The Self-Driving BNG · one box, every function · it learns your network · lower cost per subscriber
Platform Overview · Intelligent BNG / CGNAT

The Self-Driving BNG — one box, every function, and it tunes itself

A traditional edge needs a rack of specialised boxes — a BNG/BRAS for subscribers, a CGNAT appliance for IPv4, a DDoS scrubber, a QoE probe, an analytics/IPFIX exporter — each a proprietary chassis with its own licence tiers. BNGSOFT collapses all of it into one software box on commodity x86 that does something no appliance does: it learns each subscriber's normal — their traffic, their latency, their attack profile — and only enforces when it's provably ready. More subscribers per box, dramatically lower cost per subscriber, and protection legacy tin can't match.
Appliances are static: you set a threshold and hope. BNGSOFT is different — it watches, learns, and adapts to every subscriber, then acts only when it's sure it won't hurt anyone. An edge that runs itself, on hardware you can buy anywhere.
5 → 1
roles consolidated
BNG · CGNAT · DDoS ·
QoE · analytics — one box
Self-tuning
learns per subscriber
baselines each sub's normal,
catches trouble early
Safe by default
observe → enforce
acts only when a readiness
check says it's safe
Commodity x86
~10× less power
no chassis, no line cards,
no per-feature licence tiers

1 · The intelligence — it learns your network, then acts only when it's sure

Every legacy edge appliance works the same way: an engineer picks a threshold, and the box drops anything that crosses it. Pick it too low and you hurt real subscribers; too high and you miss the attack. It never learns, so it's always wrong somewhere.

BNGSOFT flips this around. Each intelligent function starts in observe — it quietly learns the normal for every individual subscriber: how much traffic they usually pull, what their latency looks like, what a normal amount of each protocol is. Then it can spot the things a fixed threshold never sees — a flood that's below the network-wide limit but 20× this subscriber's normal, or a quality dip before the support ticket. And when you're ready to let it act, a built-in readiness check tells you — per feature — exactly how many subscribers would be affected right now, so you promote to enforce with zero surprises.

1 · OBSERVE learns each sub's normal traffic · latency · attack profile no drops — pure learning 2 · READINESS CHECK "safe to enforce?" shows blast radius per feature READY · WARMING · verify-first 3 · ENFORCE acts with confidence drops the attack, not the customer per-subscriber precision the same lifecycle for DDoS, quality-of-experience, flow protection and abuse control
HOW IT WORKS   Learn first, prove it's safe, then enforce — so automation you can actually trust in production.
Why this matters: operators don't turn on aggressive protection because they're afraid of dropping real customers. BNGSOFT removes that fear — you can see, before you flip a single switch, exactly who would be affected. Confidence is the feature.

2 · One box replaces the whole rack

Because every function runs in the same high-speed software data path (in-kernel XDP on the network card's fast path), there's no reason to buy — power, cool, license and maintain — five separate appliances. One BNGSOFT box is the BNG, the CGNAT, the DDoS mitigation, the QoE analytics and the flow exporter, simultaneously, at line rate.

TRADITIONAL — five appliances, five licences BNG / BRAS chassis (ASIC line cards) CGNAT appliance + per-sub licence DDoS scrubbing appliance QoE / experience probe IPFIX / analytics exporter multiple chassis · kilowatts · stacked licence tiers consolidate ONE BNGSOFT BOX BNG · CGNAT · DDoS · QoE · analytics commodity x86 · in-kernel XDP · line rate one server · ~10× less power · all-inclusive
ILLUSTRATIVE   The same subscriber edge, delivered as software — fewer boxes to buy, power, license and maintain.

3 · What it defends, and what it tunes

DDoS — BOTH WAYS
Protects your subscribers and the internet
  • Inbound: per-victim, per-vector detection — reflection, UDP/ICMP/SYN floods — that catches attacks below the network-wide threshold using each subscriber's learned baseline.
  • Outbound: spots a compromised subscriber flooding or scanning and isolates it — protecting your reputation and everyone else.
  • Graduated response: monitor → rate-limit → block, with automatic clear-down.
AUTONOMOUS QoE
Finds the bad experience before the ticket
  • Learns each subscriber's normal loss and latency; flags the anomaly that a fixed SLA number would miss.
  • Congestion-aware AQM (L4S / dual-queue) keeps latency low under load, not just on a speed test.
  • Optional closed-loop remediation — the box tunes itself per subscriber.
SMART CGNAT
IPv4 that heals and games well
  • Shares scarce IPv4 across many subscribers — with reputation-aware address steering so one abuser can't spoil a shared IP.
  • Open-NAT auto-detects gaming / real-time traffic and gives it full-cone NAT — consoles show "Open".
  • Live config: add a subscriber network without a restart.

