Port-block NAT44 with per-subscriber pressure sensing, plus NAT64 and MAP-T / MAP-E for IPv6-only access — in the same XDP data plane that terminates the subscriber.
per box with PPPoE, CGNAT, hierarchical QoS and ACLs all enabled
per packet through the data plane
at 256-byte frames — 33.6 Gbit/s at 64-byte worst case
separate CGNAT appliances, and no per-subscriber licence
Port blocks share one public address across many subscribers. Put your own numbers in and see what your pool has to be.
XDP (eXpress Data Path) is a high-performance networking technology in the Linux kernel that offers several highlights and features.
XDP operates at an early stage in the Linux networking stack, allowing for processing of packets at the network driver level before they reach higher layers of the stack. This results in extremely low-latency packet processing.
XDP programs are written in a restricted subset of C and are executed by the Linux kernel's BPF (Berkeley Packet Filter) virtual machine. This integration ensures the safe and efficient execution of user-supplied code within the kernel.
XDP enables programmability at the kernel level, allowing developers to define custom packet processing logic directly within the Linux kernel. This is particularly useful for tasks like packet filtering, load balancing, and network monitoring.
XDP runs the forwarding path in the kernel, before the network stack — which is where both the latency and the CPU cost normally come from.
On BNGSOFT that works out to roughly 500 ns per packet and 50 Mpps per box with PPPoE, CGNAT, hierarchical QoS and ACLs all enabled. Packet rate is the limit, so the bandwidth follows your average frame size: about 33.6 Gbit/s at 64-byte worst case, 110 Gbit/s at 256-byte frames, and roughly 144 Gbit/s at IMIX. Port capacity reaches 400 Gbit/s with two dual-port E810 cards.
XDP can be offloaded to certain types of network hardware, allowing for hardware acceleration of packet processing. This feature enhances performance by leveraging the capabilities of modern network interface cards (NICs).
XDP programs can implement custom packet filtering and forwarding logic, allowing for efficient and flexible network traffic management. This is particularly beneficial for implementing security policies and custom routing decisions.
XDP contributes to the scalability of networking solutions by optimizing packet processing. It allows for efficient handling of a large number of packets and supports scaling in scenarios with high network traffic.
XDP facilitates real-time monitoring and analytics of network traffic by allowing the capture and processing of packets within the kernel. This capability is valuable for gaining insights into network behavior and troubleshooting.
XDP supports both IPv4 and IPv6, making it compatible with modern networking protocols. This is crucial as the transition to IPv6 becomes more prevalent due to the exhaustion of IPv4 addresses.
XDP provides a flexible platform for developers to customize and extend networking functionalities. This enables tailoring of packet processing logic based on specific use cases and requirements.
While providing performance benefits, XDP also includes security features to ensure safe execution of user-supplied code within the kernel. This helps maintain the stability and integrity of the Linux operating system.
XDP has gained traction within the Linux and networking communities, with ongoing development and support. The community actively contributes to the improvement and expansion of XDP capabilities.
Every CGNAT datasheet answers the same easy questions. These six decide whether the deployment survives contact with real subscribers. Ask them of any vendor — ours are answered beside them.
Per-flow logging writes a record for every connection: terabytes a day on a busy edge, and the usual reason CGNAT logging quietly gets switched off. Ask for the figure at your subscriber count, not at the vendor’s.
Our answer: We log port-block allocations, not flows — one record when a subscriber gets a block, one when it is released. The same legal answer, a few thousand records a day instead of billions.
When a shared address lands on a blocklist or a game-server ban, every subscriber behind it feels it. Ask whether a single pool address can be withdrawn, and what that costs in downtime.
Our answer: We drop the address from the pool; subscribers on it move to another at their next block allocation. No restart, no re-NAT of live sessions.
EIM/EIF is what keeps peer-to-peer, console gaming, WebRTC and SIP working through a shared address. It is easy to claim on a datasheet and easy to drop under load. Ask for the behaviour with the table full.
Our answer: EIM with EIF, port parity and hairpinning, held at 50 Mpps with the rest of the feature set enabled.
A table size on its own means nothing without the memory per entry, the timeout policy, and the behaviour at the ceiling: refuse new connections, or evict established ones? Ask for both numbers.
Our answer: We size from measured per-subscriber flow counts rather than a worst case, and publish the RAM we hold to: 32 GB minimum, 64 GB at 40G, 128 GB at 100G, with every memory channel populated.
A separate CGNAT box is another hop, another failure domain, another licence, and a second place to correlate logs from. Ask whether translation runs in the same forwarding path as subscriber termination and shaping.
Our answer: PPPoE/IPoE termination, hQoS, ACLs and CGNAT are one XDP program on one box.
Throughput is usually quoted with features off and large frames. Packets per second is the real limit; Gbps follows frame size. Ask for pps with everything enabled, and the frame size behind any Gbps figure.
Our answer: 50 Mpps with PPPoE, CGNAT, hQoS and ACLs all enabled — 33.6 Gbps at 64-byte frames, about 144 Gbps at IMIX.
Optimising packet processing performance to handle a large volume of traffic efficiently.
Supporting the seamless expansion of network capacity to accommodate a growing number of users and devices.
Minimising packet processing time for swift and responsive broadband network operations.
Supporting both IPv4 and IPv6 protocols seamlessly to accommodate the transition to IPv6 and ensure compatibility with modern networking standards.
Ensuring the solution's reliability and stability, with robust error handling and failover mechanisms to maintain continuous network operation.
