CENVERO/STRATUM comparison

Stratum vs enterprise SDN

One platform, the whole stack

See how Cenvero Stratum stacks up against the traditional SDN platforms — then browse the full capability matrix of everything it does, from the in-kernel data plane to DNS, DHCP, routing and clustering.

Get started Explore features

At a glance

data plane In-kernel

footprint One platform

controller None

deployment Bare metal

Comparison

How Stratum compares

Against the platforms teams reach for today — VMware NSX, Cisco ACI, OpenStack Neutron and Open vSwitch.

Supported Not available Not applicable

Capability	Stratum	VMware NSX	Cisco ACI	OpenStack Neutron	Open vSwitch
Line-rate in-kernel data plane	Supported	Not available	Not available	Not available	Not available
Unified control + data plane	Supported	Not available	Not available	Not available	Not applicable
No external controller / manager node	Supported	Not available	Not available	Not available	Not applicable
Runs natively on bare metal	Supported	Not available	Supported	Not available	Supported
Commodity hardware (no vendor NIC/switch)	Supported	Not applicable	Not available	Supported	Supported
Installs in minutes (one agent)	Supported	Not available	Not available	Not available	Not applicable
Open pricing (no per-core / per-VM tax)	Supported	Not available	Not available	Supported	Supported
Signed pull-based self-updates	Supported	Not applicable	Not applicable	Not applicable	Not applicable
Built-in DNS + DHCP + IPAM	Supported	Not applicable	Not applicable	Supported	Not available
Authoritative DNS + DNSSEC signing	Supported	Not applicable	Not applicable	Not applicable	Not available
DHCP tied to IPAM + kernel anti-spoof	Supported	Not applicable	Not applicable	Not applicable	Not available
NAT: masquerade / hairpin / NAT64	Supported	Supported	Supported	Supported	Not available
Built-in BGP speaker + RPKI validation	Supported	Not applicable	Supported	Not applicable	Not available
VXLAN / Geneve / VRF overlays	Supported	Supported	Supported	Supported	Supported
L4 + L7 load balancing (one platform)	Supported	Supported	Not applicable	Supported	Not available
Zero-trust firewall + connection tracking	Supported	Supported	Supported	Supported	Not applicable
Kernel anti-spoof (IP/MAC/ARP/NDP/RA)	Supported	Not applicable	Not applicable	Not applicable	Not available
Per-account private CA + automatic TLS	Supported	Not available	Not available	Not available	Not available
Gateway HA with sub-second failover	Supported	Supported	Supported	Supported	Not available
Multi-tenant isolation + scoped API keys	Supported	Supported	Supported	Supported	Not applicable
SSO (SAML 2.0 + OIDC) + RBAC	Supported	Supported	Supported	Supported	Not available
Prometheus metrics + signed webhooks	Supported	Not applicable	Not applicable	Not applicable	Not available
Signed plugin system + marketplace	Supported	Not available	Not available	Supported	Not available

Measured against traditional SDN platforms; competitor cells reflect general architecture, not a feature-by-feature audit.

Capabilities

Everything Stratum does

The complete capability set — every item below is built into one platform. DNS and DHCP each get their own detailed group, because that depth is where Stratum pulls ahead.

Data plane (in-kernel)

Inline in-kernel packet processing(supported)
Stateful firewall ACL(supported)
Source-NAT / masquerade(supported)
Hairpin NAT (NAT-loopback)(supported)
DNAT / port-forward(supported)
NAT64 (IPv6-only → IPv4)(supported)
NAT66 (IPv6 masquerade)(supported)
ICMP echo NAT (ping)(supported)
FIB routing (IPv4 + IPv6)(supported)
Connection tracking(supported)
Source-IP blocklist (with expiry)(supported)
Zero-downtime rule reloads(supported)

IP address management

IPv4 + IPv6 address pools(supported)
Dual-stack auto-assign / release(supported)
Conflict detection(supported)
Per-tenant address space(supported)
Full lease / allocation visibility(supported)

DNS (authoritative + recursive)

Authoritative zones — A / AAAA / CNAME / MX / TXT / NS / SOA / SRV / PTR(supported)
DNSSEC signing (Ed25519 KSK / ZSK)(supported)
Split-horizon answers(supported)
Recursive forwarders / upstreams(supported)
Closed-resolver recursion ACL(supported)
Sinkhole / blocklist(supported)
Response caching(supported)

DHCP (integrated)

Per-network scopes(supported)
Leases with renew / expiry(supported)
Static MAC → IP reservations(supported)
Reservations reserved in IPAM(supported)
Kernel anti-spoof enforcement(supported)
Flood protection (per-MAC + per-source)(supported)

Routing & NAT control

Static routes(supported)
Policy routing (ip rule)(supported)
Outbound NAT — shared public IP(supported)
Inbound port forwarding(supported)
Dual-stack routing & NAT(supported)
Live add / list / remove rules(supported)

