diff --git a/acceptance/common/docker.py b/acceptance/common/docker.py
index 0af9a69bc4..c6f56fb2c8 100644
--- a/acceptance/common/docker.py
+++ b/acceptance/common/docker.py
@@ -197,7 +197,7 @@ def assert_no_networks(writer=None):
             writer.write("Docker networking assertions are OFF\n")
         return
 
-    allowed_nets = ['bridge', 'host', 'none']
+    allowed_nets = ['bridge', 'host', 'none', 'benchmark']
     unexpected_nets = []
     for net in _get_networks():
         if net.name not in allowed_nets:
diff --git a/acceptance/router_benchmark/test.py b/acceptance/router_benchmark/test.py
index 2049d9eea3..428b58f71e 100755
--- a/acceptance/router_benchmark/test.py
+++ b/acceptance/router_benchmark/test.py
@@ -141,7 +141,7 @@ def _run(self):
             "-name", "router_benchmark",
             "-cmd", "./bin/end2endblast",
             "-attempts", 1500000,
-            "-timeout", "120s",  # Timeout is for all attempts together
+            "-timeout", "180s",  # Timeout is for all attempts together
             "-parallelism", 100,
             "-subset", "noncore#core#remoteISD"
         ].run_tee()
diff --git a/acceptance/router_newbenchmark/BUILD.bazel b/acceptance/router_newbenchmark/BUILD.bazel
new file mode 100644
index 0000000000..1a93da0376
--- /dev/null
+++ b/acceptance/router_newbenchmark/BUILD.bazel
@@ -0,0 +1,28 @@
+load("//acceptance/common:raw.bzl", "raw_test")
+
+exports_files([
+    "conf",
+    "test.py",
+])
+
+args = [
+    "--executable",
+    "brload:$(location //acceptance/router_newbenchmark/brload:brload)",
+    "--container-loader=posix-router:latest#$(location //docker:posix_router)",
+]
+
+data = [
+    ":conf",
+    "//docker:posix_router",
+    "//acceptance/router_newbenchmark/brload:brload",
+]
+
+raw_test(
+    name = "test",
+    src = "test.py",
+    args = args,
+    data = data,
+    homedir = "$(rootpath //docker:posix_router)",
+    # This test uses sudo and accesses /var/run/netns.
+    local = True,
+)
diff --git a/acceptance/router_newbenchmark/brload/BUILD.bazel b/acceptance/router_newbenchmark/brload/BUILD.bazel
new file mode 100644
index 0000000000..e475b8b68a
--- /dev/null
+++ b/acceptance/router_newbenchmark/brload/BUILD.bazel
@@ -0,0 +1,27 @@
+load("//tools/lint:go.bzl", "go_library")
+load("//:scion.bzl", "scion_go_binary")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "github.com/scionproto/scion/acceptance/router_newbenchmark/brload",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//acceptance/router_newbenchmark/cases:go_default_library",
+        "//pkg/log:go_default_library",
+        "//pkg/private/serrors:go_default_library",
+        "//pkg/scrypto:go_default_library",
+        "//pkg/slayers:go_default_library",
+        "//private/keyconf:go_default_library",
+        "@com_github_google_gopacket//:go_default_library",
+        "@com_github_google_gopacket//afpacket:go_default_library",
+        "@com_github_google_gopacket//layers:go_default_library",
+        "@com_github_spf13_cobra//:go_default_library",
+    ],
+)
+
+scion_go_binary(
+    name = "brload",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
diff --git a/acceptance/router_newbenchmark/brload/main.go b/acceptance/router_newbenchmark/brload/main.go
new file mode 100644
index 0000000000..40e50cfbf6
--- /dev/null
+++ b/acceptance/router_newbenchmark/brload/main.go
@@ -0,0 +1,316 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"hash"
+	"net"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/afpacket"
+	"github.com/google/gopacket/layers"
+	"github.com/spf13/cobra"
+
+	"github.com/scionproto/scion/acceptance/router_newbenchmark/cases"
+	"github.com/scionproto/scion/pkg/log"
+	"github.com/scionproto/scion/pkg/private/serrors"
+	"github.com/scionproto/scion/pkg/scrypto"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/private/keyconf"
+)
+
+type Case func(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte)
+
+type caseChoice string
+
+func (c *caseChoice) String() string {
+	return string(*c)
+}
+
+func (c *caseChoice) Set(v string) error {
+	_, ok := allCases[v]
+	if !ok {
+		return errors.New("No such case")
+	}
+	*c = caseChoice(v)
+	return nil
+}
+
+func (c *caseChoice) Type() string {
+	return "string enum"
+}
+
+func (c *caseChoice) Allowed() string {
+	return fmt.Sprintf("One of: %v", reflect.ValueOf(allCases).MapKeys())
+}
+
+var (
+	allCases = map[string]Case{
+		"in":          cases.In,
+		"out":         cases.Out,
+		"in_transit":  cases.InTransit,
+		"out_transit": cases.OutTransit,
+		"br_transit":  cases.BrTransit,
+	}
+	logConsole string
+	dir        string
+	numPackets int
+	numStreams int
+	caseToRun  caseChoice
+	interfaces []string
+)
+
+func main() {
+	rootCmd := &cobra.Command{
+		Use:   "brload",
+		Short: "Generates traffic into a specific router of a specific topology",
+	}
+	intfCmd := &cobra.Command{
+		Use:   "show-interfaces",
+		Short: "Provides a terse list of the interfaces that this test requires",
+		Run: func(cmd *cobra.Command, args []string) {
+			os.Exit(showInterfaces(cmd))
+		},
+	}
+	runCmd := &cobra.Command{
+		Use:   "run",
+		Short: "Executes the test",
+		Run: func(cmd *cobra.Command, args []string) {
+			os.Exit(run(cmd))
+		},
+	}
+	runCmd.Flags().IntVar(&numPackets, "num-packets", 10, "Number of packets to send")
+	runCmd.Flags().IntVar(&numStreams, "num-streams", 4,
+		"Number of independent streams (flowID) to use")
+	runCmd.Flags().StringVar(&logConsole, "log.console", "error",
+		"Console logging level: debug|info|error|etc.")
