VPP is a world-class forwarding engine.
Quantum makes it a shippable product.
The Quantum Framework delivers 115+ production capabilities on top of VPP’s forwarding foundation — the management, security, state and observability layer every product needs and raw VPP leaves you to build.
The comparison
| Capability | Raw VPP | Quantum Framework |
|---|---|---|
| Forwarding plane foundation 7 | ||
| Extensible graph node forwarding pipeline | ✓ | ✓ |
| Multi-core horizontal scaling | ✓ | ✓ |
| DPDK-accelerated packet I/O | ✓ | ✓ |
| Host-interface (af-packet) attachment for Linux veth pairs | ✓ | ✓ |
| L2 cross-connect / bridging forwarding primitive | ✓ | ✓ |
| Per-packet graph-node trace capture | ✓ | ✓ |
| Multi-queue RX/TX with RSS hashing per interface | ✓ | ✓ |
| Management API & control plane 18 | ||
| Full REST management API | ✗ | ✓ |
| Idempotent pipeline apply with automatic retry until interfaces converge | ✗ | ✓ |
| VPP start / stop / restart over the API vppctl and systemd only | CLI only | ✓ |
| Interface inventory and state over the API show interface via vppctl | CLI only | ✓ |
| Packet trace capture and retrieval over the API trace add / show trace via vppctl | CLI only | ✓ |
| L2 cross-connect management over the API | CLI only | ✓ |
| Guided pipeline provisioning wizard (veth, xconnect, VPP-internal loopback) | ✗ | ✓ |
| Live PCI port reassignment between kernel, VPP and TRex over the API | ✗ | ✓ |
| Management-port protection guard against self-lockout during port moves | ✗ | ✓ |
| RX/TX queue depth and RSS configuration with dry-run preview applied via vppctl commands; planning and validation are framework-only | CLI only | ✓ |
| Safe DPDK startup.conf editing that preserves existing content and backs up before writing | ✗ | ✓ |
| RX/TX queue placement and hardware-interface diagnostics over the API wraps vppctl show diagnostics commands | CLI only | ✓ |
| Clear interface, error and runtime counters over the API clear interfaces / clear runtime via vppctl | CLI only | ✓ |
| Formal plugin contract for building new products on one core codebase | ✗ | ✓ |
| Two-phase settings apply — validate before write, with per-field errors | ✗ | ✓ |
| Namespaced settings store with automatic legacy migration | ✗ | ✓ |
| Aggregate system status endpoint (VPP, packet generator, cross-connect, active test) | ✗ | ✓ |
| Atomic, crash-safe settings and config-file writes | ✗ | ✓ |
| Authentication & identity 17 | ||
| Username/password login with signed, httponly session cookies | ✗ | ✓ |
| TOTP two-factor authentication (RFC 6238) with QR-code enrollment | ✗ | ✓ |
| MFA backup codes with regeneration | ✗ | ✓ |
| WebAuthn / FIDO2 hardware key login | ✗ | ✓ |
| SAML single sign-on with IdP auto-provisioning | ✗ | ✓ |
| LDAP / Active Directory authentication with auto-provisioning | ✗ | ✓ |
| Self-service scoped, expiring API keys | ✗ | ✓ |
| Automatic garbage collection of expired and orphaned API keys | ✗ | ✓ |
| Active session listing and individual revocation | ✗ | ✓ |
| Automatic rotation of the session-signing secret with grace-period history | ✗ | ✓ |
| Self-service password reset via emailed one-time link | ✗ | ✓ |
| One-time bootstrap token for first-admin setup | ✗ | ✓ |
| Passive device fingerprinting from login request signals | ✗ | ✓ |
| First-seen-device detection on every login | ✗ | ✓ |
| One-click "this wasn't me" session-revoke link in new-device alerts | ✗ | ✓ |
| Self-service password change with current-password verification | ✗ | ✓ |
| Login-method discovery without username enumeration | ✗ | ✓ |
| Authorization & hardening 17 | ||
| Three-tier RBAC — read-only, read-write, admin | ✗ | ✓ |
| Fernet at-rest encryption of stored secrets and credentials | ✗ | ✓ |
| Argon2 password hashing | ✗ | ✓ |
| Account lockout after repeated failures, with admin unlock | ✗ | ✓ |