Allowing network operators to define and implement custom packet processing logic tailored to specific use cases and requirements.
Own high-security OS. Incorporating robust security measures within the XDP framework to ensure the integrity and confidentiality of network traffic.
Leveraging BPF maps for efficient sharing of state information between XDP programs and user-space applications, facilitating advanced networking scenarios.
Incorporating energy-efficient practices to minimize the environmental impact of networking operations, aligning with sustainability goals.
Striking a balance between high performance and cost-effectiveness ensures that the benefits of XDP BNG CGNAT are accessible and practical for a wide range of organizations.
Full support all around the world.
Providing comprehensive tools for real-time monitoring, analysis, and insights into network traffic for proactive network management.
Implementing user-friendly interfaces or tools for easy configuration, monitoring, and management of XDP programs and policies.
Leveraging hardware acceleration for XDP programs to maximize performance gains from modern network interface cards (NICs).
Designing the solution to be adaptable to various networking environments, including data centers, edge computing, cloud, and diverse deployment scenarios.
Minimum HARDWARE REQUIREMENTS:
32 GB RAM minimum (64 GB at 40G, 128 GB at 100G) with all memory channels populated | INTEL / AMD x86-64 | Intel X710 / XL710 / E810 or NVIDIA ConnectX-6 Dx (i40e, ice, mlx5 drivers) | Linux kernel 5.10 or newer | USB Flash / SATA DOM
XDP, or eXpress Data Path, is a technology within the Linux kernel that facilitates high-performance packet processing at an early stage in the networking stack. It is designed to optimize and accelerate the processing of network packets, offering a framework for developing custom packet processing logic directly within the kernel. Here are key aspects of XDP technology:
Early Packet Processing:
XDP operates at the driver level of the Linux networking stack, allowing for packet processing as soon as the packets are received by the network interface card (NIC). This early processing reduces latency significantly.BPF Integration:
XDP programs are written in a restricted subset of C and are executed by the Berkeley Packet Filter (BPF) virtual machine. BPF is a safe and efficient mechanism for running user-supplied code within the kernel, ensuring stability and security.Kernel-Level Programmability:
XDP enables programmability at the kernel level, allowing developers to define custom packet processing logic without relying on user-space applications. This is particularly useful for scenarios requiring fast and efficient networking operations.Performance Optimization:
XDP is designed for high performance, making it suitable for use cases where low-latency packet processing is crucial. By offloading certain networking tasks to the kernel, XDP improves overall system efficiency.Hardware Offload Support:
XDP programs can be offloaded to certain types of network hardware, leveraging hardware acceleration for packet processing. This feature enhances performance by utilizing the capabilities of modern network interface cards (NICs).Custom Packet Filtering and Forwarding:
XDP allows developers to implement custom packet filtering and forwarding logic. This flexibility is valuable for scenarios where tailored network policies, security measures, or custom routing decisions are required.Scalability:
XDP contributes to the scalability of networking solutions by optimizing packet processing. It efficiently handles a large number of packets, making it suitable for scenarios with high network traffic and a large number of connections.Real-Time Monitoring and Analytics:
XDP facilitates real-time monitoring and analytics of network traffic by allowing the capture and processing of packets within the kernel. This capability is beneficial for gaining insights into network behavior and troubleshooting.IPv6 Support:
XDP supports both IPv4 and IPv6, making it compatible with modern networking protocols. This is important as the transition to IPv6 becomes more prevalent due to the exhaustion of IPv4 addresses.Community Support:
XDP has gained popularity within the Linux and networking communities. The community actively contributes to its development, providing support, documentation, and sharing use cases.In summary, XDP is a technology that enhances packet processing capabilities in Linux environments, offering a platform for early, efficient, and customizable networking operations. It is particularly well-suited for scenarios where low latency and high-performance packet processing are essential.
It depends on your busy-hour throughput, your subscriber count and which features you enable. As a starting point: an 8-core box with a dual-10G X710 covers a small edge site, 16 cores with a dual-100G E810 covers around 100 Gbps, and a 2U dual-socket with two E810s covers about 200 Gbps. Reference builds and the full adapter matrix are on the Products page — or send us your peak throughput and we will size it against your own telemetry.
The POC is free for new customers.
It needs a request or contact our team with a query.
support@bngsoft.com
Six things the subscriber edge has to do, and one forwarding path that does all of them — the same XDP data plane on the same commodity server, with no separate appliance per function.
PPPoE and IPoE termination with RADIUS AAA, CoA applied to the live forwarding plane, QinQ access and per-subscriber hierarchical shaping.
Port-block NAT44 in the forwarding path — no per-flow connection tracking, one log record per block, and idle reclaim that tightens as the pool fills.
White-label streaming platform: CMS and playout, apps for Android and Android TV, VOD and live channels, visible and forensic watermarking.
Transit forwarding with eBGP and FRR as the routing authority, on the same commodity server. Design complete and reviewed — not yet running in a network.
Transparent caching and local peering for the traffic that is still cacheable — HTTP objects and P2P — billed on the upstream traffic it saves you.
Kernel, forwarding path and BNG daemon built from source into one signed artefact that boots to a RAM root. No package manager, no shell, no drift.
Seventeen technical briefs cover CGNAT and IPv4 continuity in detail.
There is no support tier between you and the engineers who built the forwarding path. When you report something in the data plane, it reaches the person who wrote that code path. More about how we work →
Contact us if you need a solution.