+	runCmd.Flags().StringVar(&dir, "artifacts", "", "Artifacts directory")
+	runCmd.Flags().Var(&caseToRun, "case", "Case to run. "+caseToRun.Allowed())
+	runCmd.Flags().StringArrayVar(&interfaces, "interface", []string{},
+		`label=host_interface,mac,peer_mac where:
+    host_interface: use this to exchange traffic with interface <label>
+    mac: the mac address of interface <label>
+    peer_mac: the mac address of <host_interface>`)
+	runCmd.MarkFlagRequired("case")
+	runCmd.MarkFlagRequired("interface")
+
+	rootCmd.AddCommand(intfCmd)
+	rootCmd.AddCommand(runCmd)
+	rootCmd.CompletionOptions.HiddenDefaultCmd = true
+
+	if rootCmd.Execute() != nil {
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
+func showInterfaces(cmd *cobra.Command) int {
+	fmt.Println(cases.ListInterfaces())
+	return 0
+}
+
+func run(cmd *cobra.Command) int {
+	logCfg := log.Config{Console: log.ConsoleConfig{Level: logConsole}}
+	if err := log.Setup(logCfg); err != nil {
+		fmt.Fprintf(os.Stderr, "%s\n", err)
+		return 1
+	}
+	defer log.HandlePanic()
+
+	caseFunc := allCases[string(caseToRun)] // key already checked.
+
+	artifactsDir := dir
+	if v := os.Getenv("TEST_ARTIFACTS_DIR"); v != "" {
+		artifactsDir = v
+	}
+
+	if artifactsDir == "" {
+		log.Error("Artifacts directory not configured")
+		return 1
+	}
+
+	hfMAC, err := loadKey(artifactsDir)
+	if err != nil {
+		log.Error("Loading keys failed", "err", err)
+		return 1
+	}
+
+	cases.InitInterfaces(interfaces)
+	handles, err := openDevices()
+	if err != nil {
+		log.Error("Loading devices failed", "err", err)
+		return 1
+	}
+
+	registerScionPorts()
+
+	log.Info("BRLoad acceptance tests:")
+
+	payloadString := "actualpayloadbytes"
+	caseDevIn, caseDevOut, rawPkts := caseFunc(payloadString, hfMAC, numStreams)
+
+	writePktTo, ok := handles[caseDevIn]
+	if !ok {
+		log.Error("device not found", "device", caseDevIn)
+		return 1
+	}
+
+	readPktFrom, ok := handles[caseDevOut]
+	if !ok {
+		log.Error("device not found", "device", caseDevOut)
+		return 1
+	}
+
+	// Try and pick-up one packet and check the payload. If that works, we're content
+	// that this test works.
+	packetSource := gopacket.NewPacketSource(readPktFrom, layers.LinkTypeEthernet)
+	packetChan := packetSource.Packets()
+	listenerChan := make(chan int)
+
+	go func() {
+		defer log.HandlePanic()
+		defer close(listenerChan)
+		listenerChan <- receivePackets(packetChan, payloadString)
+	}()
+
+	// We started everything that could be started. So the best window for perf mertics
+	// opens somewhere around now.
+	metricsBegin := time.Now().Unix()
+	for i := 0; i < numPackets; i++ {
+		if err := writePktTo.WritePacketData(rawPkts[i%numStreams]); err != nil {
+			log.Error("writing input packet", "case", string(caseToRun), "error", err)
+			return 1
+		}
+	}
+	metricsEnd := time.Now().Unix()
+	// The test harness looks for this output.
+	fmt.Printf("metricsBegin: %d metricsEnd: %d\n", metricsBegin, metricsEnd)
+
+	// Get the results from the packet listener.