| Per-endpoint-group API rate limiting | ✗ | ✓ |
| CSRF protection on state-changing calls | ✗ | ✓ |
| Strict security headers on every response (CSP, X-Frame-Options, nosniff, Referrer-Policy) | ✗ | ✓ |
| Configurable session lifetime with absolute and idle timeouts | ✗ | ✓ |
| Per-API-key IP allowlisting, path scoping and expiration enforcement | ✗ | ✓ |
| Password expiration policy with forced change | ✗ | ✓ |
| Password reuse prevention via rolling history | ✗ | ✓ |
| Mandatory per-user MFA enforcement | ✗ | ✓ |
| Admin user management with self-protection and last-admin guards | ✗ | ✓ |
| Admin force-revocation of all sessions and bearer keys for any user | ✗ | ✓ |
| Admin reset of a user's MFA enrollment | ✗ | ✓ |
| Admin password reset with forced session revocation | ✗ | ✓ |
| SSO/LDAP group-to-role mapping resolves to the highest-privilege match | ✗ | ✓ |
| TLS & certificate automation 9 | ||
| Automatic certificate issuance over ACME (HTTP-01) | ✗ | ✓ |
| Unattended daily certificate renewal | ✗ | ✓ |
| DNS-01 challenge support (Cloudflare) | ✗ | ✓ |
| Certificate-expiry email alerts at 30/7/0-day thresholds | ✗ | ✓ |
| Live certificate inspection with expiry countdown and source classification | ✗ | ✓ |
| Certificate history with validated one-click rollback | ✗ | ✓ |
| Manual certificate/key upload with cryptographic validation | ✗ | ✓ |
| Configurable TLS version, cipher-suite policy and opt-in HSTS | ✗ | ✓ |
| DNS provider credential validation without touching DNS | ✗ | ✓ |
| State, config & auditability 6 | ||
| Structured audit trail of security-relevant actions, attributed to the operator | ✗ | ✓ |
| Aggregated security-posture health score with per-check detail | ✗ | ✓ |
| Automatic VPP startup.conf generation from structured settings on every save | ✗ | ✓ |
| Live read-back of the active VPP startup configuration, with render-from-settings fallback | ✗ | ✓ |
| Live-tunable API rate-limit policy that takes effect on the next request, no restart | ✗ | ✓ |
| Operator configuration survives a service restart or reboot | ✗ | ✓ |
| Observability & analytics 10 | ||
| Prometheus metrics endpoint exposing VPP interface counters and CPU utilization vpp_prometheus_export exposes stats-segment counters only; no CPU utilisation | CLI only | ✓ |
| PromQL instant-query, range-query and series proxy to local Prometheus | ✗ | ✓ |
| Managed Prometheus service lifecycle (start / stop / status) over the API | ✗ | ✓ |
| Per-interface packet, byte and error counters over the API vppctl show interface / show hardware-interfaces / show error only | CLI only | ✓ |
| Per-thread VPP runtime CPU and node-dispatch statistics over the API vppctl show threads / show runtime only | CLI only | ✓ |
| Unified memory breakdown across kernel, VPP buffer pools and the stats segment vppctl show buffers / show memory stats-segment only; the kernel + unified view is framework-only | CLI only | ✓ |
| Outbound event webhooks, HMAC-signed and retried with exponential backoff | ✗ | ✓ |
| Self-service webhook subscription management with encrypted secrets and built-in test delivery | ✗ | ✓ |
| SMTP email delivery with STARTTLS/TLS and multipart HTML/text templating | ✗ | ✓ |
| Self-service SMTP configuration with connectivity test-send and password redaction in the API | ✗ | ✓ |
| Hardware & platform 11 | ||
| CPU model, core/thread count and boot-cmdline discovery over the API | ✗ | ✓ |
| DPDK NIC bind / unbind (and bulk reset-to-kernel) from the API | ✗ | ✓ |
| Hugepage reservation via sysctl (immediate) or GRUB (persistent) from the API | ✗ | ✓ |
| NUMA node-to-CPU mapping for same-socket-aware core placement | ✗ | ✓ |
| Pre-flight validation of CPU-pinning layout (bounds, NUMA co-location, reserved core 0) before it reaches VPP's startup.conf | ✗ | ✓ |
| NUMA-aware CPU-pinning wizard defaults computed from which NICs are bound | ✗ | ✓ |
