Load test

Generate synthetic TCP/UDP traffic against the GPNC's known game IPs to verify the L2-inline detector fires. Run from a host on the subscriber side of the bridge — frames must traverse br-gpnc for the detector to see them.

1 · Download the script

Two files. Save them anywhere — a single directory is easiest.

traffic_gen.py README.md

Or fetch direct from the command line:

curl -O http://status-wtf.netdna.cloud/loadtest/files/traffic_gen.py
curl -O http://status-wtf.netdna.cloud/loadtest/files/README.md

2 · Pre-requisites

Python 3.8+ (no extra packages needed — only stdlib)
Run from a subscriber-side host (e.g. Admin-PC on 10.99.98.x). gpnc-he-1 itself, the Mikrotiks, and BQN are all on the infra skip list and won't trigger the detector.
Network reachability to the game IP. TCP failing is fine — the SYN still leaves your host. UDP needs a usable route.
Optional: SSH key for wtfast@10.80.4.15 so the script can grep the gpnc journal for confirmation. Without it, the verification still works via the status diff.

3 · Quick start

List currently-detectable games:

python3 traffic_gen.py --status-url http://status-wtf.netdna.cloud --list

Drive a game for 90 seconds (TCP + UDP, 20 pps each — long enough that ARP warm + detector trigger + sustained flow all fit inside the window so you'll actually see a session in /sessions):

python3 traffic_gen.py --status-url http://status-wtf.netdna.cloud --game "World of Tanks"

UDP only, 120s, 50pps, against a specific IP:

python3 traffic_gen.py --status-url http://status-wtf.netdna.cloud \
    --game "Albion Online" --proto udp --rate 50 --duration 120 \
    --ip 5.188.125.14

All flags:

python3 traffic_gen.py --help

Defaults raised 2026-04-27: --rate 20 (was 10), --duration 90 (was 30). Short bursts produced too many false MISSes from cold-ARP test subscribers; the script now also primes ARP automatically before the burst.

4 · Currently testable games

Games with at least one /32 IP installed in the matcher. Port-only games (most of the catalog) can't be exercised with this script — pick one from the list below.

Game	/32 IPs	Ports	Sample IP	Quick command
Loading…

5 · What success looks like

The script reports:

active_pairs: before=N after=N+1 with a NEW PAIR line — detector fired.
gpnc journal shows FlowDetector.launch: launch ok for your MAC.
/sessions shows your subscriber MAC with a green active badge and the proper game name.

If after > before but no NEW PAIR for your game, you may have matched a different game (port collision). Look at the Sessions page to see what fired.

Per-MAC chain installs are visible on the Chains page within ~3 seconds of the launch. You can stop the session from /sessions when you're done.

6 · Common confusions

"Kernel matching N pkts but no active proxied flows" banner. This is a live-window hint, not a permanent state. If it appears once after your test burst ends and clears on the next 5s poll, that's the normal "burst ended, flow timed out" behavior. Only worry if it persists across many polls AND the kernel pkt counter is still climbing — that means the engine genuinely can't ingest TPROXY packets.

"My session disappeared from /sessions." Sessions get torn down when (1) you click Stop, (2) the Boost websocket reports IsActiveInCPE=false for non-protected initiators, or (3) gpnc restarts. Stateless and L2-inline-detected sessions are protected.

"My traffic doesn't show up at all." Your source MAC may be on the infra skip list (Mikrotik, BQN, gpnc itself). Source MACs starting with 01: or 33:33: are also skipped (multicast). For test subscribers use 02:* — the locally-administered range, guaranteed not to collide with any real OUI.