+	// Give it one second as in very short tests (<1M pkts) we get here before the first packet.
+	outcome := 0
+	timeout := time.After(1 * time.Second)
+	for outcome == 0 {
+		select {
+		case outcome = <-listenerChan:
+			if outcome == 0 {
+				log.Error("Listener never saw a valid packet being forwarded")
+				return 1
+			}
+		case <-timeout:
+			// If our listener is still stuck there, unstick it. Closing the device doesn't cause
+			// the packet channel to close (presumably a bug). Close the channel ourselves. After
+			// this, the next loop is guaranteed an outcome.
+			close(packetChan)
+		}
+	}
+
+	fmt.Printf("Listener results: %d\n", outcome)
+	return 0
+}
+
+// receivePkts consume some or all (at least one if it arrives) of the packets
+// arriving on the given handle and checks that they contain the given payload.
+// The number of consumed packets is returned.
+// Currently we are content with receiving a single correct packet and we terminate after
+// that.
+func receivePackets(packetChan chan gopacket.Packet, payload string) int {
+	numRcv := 0
+
+	for {
+		got, ok := <-packetChan
+		if !ok {
+			// No more packets
+			log.Info("No more Packets")
+			return numRcv
+		}
+		if err := got.ErrorLayer(); err != nil {
+			log.Error("error decoding packet", "err", err)
+			continue
+		}
+		layer := got.Layer(gopacket.LayerTypePayload)
+		if layer == nil {
+			log.Error("error fetching packet payload: no PayLoad")
+			continue
+		}
+		if string(layer.LayerContents()) == payload {
+			// To return the count of all packets received, just remove the "return" below.
+			// Return will occur once packetChan closes (which happens after a short timeout at
+			// the end of the test.
+			numRcv++
+			return numRcv
+		}
+	}
+}
+
+// initDevices inventories the available network interfaces, picks the ones that a case may inject
+// traffic into, and associates them with a AF Packet interface. It returns the packet interfaces
+// corresponding to each network interface.
+func openDevices() (map[string]*afpacket.TPacket, error) {
+	devs, err := net.Interfaces()
+	if err != nil {
+		return nil, serrors.WrapStr("listing network interfaces", err)
+	}
+
+	handles := make(map[string]*afpacket.TPacket)
+
+	for _, dev := range devs {
+		if !strings.HasPrefix(dev.Name, "veth_") || !strings.HasSuffix(dev.Name, "_host") {
+			continue
+		}
+		handle, err := afpacket.NewTPacket(afpacket.OptInterface(dev.Name))
+		if err != nil {
+			return nil, serrors.WrapStr("creating TPacket", err)
+		}
+		handles[dev.Name] = handle
+	}
+
+	return handles, nil
+}
+
+// loadKey loads the keys that the router under test uses to sign hop fields.
+func loadKey(artifactsDir string) (hash.Hash, error) {
+	keysDir := filepath.Join(artifactsDir, "conf", "keys")
+	mk, err := keyconf.LoadMaster(keysDir)
+	if err != nil {
+		return nil, err
+	}
+	macGen, err := scrypto.HFMacFactory(mk.Key0)
+	if err != nil {
+		return nil, err
+	}
+	return macGen(), nil
+}
+
+// registerScionPorts registers the following UDP ports in gopacket such as SCION is the
+// next layer. In other words, map the following ports to expect SCION as the payload.
+func registerScionPorts() {
+	for i := 30041; i < 30043; i++ {
+		layers.RegisterUDPPortLayerType(layers.UDPPort(i), slayers.LayerTypeSCION)
+	}
+	for i := 30000; i < 30010; i++ {
+		layers.RegisterUDPPortLayerType(layers.UDPPort(i), slayers.LayerTypeSCION)
+	}
+	for i := 50000; i < 50010; i++ {
+		layers.RegisterUDPPortLayerType(layers.UDPPort(i), slayers.LayerTypeSCION)
+	}
+}
diff --git a/acceptance/router_newbenchmark/cases/BUILD.bazel b/acceptance/router_newbenchmark/cases/BUILD.bazel
new file mode 100644
index 0000000000..d7e13f435b
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/BUILD.bazel
@@ -0,0 +1,29 @@
+load("//tools/lint:go.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "br_transit.go",
+        "in.go",
+        "in_transit.go",
+        "out.go",
+        "out_transit.go",
+        "topo.go",
+    ],
+    importpath = "github.com/scionproto/scion/acceptance/router_newbenchmark/cases",
+    visibility = [
+        "//acceptance/router_newbenchmark:__pkg__",
+        "//acceptance/router_newbenchmark:__subpackages__",
+    ],
+    deps = [
+        "//pkg/addr:go_default_library",
+        "//pkg/private/util:go_default_library",
+        "//pkg/private/xtest:go_default_library",
+        "//pkg/scrypto:go_default_library",
+        "//pkg/slayers:go_default_library",
+        "//pkg/slayers/path:go_default_library",
+        "//pkg/slayers/path/scion:go_default_library",
+        "@com_github_google_gopacket//:go_default_library",
+        "@com_github_google_gopacket//layers:go_default_library",
+    ],
+)
diff --git a/acceptance/router_newbenchmark/cases/br_transit.go b/acceptance/router_newbenchmark/cases/br_transit.go
new file mode 100644
index 0000000000..789856ad61
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/br_transit.go
@@ -0,0 +1,144 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"hash"
+	"time"
+
+	"github.com/google/gopacket"
+
+	"github.com/scionproto/scion/pkg/private/util"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/pkg/slayers/path"
+	"github.com/scionproto/scion/pkg/slayers/path/scion"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+// See topo.go
+
+// oneBrTransit generates one packet of "br_transit" traffic over the router under test.
