Skip to content

Every badge, as the README carried them until 2026-10-18

Moved here from the README on 2026-10-18, word for word, when the README was made shorter. Struck claims stay struck, with what replaced them beside them; links were only re-pointed to work from this folder.

1 - general: the repository

the repository: what checks it, what it is licensed under, what it covers

checks: syntax, nothing private, docs upstream: watches for a new OPNsense release licence: BSD-2-Clause status: experimental

families: 2 of 6 with hardware platforms: U-Boot for all 9 drivers: npuep and octep kernel modules are built on the appliance

2 - the project, measured on the appliances

the two appliances on the bench, as measured: every badge links to its numbers, and the section it lands on names the module build

XGS 136  ·  ARMADA CN913x  ·  contrib/npuep

XGS 136: 14 of 14 front ports OPNsense 26.7.7 FreeBSD 15.1-RELEASE-p4 kernel 26.7-n284159, followed across the update coprocessor: console, tools, switch read from the host

data path MTU 9000 through both switch chips: one stream 989 Mbit/s clear, 982 through the IPsec tunnel host receive: one TCP stream 773 Mbit/s in and 934 out, was 18.3 and 347 with a 10 ms poll; issue 415 flow offload: the driver's sweep put 11 connections in hardware over 2 next-hop entries ruleset reload: every offloaded flow discarded by the revision barrier

IPsec IPsec offload: AES-GCM both ways in hardware, 20 of 20 in, 10 of 10 out, 10 of 10 forwarded receive termination: every decrypted frame terminated, none refused fragmentation before the envelope: 1,500-byte packets, 5 of 5 from the appliance and 10 of 10 forwarded, DF answered replay window: the engine's check, a replayed frame dropped as a duplicate and as out of window NAT-T: ESP inside UDP 4500 both ways in hardware, 10 of 10 from the peer, 10 of 10 and 5 of 5 fragmented forwarded AES-CBC with HMAC SHA-1/256/384/512: taken both ways in hardware, 10 of 10 from the peer each ccp: the host's AMD crypto engine failed software AES-GCM; IPsec now held to aesni at boot, 903 Mbit/s in software with ccp loaded; issue 399

XGS 3300  ·  OCTEON TX CN83xx  ·  contrib/octep

XGS 3300: 12 of 12 front ports OPNsense 26.7.7 FreeBSD 15.1-RELEASE-p4 kernel 26.7-n284159, its module built for it

data path host path: 957 / 964 Mbit/s plain, four streams flow offload: 99.6 percent of frames in hardware jumbo frames through the switch chip: 10,240 bytes on all ten ports, written at every boot MTU: 72 to 9,000 per port, on the spot sensors: temperatures and fans, read from the host

IPsec IPsec, the engine at both ends: one stream 7.41 Gbit/s at MTU 9000 into an XGS 3300 IPsec offload: AES-GCM both ways, 951 down / 946 up Mbit/s flows with their association: one stream 680 to 750 Mbit/s with the host out of its data path NAT-T: at the plain tunnel's rates AES-CBC with HMAC SHA-1/256/384/512: two thirds of GCM's rate IPv6: outer header and inner packets replay window: up to 4,096 ESN: outbound only; inbound stays with the kernel not offloaded: GCM-8 and GCM-12, transport mode, ESN inbound

reliability integrity soaks: 2,391 GiB over TLS, 0 bytes changed give-backs: 6,100 revived in place, 0 refused open: an idle ring a burst finds, issue 361

colours: green measured and working · yellow partial, the link says which half · light grey not offloaded, by whose refusal the link says · orange an open fault · dark grey a fact about the repository · the version badges in their projects' colours. A badge is corrected the day a measurement contradicts it, the old figure struck beside the new in the section it links to, like everything else here.

Discussion

The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.