What happens to each packet

Every subscriber packet passes through a compact sequence of checks. The elegance of the design — and the reason it is fast — is that a single lookup of the subscriber's session pulls everything the data plane needs into one place: the anti-spoof reference, the "is this subscriber behind the captive portal?" flag, and the two rate-limiting meters (one for each direction). There is no separate firewall table and no separate rate-limit table to consult.

Upstream (subscriber → internet):

1. Look up the session by the packet's source IP. No session (and not DHCP)? Dropped — an unprovisioned address gets nothing (deny by default).
2. Anti-spoof: source IP must match the session's assigned IP.
3. DHCP interception: a DHCP packet from a known subscriber (a renew or release) is punted to the controller.
4. Captive check: if this subscriber is behind the walled garden, only DNS and web traffic to the portal survive; everything else is dropped (see the captive-portal section).
5. Rate limiting: the packet is measured against the subscriber's upstream rate and coloured green, yellow, or red (below).
6. Forward toward the core/uplink NIC and out to the internet.

Downstream (internet → subscriber): the mirror image — look up the session by destination IP, apply the captive check in reverse, meter against the subscriber's downstream rate, and deliver toward the subscriber via the edge router.