Protect the Network From Abuse — and the Subscriber From Congestion — in One XDP Data Plane
AQM · interactive-flow
RATE
subscriber — no scrubber
for IPv4 and IPv6
Enforce
load stability
Two directions of protection
1Anti-Spoof (BCP38) — validated source on every packet Protect the network
Each subscriber session carries an allow-list of exactly the addresses BNGSOFT assigned it (its IPv4 and its delegated IPv6). On every uplink packet the XDP program checks the source against that list and drops anything spoofed at line rate, at ingress — so a customer (or a compromised CPE) physically cannot send a packet pretending to be another address.
- Allow-list = the exact IPv4 + IPv6 assigned to the session.
- Enforced for both address families in XDP.
- Reflection/amplification DDoS depends on spoofing the victim's IP — those packets never leave.
- No customer can impersonate another.
- Observe mode first; auto-arms on subscriber-load stability.
- No legitimate traffic dropped during ramp-up.
2DDoS Protection — in the data plane, not a scrubber Protect the network
Layered defense that protects the BNG itself, the upstream, and every subscriber — built into XDP, so there is no separate scrubbing appliance to license or hairpin traffic through.
- Rate-protects the BNG against upload floods — always on, machine self-defense.
- One abusive line can't starve the control plane or other customers.
- Malformed and known-attack packet patterns dropped in XDP at ingress.
- Attack traffic can't be used to exhaust BNG resources.
- Filtering happens inline at line rate — no detour to a scrubber.
- Lower latency and one less box to run.
3Anti-Abuse — detect and contain compromised CPEs Protect the network
Spoofing aside, a healthy IP can still misbehave — a hijacked router blasting outbound scans, spam or attack traffic. BNGSOFT watches for abnormal outbound patterns over the upload-protection layer and can contain the offending subscriber so the abuse never reaches upstream and your address space stays off blocklists.
- Per-subscriber detector over the upload-protect counters.
- Flags CPEs suddenly generating attack-volume or scan-pattern traffic.
- Runs in observe mode first — measure before you enforce.
- Contain the flagged session so abuse doesn't reach the upstream.
- Protects your reputation and other subscribers' service.
- Operator-controlled, auditable.
4AQM / L4S — keep latency low under load Protect the experience
Protecting the network is half the job; the other half is protecting the subscriber's experience. BNGSOFT runs modern Active Queue Management with L4S per subscriber, in the same XDP path as forwarding — so a busy line stays responsive instead of bloating its buffers.
- L4S dual-queue with ECN CE-marking signals congestion early.
- Classic-drop fallback for non-ECN traffic.
- Per-subscriber sojourn-time targets, adaptive under load.
- Runs at line rate — no FastTrack/queue trade-off.
- Per-subscriber queuing latency and experience scoring.
- Visibility to prove the SLA, not guess at it.
5Interactive Flow Protection — real-time traffic stays fast Protect the experience
When a line is saturated by a bulk download, the packets that feel slow are the small, latency-sensitive ones — game traffic, voice, video-call, DNS, TCP ACKs. Interactive Flow Protection (IFP) recognises and prioritises those flows in XDP so they keep moving while the bulk transfer takes the back-pressure.
- Protects ACK / SYN / DNS and small, sparse, latency-sensitive flows.
- Keeps gaming, voice and video-calls responsive under a saturating download.
- Deployed observe-first, load-verified, then armed.
- Pairs with AQM and QoE telemetry for a complete low-latency story.
- ▸ Detail: the Interactive Flow Protection & L4S briefs.
Busy-hour responsiveness — interactive latency under a saturating download ILLUSTRATIVE
One data plane, both directions — at a glance
| Protection | Direction | What it stops / delivers | Where |
|---|---|---|---|
| Anti-Spoof (BCP38) | Outbound | Spoofed source IPs; IP impersonation; reflection-DDoS origin | XDP, per-sub, v4+v6 |
| DDoS Protection | Inbound + self | Upload floods on the BNG; malformed/attack packet patterns | XDP, always-on |
| Anti-Abuse | Outbound | Compromised-CPE attack/scan traffic; blocklist risk | XDP + detector, observe→enforce |
| AQM / L4S | Both | Bufferbloat; high tail latency under load | XDP, per-sub, adaptive |
| Interactive Flow Protection | Both | Slow voice/gaming/DNS during bulk transfers | XDP, per-sub |
Cost-effective — one data plane, not an appliance stack
The traditional way to get all this is to bolt boxes onto the edge: a standalone DDoS scrubber, a separate QoE / low-latency appliance, hand-maintained anti-spoof ACLs on the routers, and yet more tooling for outbound abuse. Each is its own capex, power draw, latency hop (traffic hair-pinned through it) and operational surface. BNGSOFT delivers all five protections in the BNG you already run — so the marginal cost of turning them on is effectively zero extra hardware.
Boxes in the path to deliver edge protection (directional)
What your subscribers feel
Protection only pays off if customers notice — and here, they notice by not noticing problems. Each capability maps to a concrete subscriber experience, which is what shows up in satisfaction, support load and churn.
- When the network is targeted by an attack, the subscriber's service keeps working.
- Inbound attack patterns and upload floods are absorbed at the edge, not felt at home.
- Video-calls, gaming and streaming stay responsive even during a big download on the same line.
- AQM + Interactive Flow Protection keep latency low instead of bloating.
- A hijacked CPE down the street can't spoof your address or get the shared prefix blocklisted.
- Abuse is contained at its source, not paid for by everyone.
What it means for the operator
The bottom line
BNGSOFT protects in both directions from one place: it keeps the network from being a source of spoofing, DDoS and abuse, and it keeps every subscriber's experience fast under load — all per-subscriber, at line rate, in the XDP data plane. No scrubber, no QoE appliance, no second hardware tier — ~$0 extra per subscriber in hardware, and the subscriber feels it as reliability: online during attacks, smooth when busy, never wrongly blocked.
Keep the bad traffic out. Keep the good traffic fast. One box — lower cost, happier subscribers.