—means changes to one often require updates to all, complicating maintenance. Second, the lack of commercial support leaves teams without a contractual backstop for field failures. Third, NetX Secure’s TLS implementation, while functional, relies on an in-house cryptographic library without FIPS validation or post-quantum readiness, making it harder to pass modern security audits.

wolfIP, developed by wolfSSL, addresses these gaps by offering a BSD-style socket API familiar to embedded engineers, static memory allocation to avoid runtime sizing, and built-in support for IPv4 TCP/UDP, ICMP, DHCP, and DNS. Security features include IPsec ESP, WireGuard VPN (via wolfGuard), and an HTTP server with wolfSSL TLS. The stack also provides in-tree Wi-Fi supplicants for WPA2-Enterprise and WPA3, along with ports for STM32, NXP, AMD, and LPC54S018 microcontrollers running FreeRTOS, Zephyr, or bare metal. DO-178C certification is in progress, and commercial licenses with 24/7 support are available.

Migration path and trade-offs

Teams already using BSD-style sockets can retain most application code, as wolfIP’s API surface—connect, send, receive, close—mirrors NetX Duo’s. The primary changes involve replacing NetX Duo’s memory-argument initialization (nx_ip_create) with wolfIP’s static instance and adapting the thread model to wolfIP’s main loop (poll + receive) with socket callbacks. Porting the network interface controller (NIC) and validating DHCP, TCP throughput, and reconnect behavior are the key verification steps.

What to watch

The Eclipse ThreadX project’s long-term trajectory remains unclear. While the community continues to release updates, the contributor base is small, and governance decisions may not align with commercial priorities. For teams prioritizing regulatory compliance or extended support windows, commercially backed alternatives like wolfIP are likely to gain traction. Meanwhile, wolfSSL’s DO-178C certification could position wolfIP as a preferred choice for aerospace and medical device manufacturers, where formal certification is mandatory.