You are putting your subscriber base on someone else's forwarding path and betting that when it breaks, they will fix it rather than file it. Every vendor's datasheet is written by the same people, to the same template, with the same adjectives. The difference between them shows up eighteen months later, at 3am, in a layer the datasheet never mentioned.
OS + driver
not just the app
the layers we fix
Published
patch record, dated
not a promise
No phone home
forwarding never asks us
commercially isolated
Your hardware
your traffic, reversible
how a PoC runs
The question is not whether the software works in the demo. It is who owns the bug when it is three layers below the thing you bought.
1 · We fix the layer below
Most edge software vendors ship an application. When the fault turns out to be in the network-card driver, or the kernel, or the way the NIC handles a particular ring configuration under load, the answer is a support ticket pointed at somebody else — and you are now the person carrying a message between two vendors who each believe it is the other's problem.
We ship the operating system as well as the data plane. That is not a marketing arrangement; it changes who is obliged to fix things.
Owning the OS is what makes the support model different. A defect in a NIC driver under sustained subscriber load is ours to reproduce and ours to patch, and it ships to you through the same signed update channel as everything else. You do not get handed to a third party.
2 · The patch record, not the patch promise
Anybody can write “regular security updates” on a slide. It costs nothing and commits to nothing. The useful version is a dated record you can inspect before you buy, and then keep checking after you have bought — because the second one is what tells you whether the first one was true.
What to do with this. Ask any vendor for their release history with dates, and ask what the gap was between a published CVE in a component they ship and the build that fixed it. If the answer is a policy rather than a list, you have learned something.
3 · We operate fleets, so problems surface in monitoring rather than in your call centre
NOC2 is not a dashboard we sell and walk away from. Gateways report continuously, and the platform is built to distinguish the cases that actually look identical from the outside: a box that is down, a box that was drained on purpose, a box that never carried a subscriber, and a box that is up and quietly not doing the thing it was bought for.
That last category is the one worth paying attention to, because nothing alarms. A capability can be written in the config, loaded by the daemon, reported healthy, and still permitting every packet it was bought to stop. Most consoles show one green tick for three different states. We wrote a whole brief about how we learned the difference — including a fault our own audit invented by reading a setting that had never been written.
Continuous, not on-demand
Gateways report on a cycle rather than when someone remembers to look, which is why a degradation tends to appear as a trend before it appears as a complaint.
Ranked by who is affected
Alerting ordered by live subscriber impact, not by which box is noisiest. Two drained gateways and a never-commissioned one rank below one carrying traffic.
4 · When we are wrong, we publish the correction
Our briefs carry method, not just results: sample windows, what was measured, what was assumed, and where a competitor is ahead of us. The capability catalogue marks every function as active on delivery, configured at commissioning, conditional, or roadmap — because “supported” is not a useful word when it can mean any of those four.
When a published figure turns out to have been measured under conditions that do not hold, we correct the page rather than quietly leaving it up. That is an unglamorous commitment and it is the one most worth checking, because it is the only one you can verify from the outside before signing anything.
5 · Nothing calls home
The gateway does not require our licence server to keep forwarding packets. There is no cloud dependency in the data path, no periodic entitlement check that can fail closed at an inconvenient moment, and no telemetry obligation.
If BNGSOFT were unreachable tomorrow
What happens
Subscribers stay connected
Yes — forwarding has no dependency on us
CGNAT, QoS and security keep running
Yes — all in the local data plane
You keep your console
Yes — NOC2 runs against your gateways
You lose new builds and support
Yes — that is what you are buying
Why procurement asks this first. It separates “the vendor is a supplier” from “the vendor is a single point of failure in the forwarding path”. Plenty of platforms fail that question and their datasheets do not mention it.
6 · What the first ninety days look like
No flag day. The proof of concept runs beside your incumbent rather than replacing it, and the cutover moves one VLAN at a time with your existing RADIUS still acting as the contract. The migration brief describes what can and cannot be made seamless, including the one thing that cannot.
Pricing: tell us three things and we will quote.
The licence is quoted per deployment because a single published number would be wrong for almost everyone — it depends on subscriber count, which functions you switch on, and whether this is one gateway or an estate.
Hardware is roughly $0.14–0.37 per subscriber depending on the node, bought from your usual supplier and excluded from our licence entirely. Send us subscriber count, peak throughput and the functions you need, and you get a real figure back.
Including us. If a vendor cannot answer these in writing, that is the answer.
If your company disappeared tomorrow, do my subscribers stay connected?Separates a supplier from a single point of failure in your forwarding path.
Which layers of the stack do you patch yourself, and which do you escalate?Determines whether a driver bug is your problem or theirs.
Show me your release history with dates.A policy is a promise. A dated list is a record.
At what frame size was your headline throughput measured?A Gbps figure without a frame size is unfalsifiable and therefore useless.
Which features are active on delivery, and which are configured at commissioning?“Supported” can mean shipped, configurable, conditional or roadmap. Make them say which.
How do I tell a gateway that is down from one that is up and not enforcing?The second is the dangerous state and most consoles show both as one green tick.
Can the proof of concept run on my hardware, with my traffic, and be reversed?If it needs their appliance in your rack, the trial is already a commitment.
Name something a competitor does better than you.A vendor who cannot is either not paying attention or not being straight with you.
Start with a proof of concept. It runs on your own x86 hardware against real subscriber traffic, beside the platform you already have. Tell us your subscriber count and peak throughput and we will size it, quote it, and hand you a build to test.
About the figures. Hardware cost guidance of ~$0.14–0.37 per subscriber covers commodity server plus NIC across edge, mainstream and high-density node types, and excludes the BNGSOFT licence, which is quoted per deployment. Performance and sizing claims referenced here are stated with their method in the performance, sizing and comparison briefs, including frame size and which features were enabled during measurement. The capability catalogue records delivery status per function and includes a sourced comparison against published competitor documentation, with concessions where a competitor is ahead.