Subscriber Edge on Commodity Servers
Broadband Gateway · CGNAT · QoS · Protection

Autopilot · Self-Configuring Subscriber Edge

There are 214 settings. You should have to think about none of them.

Queue management, interactive-flow protection, fair dropping, fault isolation, flood thresholds — each has knobs, each interacts with the others, and the right value depends on traffic that changes by the hour. Autopilot is the gateway tuning its own settings against one measured outcome: how your subscribers' connections actually behave under load. With a rule most self-tuning does not have — it must prove a setting helps on your network before it is allowed to affect a single subscriber.

objective. Every tuner optimises the same measured number — subscriber latency under load — not its own activity counter

stages per feature — off, observe (measures what it would do), enforce. Nothing skips a stage

settings taken away. Any knob you set by hand is yours permanently — autopilot will not overwrite it, ever

OFF

by default. A gateway with autopilot off behaves identically to one built before autopilot existed

What runs today, and what is still being built

This page describes a direction of travel, and it separates the two clearly rather than blurring them. Parts of this already run in production. The single switch does not exist yet.

Capability	Status	Detail
Adaptive queue management	Shipping	A closed-loop controller already steers the queue-management aggressiveness against a latency target, continuously, on live gateways. It has deadband and limits so it settles instead of oscillating.
Automatic per-subscriber remediation	Shipping	Fault isolation already runs off / observe / enforce and can act on subscribers whose behaviour has drifted from their own normal.
Automatic interrupt balancing	Shipping	On by default. The gateway distributes its own packet-processing load across CPUs.
Subscriber experience score	Shipping	The gateway already measures loaded latency per subscriber and reduces it to one number — the objective everything else would be tuned against.
One switch for the whole gateway	In development	Today each of the above is configured separately. The single control is designed, not delivered.
Self-proving promotion	In development	The rule described in section 4 — a feature must measure its own benefit before it may enforce.

We would rather show you the seam than paint over it. If a capability below is marked in development, it is not running on anyone's network today, including ours.

The page in six lines

Correct settings are not knowable in advanceThey depend on your traffic mix, your oversubscription, and the hour of the day. A number chosen at install is wrong by evening. Section 1.

The gateway already measures what actually mattersNot throughput, not drop counts — the latency real subscribers experience while their line is busy. Section 2.

One objective, many knobsEvery tuner optimises the same number, so they cannot each declare victory while the customer's experience gets worse. Section 3.

A feature must earn the right to actIt runs in observe, measures itself against itself on your traffic, and only then may it enforce — and it is demoted if it stops helping. Section 4.

Manual control is not a downgrade pathSet a knob by hand and it is yours. Autopilot may disagree in writing; it may not act. Section 5.

It is not AI, and it does not create capacityIt is closed-loop control with an honesty rule. It cannot fix an undersized network. Section 6.

01 Why the right settings cannot be shipped in a config file

Every congestion control has a number in it. How much delay to tolerate before acting. How small a connection has to be to count as interactive. How many packets per second constitute a flood. None of those numbers has a correct value that is true everywhere.

The right delay target depends on how far your subscribers are from the content they use. The right interactive threshold depends on whether your evening traffic is video calls or game traffic or streaming. The right flood threshold depends on what your normal looks like — and a threshold set for a quiet Tuesday will either fire constantly on Saturday or never fire at all.

So the settings get chosen once, at install, by whoever was on the call — and then they stay. They are not wrong because anyone was careless. They are wrong because they were fixed and the network was not.

What this costs you in practice. Features that were bought and installed sit switched off because nobody is confident what value to give them. Others are switched on with defaults that were never checked against the traffic they now run on. Neither shows up as a fault — it shows up as a service that is merely adequate.

02 The number worth optimising

Most equipment reports what it did: packets marked, packets dropped, sessions inspected. Those are activity. Activity is not benefit, and confusing the two is the single easiest mistake to make in this field.

A queue manager that drops more packets is not working harder for the customer; it may simply be misconfigured. A protection feature with impressive counters may be acting constantly on traffic that was never a problem. The counter goes up either way.

The gateway already measures something better: the latency subscribers actually experience while their line is under load, gathered per subscriber and reduced to a single score. That number moves when the customer's experience moves, and it does not move when a counter merely ticks.

Autopilot optimises that score and nothing else. Activity counters remain available for diagnosis, and are never a target. A change that increases activity but does not improve the score is rejected — not accepted with a footnote.

Three limits are enforced alongside it, so the loop cannot win by breaking something adjacent: throughput must not fall, total packet loss must not rise, and CPU headroom must be preserved. A candidate setting that improves latency by damaging any of those is discarded.

03 Two kinds of setting, two kinds of tuning

Not everything can be tuned the same way, and pretending otherwise is how self-tuning systems get a bad reputation.

