Benchmark snapshot
Manual snapshot measured on Apple M4 Pro with Go 1.26.
Throughput
~4.3 Gbit/s
Best full-cycle path
Latency
~2.6 μs
Lowest full-cycle path
Fast-path lookup
~3.9 ns - ~15.0 ns
Flat from 1 to 10,000
Allocs/op
0
Hot path
Full-cycle dataplane
Encrypt, lookup, validate, decrypt, handoff. Upper-bound for the dataplane core, not end-to-end VPN throughput.
| Path | Latency | Throughput | Allocs/op |
|---|---|---|---|
| UDPClient -> Server | ~2.7 μs | ~4.3 Gbit/s | 0 |
| UDPServer -> Client | ~2.6 μs | ~4.3 Gbit/s | 0 |
| TCPClient -> Server | ~2.6 μs | ~4.3 Gbit/s | 0 |
| TCPServer -> Client | ~2.6 μs | ~4.3 Gbit/s | 0 |
Multi-peer UDP scaling
Aggregate throughput with work spread across many peers, not one serialized send lane.
UDP Client -> Server
Aggregate throughputPeers 1~3.4 Gbit/s
Peers 64~34.6 Gbit/s
Peers 1,024~34.2 Gbit/s
UDP Server -> Client
Aggregate throughputPeers 1~3.4 Gbit/s
Peers 64~32.5 Gbit/s
Peers 1,024~31.9 Gbit/s
Lookup and serialization
Internal-IP, allowed-host, and route-ID lookups stay flat. Misses and per-peer serialization are the real pressure points.
| Lookup | Peers | |||
|---|---|---|---|---|
| 1 | 100 | 1,000 | 10,000 | |
| Exact internal lookup | ~8.7 ns | ~9.0 ns | ~9.3 ns | ~9.3 ns |
| Allowed host lookup | ~13.5 ns | ~15.0 ns | ~13.4 ns | ~14.1 ns |
| Route ID lookup | ~3.9 ns | ~6.4 ns | ~6.0 ns | ~6.6 ns |
| Miss path | ~35.4 ns | ~699 ns | ~9.0 μs | ~89.5 μs |
Egress lane
~4.7 ns -> ~80.2 ns
Uncontended to contended sends
Miss path
Linear
~35.4 ns at 1 -> ~89.5 μs at 10,000