Overlay networks

VXLAN overlays(supported)
Cluster-wide Layer-2(supported)
Per-overlay tenant isolation(supported)
Geneve tunnels(supported)
VRF (virtual routing & forwarding)(supported)
EVPN MAC / VTEP route exchange † control plane(control-plane route exchange available; overlay dataplane in progress)

Anti-spoofing

IP ↔ MAC binding(supported)
ARP protection(supported)
IPv6 NDP guard(supported)
IPv6 RA-guard(supported)
DHCP snooping (v4 + v6)(supported)
Enforced inline in the datapath(supported)

Zero-trust firewall

Layered policy (network → VM)(supported)
Default-deny(supported)
Match addr / net / port / proto / MAC / domain(supported)
Scheduled (time-based) rules(supported)
Domain-based rules (auto-synced)(supported)
Per-source connection limits(supported)
Rule conflict detection(supported)
Presets & batch apply(supported)
Hard / soft hardware binding(supported)

Connection tracking

Stateful inspection(supported)
Automatic return-traffic admit(supported)
Flow table with ageing(supported)
Backs the firewall + NAT(supported)

Intrusion detection

Traffic-anomaly counters(supported)
Early threat signal(supported)
Works alongside the firewall(supported)
Tied into alerting + events(supported)

Load balancing

L4 load-balancer virtual IPs(supported)
RR / least-conn / weighted / source-hash(supported)
Consistent-hash backend affinity(supported)
Active + passive health checks(supported)
L7 HTTP routing (host / path)(supported)
TLS termination(supported)

BGP edge routing

BGP speaker(supported)
Advertise tenant networks(supported)
Best-path selection(supported)
Prefix-lists & route-maps(supported)
BFD (sub-second detection)(supported)
Graceful restart(supported)
RPKI / ROV origin validation(supported)

HA & failover

Redundant active / standby gateways(supported)
Sub-second heartbeat(supported)
Failover + operator-controlled failback(supported)
One owner per virtual IP(supported)
Portable / floating IPs(supported)
Millisecond takeover(supported)
Cluster-wide IP ownership(supported)

Clustering

Cluster-wide virtual networks(supported)
Leader election + replicated state(supported)
Addresses / blocklists / peers / tenants replicated(supported)
Compute & gateway node modes(supported)

Multi-tenancy & isolation

Tenant management + quotas(supported)
Scoped API keys(supported)
Private networks(supported)
Container networking(supported)
VM / container-portable model(supported)
VLAN lockdown(supported)

Bandwidth & usage

Per-VM shaping (up / down, pools, burst)(supported)
Monthly usage quotas(supported)
Byte / packet accounting (95th pct)(supported)
Flow records + CSV / JSON export(supported)

Interfaces & hardware

NIC detection + stable naming(supported)
Link bonding(supported)
MTU consistency(supported)
Tamper detect-and-reconcile(supported)
Interface lockdown (opt-in BPF-LSM)(supported)
Optional hardware offload ‡(supported)

Observability

Prometheus metrics(supported)
Threshold alerts (actions / cooldown / history)(supported)
Live event stream(supported)
Structured audit log(supported)
Signed event webhooks (HMAC)(supported)
Bulk operations(supported)

Platform & lifecycle

Signed pull updates + rollback(supported)
Self-healing health checks(supported)
Independent watchdog(supported)
Backup & restore (schedules / retention)(supported)

Security & auth

Signed configs / licenses / plugins / binaries(supported)
Brute-force lockout(supported)
API request validation(supported)
Time-drift / anti-tamper checks(supported)
SAML 2.0 SSO(supported)
OIDC SSO(supported)
RBAC roles(supported)
Per-account TLS CA + auto node certs(supported)

Licensing & activation

Hardware-bound licenses(supported)
Per-machine activation(supported)
Silent auto-renewal(supported)
Key regeneration(supported)
Guided onboarding(supported)
Signed revocation (CRL)(supported)

Plugins & developer program

Cryptographically-signed plugins(supported)
Sandboxed out-of-process execution(supported)
Built-in store(supported)
Developer program (scoped certs)(supported)
Marketplace publishing(supported)
Signed revocation list(supported)

APIs & CLI

REST / gRPC / WebSocket API(supported)
API-token authentication(supported)
Full cenvero-str-ctl CLI(supported)
Bulk create (rules / DNS records)(supported)
Real-time event stream (SSE / WS)(supported)
One-line install / onboarding(supported)

† EVPN route exchange is available today; overlay-dataplane programming from learned routes is in progress. ‡ Hardware offload is optional; the default data plane runs in software. Capabilities are built and kernel-validated; large-scale multi-host performance benchmarks are ongoing.

CENVERO/STRATUM deploy today

Deploy

Replace the rack, not the budget

Every capability above ships with each license. No controller appliance, no per-core tax.

Get started See pricing