+// The outcome is a raw packet which the test must feed to the router.
+func oneBrTransit(payload string, mac hash.Hash, flowId uint32) []byte {
+
+	var (
+		originIA       = ISDAS(2)
+		originIP       = PublicIP(2, 1)
+		originHost     = HostAddr(originIP)
+		srcIP, srcPort = PublicIPPort(2, 1)
+		dstIP, dstPort = PublicIPPort(1, 2)
+		targetIA       = ISDAS(3)
+		targetIP       = PublicIP(3, 1)
+		targetHost     = HostAddr(targetIP)
+	)
+
+	options := gopacket.SerializeOptions{
+		FixLengths:       true,
+		ComputeChecksums: true,
+	}
+
+	ethernet, ip, udp := Underlay(srcIP, srcPort, dstIP, dstPort)
+
+	// Fully correct (hopefully) path.
+	sp := &scion.Decoded{
+		Base: scion.Base{
+			PathMeta: scion.MetaHdr{
+				CurrHF: 1,
+				SegLen: [3]uint8{2, 2, 0},
+			},
+			NumINF:  2,
+			NumHops: 4,
+		},
+		InfoFields: []path.InfoField{
+			{
+				SegID:     0x111,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   false,
+			},
+			{
+				SegID:     0x222,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   true,
+			},
+		},
+		HopFields: []path.HopField{
+			{ConsIngress: 1, ConsEgress: 0}, // From there (non-consdir)
+			{ConsIngress: 0, ConsEgress: 2}, // <- Processed here (non-consdir)
+			{ConsIngress: 0, ConsEgress: 3}, // Down via this
+			{ConsIngress: 1, ConsEgress: 0}, // To there
+		},
+	}
+
+	// Calculate MACs...
+	// Seg0: Hops are in non-consdir.
+	sp.HopFields[1].Mac = path.MAC(mac, sp.InfoFields[0], sp.HopFields[1], nil)
+	sp.InfoFields[0].UpdateSegID(sp.HopFields[1].Mac)
+	sp.HopFields[0].Mac = path.MAC(FakeMAC(2), sp.InfoFields[0], sp.HopFields[0], nil)
+
+	// Seg1: in the natural order.
+	sp.HopFields[2].Mac = path.MAC(mac, sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].UpdateSegID(sp.HopFields[2].Mac) // tmp
+	sp.HopFields[3].Mac = path.MAC(FakeMAC(3), sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].SegID = 0x222 // Restore to initial.
+
+	// End-to-end. Src is the originator and Dst is the final destination.
+	scionL := &slayers.SCION{
+		Version:      0,
+		TrafficClass: 0xb8,
+		FlowID:       flowId,
+		NextHdr:      slayers.L4UDP,
+		PathType:     scion.PathType,
+		SrcIA:        originIA,
+		DstIA:        targetIA,
+		Path:         sp,
+	}
+	if err := scionL.SetSrcAddr(originHost); err != nil {
+		panic(err)
+	}
+	if err := scionL.SetDstAddr(targetHost); err != nil {
+		panic(err)
+	}
+
+	scionudp := &slayers.UDP{}
+	scionudp.SrcPort = 50000
+	scionudp.DstPort = 50000
+	scionudp.SetNetworkLayerForChecksum(scionL)
+
+	payloadBytes := []byte(payload)
+
+	// Prepare input packet
+	input := gopacket.NewSerializeBuffer()
+	if err := gopacket.SerializeLayers(input, options,
+		ethernet, ip, udp, scionL, scionudp, gopacket.Payload(payloadBytes),
+	); err != nil {
+		panic(err)
+	}
+	return input.Bytes()
+}
+
+// BrTransit generates numDistinct packets (each with a unique flowID) with the given payload
+// constructed to cause br_transit traffic at the br1a router.
+// numDistrinct is a small number, only to enable multiple parallel streams. Each distinct packet
+// is meant to be replayed a large number of times for performance measurement.
