BNGSOFT PRODUCTS

Carrier BNG, CGNAT and edge routing — as software, on hardware you already buy.

50 Mpps per box with PPPoE, CGNAT, hQoS and ACLs all enabled. No appliance, no line cards, no per-subscriber licence.

Kernel depth, not workarounds

When a NIC driver misbehaves at line rate, the fix goes into the driver — not around it.

Patched in days, not release trains

Security fixes ship as software. No line-card refresh and no waiting on a silicon vendor.

No licence tied to hardware

Buy the server you want. Nothing in the licence counts your subscribers or pins you to a chassis.

Prove it on your hardware

A proof of concept runs on your own x86 against your own traffic.

One forwarding path, not four appliances

Subscriber termination, address translation, hierarchical shaping, filtering and border routing — all of it on one commodity server, with no per-subscriber licence tied to hardware.

WHAT THIS REPLACES BRAS / BNG chassis + line cards CGNAT appliance per-subscriber licence Shaper / QoS separate box Firewall / DDoS scrubbing hop 4 hops · 4 licences 4 failure domains ONE COMMODITY x86 SERVER OrionOS signed image · RAM root · kernel + forwarding path + BNG daemon SINGLE eBPF PROGRAM AT THE XDP HOOK — ONE PASS, NO TAIL CALLS RX NIC driver DMA PARSE S-tag · C-tag PPPoE · IP CLASSIFY subscriber lookup TRANSLATE port-block NAT no conntrack PROTECT uRPF · ACL DDoS SHAPE policer · IFP AQM · L4S TX redirect The kernel network stack is never entered. Nothing is copied to userspace. The packet leaves from the same driver it arrived on. SUBSCRIBER SIDE PPPoE / IPoE · QinQ · 100.64.0.0/10 · IPv6 PD UPSTREAM public IPv4 pool · native IPv6 50 Mpps measured with PPPoE, CGNAT, hQoS and ACLs all enabled at once ~500 ns cumulative per-packet cost across the whole pass 1 program not a service chain — every stage runs on the same packet, once

Select a stage to see what it actually does

What runs on the box

Every capability below runs in the same eBPF program, on the same packet, in the same pass. Nothing here is a separate appliance, a licence tier, or a feature that costs you another hop.

Subscriber termination

PPPoE and IPoE on the same node, with the access encapsulation you already run.

  • PPPoE with PAP/CHAP, each session on its own subscriber netdev; IPoE keyed by IP
  • 802.1Q and QinQ — outer service tag, inner customer tag, past the 4094-VLAN ceiling
  • VLAN monitoring creates a subscriber VLAN on the first packet it sees
  • RADIUS auth and accounting: Framed-IP-Address, Framed-Route, vendor rate-limit, interim updates
  • CoA and Disconnect-Message applied to the live forwarding plane — no reconnect
  • DHCPv4 with Option 82, DHCPv6 with router advertisements and prefix delegation
  • LACP bonds, resolved to the active member in the forwarding path

Address translation

Port blocks, not per-flow connection tracking — which is what keeps the log volume and the state small.

  • Port-block NAT44 with configurable block size and a per-subscriber block ceiling
  • RFC 4787 filtering: endpoint-independent, address-dependent, address-and-port-dependent
  • Pressure-adaptive reclaim — idle timeouts tighten as a pool fills, with a hard TCP floor of 120 s
  • A block returns to the pool the moment its last session closes
  • Native hairpin, TCP MSS clamping on both families, exempt-destination lists
  • PCP (RFC 6887) and NAT-PMP (RFC 6886) so consoles and RTC apps map their own ports
  • One log record per port-block allocation, not one per flow

Hierarchical QoS

Three levels of shaping, and a queue measured by how long packets sit in it rather than how deep it is.

  • Licensed global cap → VLAN-group aggregate → per-subscriber, per-class
  • Nine traffic classes matched on destination prefix or port — no DPI at any layer
  • Token-bucket policing per direction per class, with an operator-set burst budget
  • CoDel-style AQM driven by a sojourn-time target of roughly 5 ms
  • L4S ECN marking with the RFC 9332 coupling factor operator-settable, both address families
  • Interactive Flow Protection keeps bare ACKs, SYNs, DNS and small VoIP/gaming packets out of the bulk queue
  • Off-peak boost from RADIUS, time-of-day schedules, live rate override

Edge security

Source validation and DDoS containment in the same pass that forwards — no scrubbing hop to trombone through.

  • BCP 38 / uRPF against the exact IPv4 and IPv6 the session actually holds, allow-listed from the live session table
  • Priority-ordered ACL chains on address, prefix, port range and protocol, with per-rule hit counters
  • Inbound DDoS keyed on victim and vector: solicited traffic is passed before it is ever counted
  • Escalation ladder monitor → limit → block, decaying back one step at a time once the flood stops
  • Outbound abuse containment for compromised CPE — a rate floor, not a cut
  • Every one of these ships observe-first; you turn enforcement on when you have seen the logs

Running it

Upgrades that keep the sessions, and enough telemetry to answer a subscriber complaint without a packet capture.

  • ISSU: the new program is verified against the tables live on that box, adopts them, and the kernel switches attachment atomically
  • The old program is never detached first, so the driver ring is never torn down
  • Per-subscriber diagnostics down to blocks used, ports in use, loss, transit and access RTT
  • Syslog and IPFIX from the same event stream, to your own collectors
  • JSON metrics file rewritten atomically for your existing collector agent
  • Config is schema-validated — a mistyped key is caught, not silently ignored

One image, three roles

The same signed image runs at every position in the network. What a node does is decided by which stages you licence and enable — not by which box you bought.

