XDP BNG · CGNAT · QoS · Low-Latency — for Satellite Gateways
For Satellite ISPs · LEO + GEO
You Can't Shorten the Path to Orbit. You Can Stop Adding Latency on the Ground.
Satellite's two hardest problems — latency that balloons under load and millions of subscribers sharing scarce IPv4 — are both solved at the gateway. BNGSOFT runs BNG, carrier-grade CGNAT, per-subscriber QoS and L4S/AQM low-latency in one XDP data plane on commodity x86 — for LEO constellations and GEO/VSAT operators alike.
A satellite link's worst latency isn't the trip to space — it's the queue at the gateway when the beam fills up. Under load, RTT jumps 2–4×. BNGSOFT makes that added latency disappear — per subscriber, for the whole network.
2–4×
latency under load
bufferbloat we remove at
the gateway, per-sub
the gateway, per-sub
Millions
on scarce IPv4
carrier-grade CGNAT —
satellite's default
satellite's default
~$0.30
per subscriber
commodity x86 at the
teleport / PoP
teleport / PoP
LEO+GEO
one platform
new entrants and
established operators
established operators
Two one-page briefs to forward — same story, split by audience: Latency / demo — for your network & product team → · CGNAT cost — for finance / CFO →. This page is the full story; the one-pagers are the targeted hand-offs.
1 · The gateway is where the experience is won
Every terminal's traffic — from a constellation or a GEO bird — aggregates at the gateway / teleport before it reaches the internet. That's the one place an operator controls per-subscriber: it's where you terminate sessions, conserve IPv4, shape the scarce capacity, and manage latency. BNGSOFT is the software BNG that lives there.
The path to orbit is fixed by physics. Everything an operator can control — sessions, NAT, fairness, latency, security — happens at the gateway, in software, on commodity servers.
2 · Kill the bufferbloat — make the link feel fast
This is the headline. Independent measurements show satellite RTT climbing 2–4× under load — to roughly 400–500 ms — as the gateway/beam buffer fills. That's not the speed of light; that's a queue. It's why a download makes a video call stutter and a game spike. The fix is Active Queue Management, and operators already know it works — Starlink added fq_codel to its home router to tame exactly this.
Do it where it scales — at the gateway, not one router at a time. BNGSOFT applies L4S/AQM dual-queue marking + Interactive Flow Protection per subscriber, network-wide: small, latency-sensitive flows (DNS, TCP ACKs, voice, video-call, gaming) stay responsive while bulk transfers take the back-pressure — automatically, on every plan, without a customer touching a thing.
Latency under load — the satellite bufferbloat problem, and the fix ILLUSTRATIVE
Conceptual; magnitudes reflect published measurements (idle vs ~2–4× under load). The propagation RTT is unchanged — what's removed is the queuing latency stacked on top.
For LEO, where idle RTT is already low (~25–60 ms), removing the load-induced spike is the whole game — it's the difference between "as good as fibre" and "laggy." For GEO, you can't hide the ~600 ms physics, but cutting the queuing on top still sharply improves responsiveness for interactive traffic.
3 · Satellite is a CGNAT operator — so do it on commodity x86
Sharing scarce IPv4 isn't optional at satellite scale; it's the default. Starlink runs subscribers behind CGNAT today (private 10.64.0.0/10 → a shared public address). Doing that for millions of terminals on a proprietary carrier appliance is enormously expensive. BNGSOFT runs carrier-grade port-block CGNAT in the same XDP data plane, on standard servers, at ~$0.30 per subscriber.
Port-block
deterministic CGNAT — fewer logs, lawful-intercept friendly
IPFIX
per-flow logging for compliance & abuse tracing
Dual-stack
IPv6 + CGNAT'd IPv4 per terminal, concurrently
~$0.30
per subscriber on commodity x86, scale-out
4 · Fair-share the most expensive bandwidth in networking
Beam and transponder capacity is the scarcest, costliest resource you have. BNGSOFT enforces it per-subscriber, in the fast path — so a handful of heavy users can't ruin a beam, and your plan tiers are real.
PER-SUB QOS
Fair-share every beam.
- Per-subscriber shaping at line rate; hierarchical fairness across a beam/cell.
- Protects the experience for everyone when capacity is tight.
DATA CAPS & TIERS
Priority vs Standard, live.
- RADIUS CoA throttles or de-prioritises after a data cap — no reconnect.
- Implement "priority" vs "best-effort" tiers exactly like the LEO leaders.
QoE TELEMETRY
Prove the experience.
- Per-subscriber queuing-latency & experience scoring at the gateway.
- See and prove SLA over a link you can't directly instrument end-to-end.