+func BrTransit(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte) {
+	packets := make([][]byte, numDistinct)
+	for i := 0; i < numDistinct; i++ {
+		packets[i] = oneBrTransit(payload, mac, uint32(i+1))
+	}
+	return DeviceName(1, 2), DeviceName(1, 3), packets
+}
diff --git a/acceptance/router_newbenchmark/cases/in.go b/acceptance/router_newbenchmark/cases/in.go
new file mode 100644
index 0000000000..bf760a2fb0
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/in.go
@@ -0,0 +1,131 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"hash"
+	"time"
+
+	"github.com/google/gopacket"
+
+	"github.com/scionproto/scion/pkg/private/util"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/pkg/slayers/path"
+	"github.com/scionproto/scion/pkg/slayers/path/scion"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+// See topo.go
+
+// oneIn generates one packet of incoming traffic into AS1 at br1a. The outcome is a raw packet
+// that the test must feed into the router.
+func oneIn(payload string, mac hash.Hash, flowId uint32) []byte {
+
+	var (
+		originIA       = ISDAS(2)
+		originIP       = PublicIP(2, 1)
+		originHost     = HostAddr(originIP)
+		srcIP, srcPort = PublicIPPort(2, 1)
+		dstIP, dstPort = PublicIPPort(1, 2)
+		targetIA       = ISDAS(1)
+		targetIP       = InternalIP(1, 2)
+		targetHost     = HostAddr(targetIP)
+	)
+
+	options := gopacket.SerializeOptions{
+		FixLengths:       true,
+		ComputeChecksums: true,
+	}
+
+	ethernet, ip, udp := Underlay(srcIP, srcPort, dstIP, dstPort)
+
+	// Fully correct (hopefully) path.
+	sp := &scion.Decoded{
+		Base: scion.Base{
+			PathMeta: scion.MetaHdr{
+				CurrHF: 1,
+				SegLen: [3]uint8{2, 0, 0},
+			},
+			NumINF:  1,
+			NumHops: 2,
+		},
+		InfoFields: []path.InfoField{
+			{
+				SegID:     0x111,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   false,
+			},
+		},
+		HopFields: []path.HopField{
+			{ConsIngress: 1, ConsEgress: 0}, // From there (non-consdir)
+			{ConsIngress: 0, ConsEgress: 2}, // <- Processed here (non-consdir)
+		},
+	}
+
+	// Calculate MACs...
+	// Seg0: Hops are in non-consdir.
+	sp.HopFields[1].Mac = path.MAC(mac, sp.InfoFields[0], sp.HopFields[1], nil)
+	sp.InfoFields[0].UpdateSegID(sp.HopFields[1].Mac)
+	sp.HopFields[0].Mac = path.MAC(FakeMAC(2), sp.InfoFields[0], sp.HopFields[0], nil)
+
+	// End-to-end. Src is the originator and Dst is the final destination.
+	scionL := &slayers.SCION{
+		Version:      0,
+		TrafficClass: 0xb8,
+		FlowID:       flowId,
+		NextHdr:      slayers.L4UDP,
+		PathType:     scion.PathType,
+		SrcIA:        originIA,
+		DstIA:        targetIA,
+		Path:         sp,
+	}
+	if err := scionL.SetSrcAddr(originHost); err != nil {
+		panic(err)
+	}
+	if err := scionL.SetDstAddr(targetHost); err != nil {
+		panic(err)
+	}
+
+	scionudp := &slayers.UDP{}
+	scionudp.SrcPort = 50000
+	scionudp.DstPort = 50000
+	scionudp.SetNetworkLayerForChecksum(scionL)
+
+	payloadBytes := []byte(payload)
+
+	// Prepare input packet
+	input := gopacket.NewSerializeBuffer()
+	if err := gopacket.SerializeLayers(input, options,
+		ethernet, ip, udp, scionL, scionudp, gopacket.Payload(payloadBytes),
+	); err != nil {
+		panic(err)
+	}
+	return input.Bytes()
+}
+
+// In generates numDistinct packets (each with a unique flowID) with the given payload
+// constructed to cause "in" traffic at the br1a router.
+// numDistrinct is a small number, only to enable multiple parallel streams. Each distinct packet
+// is meant to be replayed a large number of times for performance measurement.
+func In(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte) {
+	packets := make([][]byte, numDistinct)
+	for i := 0; i < numDistinct; i++ {
+		packets[i] = oneIn(payload, mac, uint32(i+1))
+	}
+	return DeviceName(1, 2), DeviceName(1, 0), packets
+}
diff --git a/acceptance/router_newbenchmark/cases/in_transit.go b/acceptance/router_newbenchmark/cases/in_transit.go
new file mode 100644
index 0000000000..de51f87d7a
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/in_transit.go
@@ -0,0 +1,144 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"hash"
+	"time"
+
+	"github.com/google/gopacket"
+
+	"github.com/scionproto/scion/pkg/private/util"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/pkg/slayers/path"
+	"github.com/scionproto/scion/pkg/slayers/path/scion"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+// See topo.go
+
+// oneInTransit generates one packet of "in_transit" traffic over the router under test.
+// The outcome is a raw packet that the test must feed into the router.
