Architecture at a glance

Plane	Component	What it does	Where it lives
Management	QuantumTouch (bng-deploy)	The web UI + REST API operators use. Flask + gunicorn.	Port 8443 (HTTPS)
Control	Quantum Controller	Source of truth for subscribers, sessions, DHCP leases, AAA state.	Docker container, port 3000 (HTTPS, `127.0.0.1` only)
Data	VPP + tuned DPDK	Line-rate packet forwarding with a per-subscriber 3-color policer (trTCM).	Kernel-adjacent, one main core + N workers pinned to isolcpus
Bridge	vpp-bridge	Go daemon that translates controller decisions into VPP CLI operations and vice versa.	`systemd` unit

Traffic path for a subscriber packet:

CPE  →  Access NIC (VPP)  →  BNG plugin (policer + session lookup)  →  Uplink NIC (VPP)  →  Core router
                                    ↑
                                    Controller (via vpp-bridge) — session install, plan lookup

DHCP path:

CPE DHCP DISCOVER → Access NIC (VPP) → BNG plugin punts → vpp-bridge → Controller
                                                                            ↓
                                                                        AAA lookup (Local or RADIUS)
                                                                            ↓
Controller crafts OFFER → back down the stack → CPE

The Community Edition license caps concurrent sessions at 1000. That's shown in the header pill and in the Sessions "over time" chart.

For a deeper theory-of-operation (packet path, state ownership, DHCP/AAA state machines), see ../theory-of-operation.md — that document is for engineers integrating against QuantumBNG; this one is for operators running it.