Subscribers are identified by their IP address

Because the access network is L3-routed (the edge router is a true routing hop, not a bridge), the BNG identifies each subscriber by the IP address it assigned them — their framed IP, a /32 host address. There is no VLAN per subscriber and no reliance on the subscriber's MAC for forwarding. The edge router relays the subscriber's DHCP to the BNG, inserts Option 82 (circuit and remote identifiers that say which port on which edge router this subscriber is behind), and sets giaddr to identify itself.

For you as an operator this has a few concrete consequences:

• A subscriber's session is looked up by their IP, both for traffic they send (source IP) and traffic they receive (destination IP).
• The BNG enforces anti-spoofing on every upstream packet: the source IP must equal the subscriber's assigned IP, or the packet is dropped. A subscriber cannot send traffic from an address they were not given.
• Traffic to and from the internet is delivered through the edge router, whose address the BNG learned from giaddr. The BNG resolves the edge router's MAC once and shares it across every subscriber behind that router — so the neighbour table stays small even at 100,000 subscribers.