+func oneInTransit(payload string, mac hash.Hash, flowId uint32) []byte {
+
+	var (
+		originIA       = ISDAS(2)
+		originIP       = PublicIP(2, 1)
+		originHost     = HostAddr(originIP)
+		srcIP, srcPort = PublicIPPort(2, 1)
+		dstIP, dstPort = PublicIPPort(1, 2)
+		targetIA       = ISDAS(4)
+		targetIP       = PublicIP(4, 1)
+		targetHost     = HostAddr(targetIP)
+	)
+
+	options := gopacket.SerializeOptions{
+		FixLengths:       true,
+		ComputeChecksums: true,
+	}
+
+	ethernet, ip, udp := Underlay(srcIP, srcPort, dstIP, dstPort)
+
+	// Fully correct (hopefully) path.
+	sp := &scion.Decoded{
+		Base: scion.Base{
+			PathMeta: scion.MetaHdr{
+				CurrHF: 1,
+				SegLen: [3]uint8{2, 2, 0},
+			},
+			NumINF:  2,
+			NumHops: 4,
+		},
+		InfoFields: []path.InfoField{
+			{
+				SegID:     0x111,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   false,
+			},
+			{
+				SegID:     0x222,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   true,
+			},
+		},
+		HopFields: []path.HopField{
+			{ConsIngress: 1, ConsEgress: 0}, // From there (non-consdir)
+			{ConsIngress: 0, ConsEgress: 2}, // <- Processed here (non-consdir)
+			{ConsIngress: 0, ConsEgress: 4}, // Sideways to as4 via this
+			{ConsIngress: 1, ConsEgress: 0}, // To there
+		},
+	}
+
+	// Calculate MACs...
+	// Seg0: Hops are in non-consdir.
+	sp.HopFields[1].Mac = path.MAC(mac, sp.InfoFields[0], sp.HopFields[1], nil)
+	sp.InfoFields[0].UpdateSegID(sp.HopFields[1].Mac)
+	sp.HopFields[0].Mac = path.MAC(FakeMAC(2), sp.InfoFields[0], sp.HopFields[0], nil)
+
+	// Seg1: in the natural order.
+	sp.HopFields[2].Mac = path.MAC(mac, sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].UpdateSegID(sp.HopFields[2].Mac) // tmp
+	sp.HopFields[3].Mac = path.MAC(FakeMAC(4), sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].SegID = 0x222 // Restore to initial.
+
+	// End-to-end. Src is the originator and Dst is the final destination.
+	scionL := &slayers.SCION{
+		Version:      0,
+		TrafficClass: 0xb8,
+		FlowID:       flowId,
+		NextHdr:      slayers.L4UDP,
+		PathType:     scion.PathType,
+		SrcIA:        originIA,
+		DstIA:        targetIA,
+		Path:         sp,
+	}
+	if err := scionL.SetSrcAddr(originHost); err != nil {
+		panic(err)
+	}
+	if err := scionL.SetDstAddr(targetHost); err != nil {
+		panic(err)
+	}
+
+	scionudp := &slayers.UDP{}
+	scionudp.SrcPort = 50000
+	scionudp.DstPort = 50000
+	scionudp.SetNetworkLayerForChecksum(scionL)
+
+	payloadBytes := []byte(payload)
+
+	// Prepare input packet
+	input := gopacket.NewSerializeBuffer()
+	if err := gopacket.SerializeLayers(input, options,
+		ethernet, ip, udp, scionL, scionudp, gopacket.Payload(payloadBytes),
+	); err != nil {
+		panic(err)
+	}
+	return input.Bytes()
+}
+
+// InTransit generates numDistinct packets (each with a unique flowID) with the given payload
+// constructed to cause in_transit traffic at the br1a router.
+// numDistrinct is a small number, only to enable multiple parallel streams. Each distinct packet
+// is meant to be replayed a large number of times for performance measurement.
+func InTransit(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte) {
+	packets := make([][]byte, numDistinct)
+	for i := 0; i < numDistinct; i++ {
+		packets[i] = oneInTransit(payload, mac, uint32(i+1))
+	}
+	return DeviceName(1, 2), DeviceName(1, 0), packets
+}
diff --git a/acceptance/router_newbenchmark/cases/out.go b/acceptance/router_newbenchmark/cases/out.go
new file mode 100644
index 0000000000..0f36ca5267
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/out.go
@@ -0,0 +1,133 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"hash"
+	"time"
+
+	"github.com/google/gopacket"
+
+	"github.com/scionproto/scion/pkg/private/util"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/pkg/slayers/path"
+	"github.com/scionproto/scion/pkg/slayers/path/scion"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+// See topo.go
+
+// oneOut generates one packet of outgoing traffic from AS1 at br1a. The outcome is a raw packet
+// that the test must feed into the router.
