Vector Packet Processing (VPP)

FD.io VPP is a production-grade, userspace packet processing framework that delivers carrier-class forwarding performance on commodity x86 hardware. PacketFlow engineers have deep, hands-on expertise across VPP's full stack: from graph node architecture and plugin development to multi-worker scaling and production deployment. Our delivered projects span IPsec gateways, subscriber management, network function containers, and custom forwarding pipelines — all built on VPP's deterministic, batch-oriented processing model.

Core Competencies

• Graph Node Architecture — Designing custom graph nodes that integrate cleanly into VPP's directed processing graph. We understand node disposition codes, frame handoff between nodes, and the vector processing model that gives VPP its instruction-cache advantage over per-packet designs.
• Plugin Development — Building production VPP plugins with proper initialization, API message handlers, CLI commands, and stats integration. We follow VPP's plugin architecture conventions and deliver plugins that coexist with upstream VPP releases.
• Multi-Worker Scaling — Configuring and tuning VPP's multi-worker threading model for near-linear throughput scaling. This includes RSS configuration, worker-to-core pinning, NUMA-aware memory allocation, and per-worker counter aggregation through the stats segment.
• TAP/LCP Interface Management — Deploying VPP alongside the Linux kernel networking stack using TAP and Linux Control Plane (LCP) interfaces. We handle the complexities of dual-stack operation, routing synchronization, and namespace integration at scale.
• Binary API & Stats Segment — Integrating external applications with VPP through the binary API (C, Go via GoVPP, Python) and the shared-memory stats segment for real-time telemetry without polling overhead.
• startup.conf Tuning — Optimizing VPP's startup configuration for specific hardware: hugepage allocation, CPU pinning, buffer sizing, polling parameters, and DPDK PMD options that determine baseline performance.
• Protocol Stack Integration — Deploying VPP with ACL, NAT44, OSPF (via FRRouting), VxLAN, and other protocol features in production topologies.

Tools & Technologies

Proven Delivery

100Gbps IPsec Gateway (Case Study 1) — Built a VPP-based IPsec gateway handling 10,000+ simultaneous tunnels at 100Gbps line rate. The implementation included XFRM plugin integration for kernel SA coexistence and full IKEv2 lifecycle management.

VPP Multi-Worker Scaling to 95Gbps (Case Study 3) — Scaled a VPP forwarding pipeline from 25Gbps to 95Gbps by implementing proper multi-worker distribution across 8 CPU cores. The deployment managed 5,000 TAP/LCP interfaces for container networking, demonstrating VPP's ability to serve as the forwarding plane for large-scale virtualized environments.

VPP XFRM Plugin — Deployed and integrated a VPP plugin that synchronizes IPsec Security Associations with the Linux XFRM subsystem via netlink, enabling VPP to coexist with kernel-based IPsec management planes. Includes SA counter export for monitoring.

VPP PPPoE Session Automation — Implemented automated PPPoE session management within VPP for subscriber access networks, handling session lifecycle, authentication integration, and per-subscriber forwarding.

vppctl-ai — Created an AI-powered VPP CLI tool that translates natural-language queries into vppctl commands, reducing the learning curve for operators managing VPP deployments.

VPP Protocol Stack — Deployed production VPP instances with ACL-based filtering, NAT44 translation, OSPF routing via FRRouting, and VxLAN overlay networking, all managed through the Python API.

Related Use Cases

• VPP IKEv2/IPsec Hardening — PFS, rekeying, SA monitoring
• VPP XFRM/PPPoE — 100 commits, AEAD AES-GCM, SA sync
• Hyperscan DPI for 5G UPF — VPP-integrated application detection

Related Services

• VPP Plugin Development — Custom graph nodes, plugins, and integrations
• IPsec & IKEv2 Engineering — Tunnel management, crypto offload, SA lifecycle