Andree Toonk releases Wireblast to simplify 100 Gbps packet testing

Why it matters

Wireblast turns a specialist Linux kernel-bypass interface into a downloadable Go tool while giving Toonk a benchmark rig for a separate dataplane project.

Andree Toonk (@atoonk) released Wireblast, an open-source Linux packet generator that packages AF_XDP network acceleration into a static Go binary. In a launch post published in early August, Toonk reported pushing up to 98.5 Gbps on a 100 Gbps Mellanox link, positioning the tool between the simplicity of iperf3 and the heavier machinery used in dedicated network-testing systems. The results are Toonk's own benchmarks and have not been independently reproduced.

Wireblast is a personal open-source release rather than a new startup. Toonk publishes the project on his infrastructure engineering site. Its significance comes from the engineer behind it and what he intends to build next. Toonk has spent his career working on the systems that route, protect and provide access to internet infrastructure. Wireblast is a Go-based AF_XDP traffic generator for Linux. Toonk says it will serve as a test harness when he returns to a separate project: a Go-based dataplane for routing, switching and firewall functions. (toonk.io)

Toonk later worked on OpenDNS's global network architecture and founded BGPMon, a routing-monitoring service used by thousands of network engineers. BGPMon joined OpenDNS in 2015. Toonk also holds an M.Sc. in System and Network Engineering from the University of Amsterdam. (Black Hat biography)

Tailscale describes Border0, Toonk's former startup, as a system for controlled and auditable access to production systems, databases, Kubernetes and other sensitive infrastructure. Toonk joined Tailscale with the Border0 team after Border0 joined Tailscale in March 2026. The Border0 team is working on privileged-access management. Wireblast returns Toonk to the lower layers of the stack, where the operating system, network interface card and packet format determine performance.

Turning AF_XDP into a usable tool

Wireblast grew out of go-afxdp, Toonk's Go library for Linux's AF_XDP interface. AF_XDP lets a program exchange Ethernet frames with a network card through shared memory and XDP, avoiding much of the usual kernel networking path and its per-packet overhead.

In an earlier article about AF_XDP, Toonk argues that the design offers an operational advantage over DPDK-based generators. He writes that AF_XDP can redirect selected traffic while leaving the network interface available to Linux, allowing ordinary host networking to continue during a test. His comparison says DPDK can take control of the full interface and require dedicated interfaces, hugepages and additional setup.

Toonk's bet is that many engineers need raw packet volume without the setup and breadth of a complete test appliance. Wireblast runs through an interactive terminal wizard or command-line flags and supports fixed-size UDP traffic, multiple flows, an IMIX packet-size profile, PCAP and PCAPNG replay, and stateless TCP SYN generation. (Wireblast documentation) Releases are available for Linux, and the repository is available on GitHub.

The tradeoffs are explicit. Wireblast counts packets and bytes, but it does not measure latency or jitter, provide hardware timestamping or establish complete TCP sessions. In his launch article, Toonk frames that narrow scope around two tests: whether a packet-processing path can reach line rate and whether the far end receives the packets.

The 100 Gbps claim

On 10 Gbps hardware, Toonk's Wireblast launch post reported 14.88 million packets per second with 64-byte frames. Separately, a review of the public go-afxdp package documentation cited approximately 13.5 million packets per second on 10G when transmitting 64-byte frames from userspace Go on one Intel ixgbe network card.

For the 100G test, Toonk used two machines equipped with Mellanox ConnectX network cards and the mlx5 driver. He reported 122 million packets per second at 98 Gbps with 80-byte packets. His table showed results ranging from 95 Gbps with minimum tagged frames to 98.5 Gbps with 1,518-byte frames. (toonk.io)

The headline figure needs that context. The repository describes 138 million packets per second with the smallest frames, while the launch article's detailed table reports 135 million packets per second and 95 Gbps for 68-byte tagged frames. Both sets of figures come from Toonk's testing. Hardware, driver mode, queue count, frame-size accounting and whether throughput is measured at Layer 1 or Layer 2 can materially change the result. Wireblast's documentation includes a section explaining those measurement differences.

Wireblast also occupies a narrower category than established alternatives. Pktgen-DPDK is a multi-port, multi-core generator with Lua and remote-control support. MoonGen offers programmable per-packet behavior, timestamping and rate control. Toonk presents Wireblast as a simpler tool for common packet-generation work rather than a replacement for those systems. (Toonk's launch post)

A founder's test rig for the next project

Wireblast's immediate audience is engineers testing routers, firewalls, load balancers, access-control lists, ECMP paths, receive-side scaling and connection tables. Its longer-term purpose belongs to Toonk. He wrote that the generator lets him return to the project that prompted the work: an all-Go dataplane for packet forwarding on Linux.

Toonk first built a reusable AF_XDP library, then a generator capable of stressing it. He now has the measurement tool needed to iterate on the larger forwarding system. He also credited Claude Code with speeding up development of Wireblast's terminal interface. (toonk.io)

The Wireblast repository gives infrastructure engineers access to the implementation and downloadable Linux builds for testing on their own hardware.