+func oneOut(payload string, mac hash.Hash, flowId uint32) []byte {
+
+	var (
+		originIA       = ISDAS(1)
+		originIP       = InternalIP(1, 2)
+		originHost     = HostAddr(originIP)
+		srcIP, srcPort = InternalIPPort(1, 2)
+		dstIP, dstPort = InternalIPPort(1, 1)
+		targetIA       = ISDAS(2)
+		targetIP       = PublicIP(2, 1)
+		targetHost     = HostAddr(targetIP)
+	)
+
+	options := gopacket.SerializeOptions{
+		FixLengths:       true,
+		ComputeChecksums: true,
+	}
+
+	ethernet, ip, udp := Underlay(srcIP, srcPort, dstIP, dstPort)
+
+	// Fully correct (hopefully) path.
+	sp := &scion.Decoded{
+		Base: scion.Base{
+			PathMeta: scion.MetaHdr{
+				CurrHF: 0,
+				SegLen: [3]uint8{2, 0, 0},
+			},
+			NumINF:  1,
+			NumHops: 2,
+		},
+		InfoFields: []path.InfoField{
+			{
+				SegID:     0x111,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   true,
+			},
+		},
+		HopFields: []path.HopField{
+			{ConsIngress: 0, ConsEgress: 2}, // <- Processed here
+			{ConsIngress: 1, ConsEgress: 0}, // Going there
+		},
+	}
+
+	// Calculate MACs...
+	// Seg0: Hops are in consdir.
+	sp.HopFields[0].Mac = path.MAC(mac, sp.InfoFields[0], sp.HopFields[0], nil)
+	sp.InfoFields[0].UpdateSegID(sp.HopFields[0].Mac) // tmp
+	sp.HopFields[1].Mac = path.MAC(FakeMAC(2), sp.InfoFields[0], sp.HopFields[0], nil)
+	sp.InfoFields[0].SegID = 0x111 // Restore to initial.
+
+	// End-to-end. Src is the originator and Dst is the final destination.
+	scionL := &slayers.SCION{
+		Version:      0,
+		TrafficClass: 0xb8,
+		FlowID:       flowId,
+		NextHdr:      slayers.L4UDP,
+		PathType:     scion.PathType,
+		SrcIA:        originIA,
+		DstIA:        targetIA,
+		Path:         sp,
+	}
+	if err := scionL.SetSrcAddr(originHost); err != nil {
+		panic(err)
+	}
+	if err := scionL.SetDstAddr(targetHost); err != nil {
+		panic(err)
+	}
+
+	scionudp := &slayers.UDP{}
+	scionudp.SrcPort = 50000
+	scionudp.DstPort = 50000
+	scionudp.SetNetworkLayerForChecksum(scionL)
+
+	payloadBytes := []byte(payload)
+
+	// Prepare input packet
+	input := gopacket.NewSerializeBuffer()
+	if err := gopacket.SerializeLayers(input, options,
+		ethernet, ip, udp, scionL, scionudp, gopacket.Payload(payloadBytes),
+	); err != nil {
+		panic(err)
+	}
+
+	return input.Bytes()
+}
+
+// Out generates numDistinct packets (each with a unique flowID) with the given payload
+// constructed to cause "out" traffic at the br1a router.
+// numDistrinct is a small number, only to enable multiple parallel streams. Each distinct packet
+// is meant to be replayed a large number of times for performance measurement.
+func Out(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte) {
+	packets := make([][]byte, numDistinct)
+	for i := 0; i < numDistinct; i++ {
+		packets[i] = oneOut(payload, mac, uint32(i+1))
+	}
+	return DeviceName(1, 0), DeviceName(1, 2), packets
+}
diff --git a/acceptance/router_newbenchmark/cases/out_transit.go b/acceptance/router_newbenchmark/cases/out_transit.go
new file mode 100644
index 0000000000..5322ce4950
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/out_transit.go
@@ -0,0 +1,145 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"hash"
+	"time"
+
+	"github.com/google/gopacket"
+
+	"github.com/scionproto/scion/pkg/private/util"
+	"github.com/scionproto/scion/pkg/slayers"
+	"github.com/scionproto/scion/pkg/slayers/path"
+	"github.com/scionproto/scion/pkg/slayers/path/scion"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+// See topo.go
+
+// oneOutTransit generates one packet of "out_transit" traffic over the router under test.
+// The outcome is a raw packet that the test must feed to the router.
+func oneOutTransit(payload string, mac hash.Hash, flowId uint32) []byte {
+
+	var (
+		originIA       = ISDAS(4)
+		originIP       = PublicIP(4, 1)
+		originHost     = HostAddr(originIP)
+		srcIP, srcPort = InternalIPPort(1, 2)
+		dstIP, dstPort = InternalIPPort(1, 1)
+		targetIA       = ISDAS(2)
+		targetIP       = PublicIP(2, 1)
+		targetHost     = HostAddr(targetIP)
+	)
+
+	options := gopacket.SerializeOptions{
+		FixLengths:       true,
+		ComputeChecksums: true,
+	}
+
+	ethernet, ip, udp := Underlay(srcIP, srcPort, dstIP, dstPort)
+
+	// Fully correct (hopefully) path.