5 · Protect the uplink — every wasted bit costs real money
ANTI-SPOOF (BCP38)
No spoofed sources.
- Per-terminal source validation in XDP — your network can't be a reflection-DDoS origin.
DDoS PROTECTION
Don't burn capacity on attacks.
- In-data-plane upload self-protection + attack-pattern drop at the gateway.
ANTI-ABUSE
Contain compromised CPEs.
- Detect and quarantine outbound abuse before it consumes the expensive uplink.
6 · Two operators, one platform
NEW ENTRANT (e.g. a Jio-style launch)
Stand up a national satellite ISP fast.
- Software BNG + CGNAT at each gateway on commodity servers — no multi-year carrier-chassis procurement.
- Lowest cost-per-subscriber to serve rural / underserved millions on scarce IPv4.
- Integrates with your existing RADIUS / billing as a standards-based NAS.
ESTABLISHED LEO / VSAT OPERATOR
Lift QoE and unit economics.
- Network-wide L4S/AQM + IFP — bufferbloat fixed for every subscriber, not just those who buy a fancy router.
- Consolidate BNG, CGNAT, QoS and security into one box per gateway.
- Data-cap / priority tiers and per-beam fairness in the fast path.
7 · Honest framing
| What BNGSOFT does | What it doesn't |
|---|---|
| Removes the queuing/bufferbloat latency stacked on top of the link, per subscriber, at the gateway. | Change propagation delay — GEO's ~600 ms and LEO's ~25–60 ms are physics. |
| Runs carrier-grade CGNAT, QoS, security and BNG in one data plane on commodity x86. | Replace a TCP Performance-Enhancing Proxy (PEP) — it complements one by keeping the ACK path clean and low-latency. |
| Sits at the ground segment (gateway / teleport / PoP) where the operator controls per-subscriber. | Live on the satellite or in the terminal — it's ground-segment software. |
8 · What it means for a satellite operator
BNGSOFT for satellite · operator value
"Feels like fibre" under loadPer-subscriber L4S/AQM + IFP at the gateway removes the 2–4× load-induced latency that makes satellite feel laggy.
Lowest ground-segment costCGNAT + BNG + QoS for millions on commodity x86 at ~$0.30/sub — not a six-figure carrier chassis per gateway.
Make scarce capacity go furtherPer-beam fairness, data-cap and priority tiers via CoA — protect the most expensive bandwidth you own.
Don't waste the uplink on abuseAnti-spoof, DDoS and outbound-abuse containment inline at the gateway.
Scale-out, not forkliftAdd commodity servers per gateway as the constellation and subscriber base grow.
Prove the experiencePer-subscriber QoE telemetry at the gateway — see and demonstrate SLA on a link you can't instrument end to end.
The bottom line
Satellite operators can't change the distance to orbit — but most of what subscribers experience as "satellite lag" is queuing latency at the gateway, and most of the IPv4 problem is CGNAT at scale. BNGSOFT solves both in one XDP data plane on commodity x86, for LEO and GEO alike: flat latency under load, millions on scarce IPv4, ~$0.30 per subscriber.
Fix the latency you're adding. Conserve the IPv4 you don't have. At the gateway, in software.
Sources & honest framing: This brief positions the BNGSOFT software BNG/CGNAT/QoS platform for satellite (LEO and GEO/VSAT) ground-segment use at the gateway/teleport; it is not a benchmark report. BNGSOFT figures (carrier-grade CGNAT, per-subscriber QoS, L4S/AQM + Interactive Flow Protection, anti-spoof/DDoS, ~$0.30/subscriber on commodity x86, line-rate XDP) are from BNGSOFT deployment/lab data and are indicative — exact results depend on hardware, gateway design, traffic mix and configuration, and must be validated per deployment. Satellite figures are from public sources and vary by constellation, location, plan and time: bufferbloat / latency-under-load on satellite (RTT rising ~2–4× to ~400–500 ms under load; AQM/fq_codel as the fix; Starlink adding fq_codel to its router; SQM gaming-priority shaving ~5–15 ms) — arXiv 2310.09242 (Starlink performance study), Starlink (Improving Latency), independent gaming/latency reports; satellite CGNAT (shared public IPv4, private 10.64.0.0/10 range, all subscribers behind CGNAT by default) — CGNAT on Starlink explained; LEO idle RTT ~25–60 ms and GEO ~600 ms RTT are widely-published physical figures. The latency chart is an ILLUSTRATIVE conceptual representation, not a measured benchmark. BNGSOFT is ground-segment software and complements (does not replace) TCP Performance-Enhancing Proxies. Starlink®, Jio® and other names are trademarks of their respective owners; BNGSOFT is not affiliated with them. Prepared as a management overview for satellite operators.