Fast path vs. slow path

The whole design turns on keeping the fast path pure. In steady state, the controller sees none of a connected subscriber's traffic. Only two tiny classes of packet ever leave the data plane and go "up" to the controller (this is called punting):

1. DHCP from an unknown subscriber — someone new trying to get online, or a known subscriber renewing/releasing their lease.
2. Inbound RADIUS CoA — the AAA server asking to change or disconnect a session (in the target design; see the AAA and scope sections).

Everything else — all actual subscriber data — stays in VPP and is forwarded, policed, filtered, and counted without the controller ever touching it. When you understand that "in steady state, nothing is punted," you understand why the box can forward at line rate and why the controller's CPU stays low even with a full session table.

The Data Plane: How Subscriber Traffic Is Handled

Once a subscriber is connected, everything that happens to their packets happens in VPP. This section is the operator's view of that fast path.