| Per-NIC-family descriptor/queue-limit lookup driving default queue sizing vppctl show hardware-interfaces reports descriptor min/max once VPP is running with the port bound; this lookup works pre-bind, before VPP starts | CLI only | ✓ |
| Automatic RX/TX queue-count and descriptor autofill computed from CPU pinning and NIC capability | ✗ | ✓ |
| Declarative boot-parameter management (isolcpus, IOMMU, hugepages, IRQ affinity, C-states) built from settings and written to GRUB | ✗ | ✓ |
| Intel ICE DDP firmware-package download and install over the API | ✗ | ✓ |
| Automatic, chip-and-workload-aware DDP variant negotiation with safe reset escalation | ✗ | ✓ |
| Traffic generation & validation 13 | ||
| Integrated TRex service lifecycle — start auto-generates trex_cfg.yaml and a systemd unit, with CPU-list sanity guardrails | ✗ | ✓ |
| Automated pre-flight checks and one-click remediation of common TRex blockers (port ownership conflicts, unbound drivers, CPU list) | ✗ | ✓ |
| TRex traffic-rate control (percent / pps / bps / gbps) with continuous, duration, or packet-count stop conditions and automatic bytes-per-packet verification | ✗ | ✓ |
| Per-port TRex link/driver diagnostics and live throughput/latency statistics over the API | ✗ | ✓ |
| Automatic TRex core selection that avoids cores already reserved by VPP or Linux housekeeping | ✗ | ✓ |
| Remote TRex host provisioning over SSH with prerequisite checks and streamed install progress | ✗ | ✓ |
| Named traffic-profile authoring and storage, with one-click load/run against TRex | ✗ | ✓ |
| Saved test definitions with per-stream configuration, import/export and clone | ✗ | ✓ |
| Recorded time-series and summary statistics per test run | ✗ | ✓ |
| Configurable veth-pair loopback traffic injection and validation (protocol, VLAN, MAC/IP/port, rate, count) | ✗ | ✓ |
| VPP packet-generator test orchestration — start/stop/reset tied to saved test definitions, with automatic counter-baseline reset for accurate before/after deltas vppctl packet-generator start/stop only; test-tied orchestration and delta baselines are framework-only | CLI only | ✓ |
| Automatic internal VPP loopback/cross-connect pipeline wiring for self-contained traffic testing without external cabling loopback create / l2patch add are vppctl primitives; automatic topology wiring from settings is framework-only | CLI only | ✓ |
| Per-stream packet-pipeline trace visualization with per-node runtime-cost annotation built from vppctl trace + show runtime; mapping the trace path to a per-configured-stream cost estimate is framework-only | CLI only | ✓ |
| Operations & lifecycle 9 | ||
| Runtime plugin/module enable and disable | ✗ | ✓ |
| Component version reporting across the stack | ✗ | ✓ |
| systemd service supervision from the API | ✗ | ✓ |
| Automatic VPP restart on settings change, skipped when nothing VPP-relevant changed | ✗ | ✓ |
| Automated DPDK readiness probe (worker count, port state, journal errors) | ✗ | ✓ |
| DPDK-aware VPP restart with automatic PCI-to-interface remap and bring-up | ✗ | ✓ |
| Boot-time persistence of DPDK PCI driver bindings across reboot | ✗ | ✓ |
| Boot-time persistence of RX/TX queue and RSS configuration | ✗ | ✓ |
| Automatic stop / rebind / restart orchestration when a port move touches a running service | ✗ | ✓ |
| Operator UI & white-labelling 5 | ||
| Production React operator web interface | ✗ | ✓ |
| Extensible plugin shell — merges each plugin's routes, nav items and settings sections into one app, filtered by role and licensed capability, with collision detection | ✗ | ✓ |
| Declarative, registry-driven settings screens composed per plugin | ✗ | ✓ |
| In-app system-health status pill with categorized live checks (security, TLS, operational) and a plugin extension point | ✗ | ✓ |
| White-label logo upload (PNG, size-validated) served over the API | ✗ | ✓ |