STAGES ACTIVE IN THE FORWARDING PATH Model A Subscriber gateway RX PARSE CLASSIFY TRANSLATE PROTECT SHAPE TX Model B Full data plane · default RX PARSE CLASSIFY TRANSLATE PROTECT SHAPE TX Model C Standalone translation node RX PARSE CLASSIFY TRANSLATE PROTECT SHAPE TX

Model A — Subscriber gateway

Shaping and protection, no translation, no route lookups in the forwarding plane. The smallest footprint, for operators who already have public addressing sorted.

Model B — Full data plane

Model A plus carrier-grade translation, the firewall engine, port forwarding and the walled garden. Selected automatically when translation or firewalling is licensed and enabled.

Model C — Standalone translation

Translation only. Subscriber and session management are skipped entirely — for dropping CGNAT in behind a BNG you are keeping.

Moving a node between roles is a configuration change on the same signed image, not a different product and not a different licence SKU.

What it does, and on what

50 Mpps is the measured ceiling with PPPoE, CGNAT, hierarchical QoS and ACLs all switched on at the same time — not a stateless forwarding number with the features turned off. Everything below follows from it.

33.6Gbit/s

at 64-byte frames, with the engine held at 50 Mpps

0200 Gbit/s400 Gbit/s — port ceiling

The packet rate is what the engine is held to. The bit rate is arithmetic on top of it: wire_bits = (frame_bytes + 20) × 8, then Gbps = pps × wire_bits ÷ 1e9. The 20 bytes are preamble, start-of-frame delimiter and inter-frame gap. Past about 980-byte frames the adapters saturate before the engine does.

Reference builds

BuildAdapterCPURAMCapacitySubscribersPower
Edge 1UIntel X710-DA2 · i40e8-core32 GB~20 Gbps~6,700~250 W
Standard 1UIntel E810-CQDA2 · ice16-core64 GB~100 Gbps~33,000~380 W
High-density 2U2 × E810-CQDA2 · ice2 × 16–24-core128 GB~200 Gbps~64,000~650 W
SmartNIC 2UConnectX-6 Dx · mlx524-core128 GB~200 Gbps~64,000~600 W

Adapters and drivers

AdapterPortsPCIeDriverXDP mode
Intel X710-DA22 × 10GGen3 ×8i40enative
Intel XL710-QDA22 × 40GGen3 ×8i40enative
Intel E810-CQDA22 × 100GGen4 ×16icenative
NVIDIA ConnectX-6 Dx2 × 100/200GGen4 ×16mlx5native
VMware vmxnet3vmxnet3generic only — no native path

Sizing basis

Subscriber figures above assume roughly 3.2 Mbps per subscriber at busy hour, which is the median we measure across production gateways. Size your uplinks from your subscriber count; size your CPU from your own telemetry.

Memory

32 GB minimum, 64 GB at 40G, 128 GB at 100G and above — with every memory channel populated. The tables that hold sessions, port blocks and the flow cache all live in RAM.

What actually limits you

On a well-configured node it is usually the PCIe link and the port, not the processor. A dual-40G card on a Gen3 ×8 slot shares about 56 Gbps of usable bus bandwidth between both ports.

Platform

x86-64, Intel or AMD. Kernel 5.10 is the minimum and 6.x is recommended. The image ships as one artefact — you do not install it onto a distribution you already run.

Our Services

Solutions & Focus Areas

Eight things the subscriber edge has to do, and one XDP data plane that does them. Each card links to the technical brief behind it — and says plainly where it stands.

XDP CGNAT

Port-block NAT44 in the forwarding path — no per-flow connection tracking, one log record per block, and idle reclaim that tightens as the pool fills.

SHIPPING

vBNG / BRAS

PPPoE and IPoE termination with RADIUS AAA, CoA applied to the live forwarding plane, QinQ access and per-subscriber hierarchical shaping.

SHIPPING

OrionOS — hardened carrier image

Kernel, forwarding path and BNG daemon built from source into one signed artefact that boots to a RAM root. No package manager, no shell, no drift.

SHIPPING

Internet acceleration

Transparent caching and local peering for the traffic that is still cacheable — HTTP objects and P2P — billed on the upstream traffic it saves you.

SHIPPING

IPTV / OTT

White-label streaming platform: CMS and playout, apps for Android and Android TV, VOD and live channels, visible and forensic watermarking.

SHIPPING

Edge security

BCP 38 source validation, ACL chains and victim-and-vector DDoS containment — all in the same pass that forwards the packet, with no scrubbing hop.

SHIPPING

BGP border router

Transit forwarding with eBGP and FRR as the routing authority, on the same commodity server. Design complete and reviewed — not yet running in a network.

IN DEVELOPMENT

IPv6 transition

NAT64, MAP-T and MAP-E wired end to end in the shipping image and selected by one config key. Implemented and lab-validated — not yet deployed in production.

IN VALIDATION
About BNGSOFT

Ten people who wrote the data plane

There is no support tier between you and the engineers who built the forwarding path. When you report something in the data plane, it reaches the person who wrote that code path. More about how we work →

Need Solution?

Contact us if you need a solution.