Full-Core performance

Even PPPoE — which cards can't spread — is fanned across every CPU core, so the whole box works, not just one core.

Edge self-defence

Anti-spoofing (BCP38), scanner and abuse quarantine, and always-on protection for the box's own services.

Built-in observability

Per-subscriber health, a full check-engine grade, live metrics and IPFIX — the analytics probe is already inside.

4 · The economics — why software wins

The savings come from three places at once: you stop buying proprietary chassis, you stop paying per-feature and per-throughput licence tiers, and — with CGNAT — you stop buying scarce IPv4 addresses. Here's the shape of it for a mid-size operator.

Cost driverTraditional appliance stackBNGSOFT on commodity x86
Subscriber edge (BNG/BRAS)Proprietary ASIC chassis + line cardsIncluded — software on x86
CGNATSeparate appliance + per-subscriber licenceIncluded
DDoS mitigationScrubber appliance ≈ $150k–$500k + $30k–$100k/yr licensing1Included
QoE / analytics probeSeparate probe + collectorIncluded
HardwareMultiple chassis2× commodity x86 servers (HA)
Software hardware cost—Up to ~70% lower than hardware BNGs2
PowerChassis routers up to ~19 kW fully loaded3≈ 0.4–1 kW per server — roughly 10× less
IPv4 addressesBuy at ~$20–$45 / address4CGNAT shares ~40–60 subs per IP — cut the buy by a similar factor
Licensing modelPer-throughput and per-feature tiersAll-inclusive, per-subscriber
The IPv4 angle alone can pay for the project. Serving 50,000 subscribers with public IPv4 is effectively impossible; with CGNAT at ~50:1 you need on the order of a thousand addresses instead of fifty thousand. At market prices that's the difference between a five- or six-figure line item and a rounding error — every year.
Illustrative, not a quote. Figures above are public-market ranges (see sources) to show the shape of the saving; BNGSOFT software pricing and your exact stack are set with our team. The point isn't a single number — it's that a self-tuning software box removes several capital purchases, several licence tiers, and most of the power bill at once.

5 · Safe by design — automation you can run in production

Observe-first defaults

Every intelligent feature ships learning, not dropping. It earns trust before it acts.

Readiness gate

One command shows, per feature, exactly how many subscribers would be affected if you enforced — so you promote with eyes open.

Zero-downtime updates

Upgrade the software without dropping subscriber sessions — no maintenance-window reboots for most changes.

GROWING ISP

Grow subscribers, not the rack

Out of IPv4, adding customers fast, tight capex.
CGNAT reclaims IPv4; one box adds BNG + protection; scale by adding commodity servers, not chassis.
QUALITY-LED

Win on experience

Competing on quality, drowning in "internet is slow" tickets.
Per-subscriber QoE baselines + low-latency AQM catch the bad experience before the customer calls.
UNDER ATTACK

Stop paying the scrubber

Recurring DDoS, expensive mitigation contract.
Inbound + outbound DDoS built into the edge — no separate appliance, no per-Gbps bill.

One box. Every function. And it tunes itself.

BNGSOFT turns commodity x86 into a subscriber edge that learns your network, defends it in both directions, and only enforces when it's sure — replacing a rack of appliances and their licence tiers with software you can grow one server at a time.

See it on your traffic. We'll show the consolidation, the per-subscriber intelligence, and the numbers for your subscriber count and attack profile.

BNGSOFT — Intelligent BNG / CGNAT on commodity x86
BNG · CGNAT · DDoS · QoE · analytics, in one self-tuning box
Talk to us: bngsoft.com
BNG pricing on request · full-featured evaluation available
Product capabilities describe the BNGSOFT XDP data-plane and its self-tuning daemon; feature availability and defaults may vary by release and platform. Cost figures are illustrative public-market ranges to show the shape of the saving, not a price quote — your figures are set with our team. Sources: 1 DDoS appliance / licensing ranges — Flowtriq DDoS pricing 2026. 2 Up to ~70% lower hardware cost for software BNGs on x86 — netElastic. 3 Carrier chassis power up to ~19.5 kW fully loaded — Cisco CRS system description; x86 rack ≈ 3–5 kW — Sysracks. 4 IPv4 market ≈ $20–$45 / address (2026) — RapidSeedbox IPv4 price 2026; CGNAT cost-per-subscriber advantage — A10 Networks.