Need Solution?
Contact us if you need a solution.
Not every deployment needs every stage. Pick a model below and see which parts of the forwarding path a packet actually touches — and what you switch on, or leave off, by choosing it.
Shaping and protection, no translation, no route lookups in the forwarding plane. The smallest footprint, for operators who already have public addressing sorted.
Model A plus carrier-grade translation, the firewall engine, port forwarding and the walled garden. Selected automatically when translation or firewalling is licensed and enabled.
Translation only. Subscriber and session management are skipped entirely — for dropping CGNAT in behind a BNG you are keeping.
Moving a node between roles is a configuration change on the same signed image, not a different product and not a different licence SKU.
Shaping and protection, no translation and no route lookups in the forwarding plane. The smallest footprint, and the right choice for an operator who already has public addressing sorted and only needs the subscriber edge.
Everything in model A plus carrier-grade translation, the firewall engine, port forwarding and the walled garden. This is the default, and the one the published 50 Mpps figure is measured with.
Translation only: subscriber and session management are skipped entirely. This is how you drop CGNAT in behind a BNG you intend to keep, without replacing anything you already run.
RX — the packet arrives in the network driver and the eBPF program runs there, before Linux allocates a socket buffer for it.
PARSE — headers are read: VLAN tags, PPPoE, IP, the transport header.
CLASSIFY — the subscriber behind the packet is identified and the policy that applies to them is fetched.
TRANSLATE — carrier-grade NAT: port-block allocation, NAT64 and MAP-T for IPv6-only access.
PROTECT — the filtering engine: ACLs, port forwarding, the walled garden.
SHAPE — hierarchical QoS: the per-subscriber queue and every rate above it.
TX — the packet leaves, ideally without ever having become a socket buffer.
Moving a node between these roles is a configuration change on the same signed image — not a different product, and not a different licence SKU. How the data plane is built.
Contact us if you need a solution.