Dials — continuous values

Delay targets, aggressiveness, thresholds. These have a direction: a bit more, a bit less. A control loop can steer them the way a thermostat steers a room — measure the error, correct proportionally, stop correcting near the target so it does not hunt.

This already runs for queue management, with the limits and damping that keep it stable.

Switches — on or off

A feature is either running or it is not. There is no "slightly enabled", so there is nothing for a control loop to steer. These need a different method entirely: run the network with it, run the network without it, and compare.

That comparison is the subject of the next section, and it is the part we consider load-bearing.

04 The rule: a feature must prove itself on your traffic

This is the part that distinguishes autopilot from a box that simply switches things on for you. A feature may not affect a single subscriber until it has measured its own benefit, on your gateway, against your traffic.

How a feature earns enforcement

OffThe starting state for everything. Nothing is running.

Observe — free, and honestThe feature evaluates every packet and records what it would have done, without changing any outcome. No subscriber is affected. This is where the comparison happens.

The comparison, run properlyAlternating periods with the setting and without it, in both orders, returning to the starting condition at the end. A result only counts if it survives all of that.

Enforce — on probationOnly after a measured improvement. Evaluation continues; if the benefit disappears, the feature is demoted automatically and the reason is logged.

The alternation matters more than it sounds. Traffic drifts continuously — it is heavier at nine than at eight, lighter on Sunday than on Thursday. Measure a setting for ten minutes, change it, and measure again, and much of what you observe is the clock, not the setting. Running both orders and returning to the starting condition is what separates the two.

We hold our own features to this. One of our congestion features is measured, reproducible, and demonstrably active on live gateways — and it has not yet demonstrated a latency improvement we can attribute to it rather than to the time of day. Under the rule on this page it would remain in observe on every gateway we run. We would rather tell you that than let a counter that moves stand in for a benefit that has not been shown.

05 Manual control: the operator always wins

Autopilot is an assistant with no authority. Anything you set by hand becomes yours, permanently, and autopilot stops touching it. There is no separate step to remember and no timer after which it takes the knob back.

You want	What you do
Everything manual, as today	Leave autopilot off. This is the default. The gateway behaves exactly as one built before autopilot existed — no background loop is steering anything.
Advice, but no action	Set autopilot to observe. It reports what it would change and what it expects that to buy you, and changes nothing.
Automatic, except one thing	Set that one setting by hand. It is now pinned to your value. Everything else continues to be managed.
Automatic, except one subsystem	Turn autopilot off for that subsystem alone. The rest carries on.
To hand a setting back	Release it explicitly. Giving control back is the surprising direction, so it requires saying so.

Three guarantees we consider non-negotiable, because without them nobody should trust a system like this:

Your file stays yours

Autopilot never writes your configuration file. Read it and you see your intent, not a machine's latest guess. Diff it against a backup and you see your changes, not churn.

A pinned setting is never overwritten

Not on reload, not on restart, not when autopilot is confident you are wrong. You may have pinned it for a reason it cannot see — a complaint, a regulator, a peering quirk.

Disagreement is written down, not acted on

If your value measures worse, it says so once, with the numbers, and does nothing further. No nagging, no silent correction, no temporary override.

And it will always tell you what is in effect. For every setting: the value being used, who chose it — you or autopilot — and whether that matches what is saved to disk. A setting that is live but not saved is flagged, because "I set it, it worked, and it came back wrong after a reboot" is a support call nobody should have to make.

06 What autopilot is not

Not this	What is actually true
Not artificial intelligence	It is closed-loop control — the same category of thing as a thermostat or a cruise control — plus a rule that a change must demonstrate a measured benefit before it is kept. There is no model, nothing is trained, and no data leaves your gateway.
Not extra capacity	It changes how a shortage is managed. It cannot manufacture bandwidth, and on a link that is permanently oversubscribed the honest answer remains capacity.
Not deep packet inspection	It tunes the settings of features that already run. It does not identify applications and it does not read payloads. Encrypted traffic is treated identically.
Not a black box	Every change is logged with what it was, what it became, why, and what happened to the score afterwards. If you disagree with a decision you can see the decision.
Not irreversible	Turn it off and the gateway keeps the settings it had, under your control. There is no state you cannot inspect and no change you cannot undo.
Not finished	The single control and the self-proving promotion described here are in development. The adaptive control, the subscriber score, and the observe/enforce staging are running today.

The honest risk, stated once. Queue management, interactive protection and fair dropping all act on the same packets. Tuning them independently against one score can settle somewhere each looks individually justified while the combination is not the best available. Our answer is to tune one at a time and hold the others still — which is slower and less impressive than tuning everything at once, and is the reason we are staging this rather than shipping it whole.