+	sp := &scion.Decoded{
+		Base: scion.Base{
+			PathMeta: scion.MetaHdr{
+				CurrINF: 1,
+				CurrHF:  2,
+				SegLen:  [3]uint8{2, 2, 0},
+			},
+			NumINF:  2,
+			NumHops: 4,
+		},
+		InfoFields: []path.InfoField{
+			{
+				SegID:     0x111,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   false,
+			},
+			{
+				SegID:     0x222,
+				Timestamp: util.TimeToSecs(time.Now()),
+				ConsDir:   true,
+			},
+		},
+		HopFields: []path.HopField{
+			{ConsIngress: 1, ConsEgress: 0}, // From there (non-consdir)
+			{ConsIngress: 0, ConsEgress: 4}, // Sideways via this
+			{ConsIngress: 0, ConsEgress: 2}, // <- Processed here (non-consdir)
+			{ConsIngress: 1, ConsEgress: 0}, // To there
+		},
+	}
+
+	// Calculate MACs...
+	// Seg0: Hops are in non-consdir.
+	sp.HopFields[1].Mac = path.MAC(mac, sp.InfoFields[0], sp.HopFields[1], nil)
+	sp.InfoFields[0].UpdateSegID(sp.HopFields[1].Mac)
+	sp.HopFields[0].Mac = path.MAC(FakeMAC(4), sp.InfoFields[0], sp.HopFields[0], nil)
+
+	// Seg1: in the natural order.
+	sp.HopFields[2].Mac = path.MAC(mac, sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].UpdateSegID(sp.HopFields[2].Mac) // tmp
+	sp.HopFields[3].Mac = path.MAC(FakeMAC(2), sp.InfoFields[1], sp.HopFields[2], nil)
+	sp.InfoFields[1].SegID = 0x222 // Restore to initial.
+
+	// End-to-end. Src is the originator and Dst is the final destination.
+	scionL := &slayers.SCION{
+		Version:      0,
+		TrafficClass: 0xb8,
+		FlowID:       flowId,
+		NextHdr:      slayers.L4UDP,
+		PathType:     scion.PathType,
+		SrcIA:        originIA,
+		DstIA:        targetIA,
+		Path:         sp,
+	}
+	if err := scionL.SetSrcAddr(originHost); err != nil {
+		panic(err)
+	}
+	if err := scionL.SetDstAddr(targetHost); err != nil {
+		panic(err)
+	}
+
+	scionudp := &slayers.UDP{}
+	scionudp.SrcPort = 50000
+	scionudp.DstPort = 50000
+	scionudp.SetNetworkLayerForChecksum(scionL)
+
+	payloadBytes := []byte(payload)
+
+	// Prepare input packet
+	input := gopacket.NewSerializeBuffer()
+	if err := gopacket.SerializeLayers(input, options,
+		ethernet, ip, udp, scionL, scionudp, gopacket.Payload(payloadBytes),
+	); err != nil {
+		panic(err)
+	}
+	return input.Bytes()
+}
+
+// OutTransit generates numDistinct packets (each with a unique flowID) with the given payload
+// constructed to cause out_transit traffic at the br1a router.
+// numDistrinct is a small number, only to enable multiple parallel streams. Each distinct packet
+// is meant to be replayed a large number of times for performance measurement.
+func OutTransit(payload string, mac hash.Hash, numDistinct int) (string, string, [][]byte) {
+	packets := make([][]byte, numDistinct)
+	for i := 0; i < numDistinct; i++ {
+		packets[i] = oneOutTransit(payload, mac, uint32(i+1))
+	}
+	return DeviceName(1, 0), DeviceName(1, 2), packets
+}
diff --git a/acceptance/router_newbenchmark/cases/topo.go b/acceptance/router_newbenchmark/cases/topo.go
new file mode 100644
index 0000000000..b49bced0bd
--- /dev/null
+++ b/acceptance/router_newbenchmark/cases/topo.go
@@ -0,0 +1,236 @@
+// Copyright 2023 SCION Association
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cases
+
+import (
+	"fmt"
+	"hash"
+	"net"
+	"net/netip"
+	"strings"
+
+	"github.com/google/gopacket/layers"
+
+	"github.com/scionproto/scion/pkg/addr"
+	"github.com/scionproto/scion/pkg/private/xtest"
+	"github.com/scionproto/scion/pkg/scrypto"
+)
+
+// Topology (see accept/router_newbenchmark/conf/topology.json)
+//    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+//                 |
+//    AS3 (br3) ---+
+//
+// We're only executing and monitoring br1a. All the others are a fiction (except for the knowledge
+// about them configured in br1a) from which we construct packets that get injected at one of the
+// br1a interfaces.
+//
+// To reduce maintainers headaches, the topology follows a convention to assign addresses, so that
+// an address can be derived from a minimal information:
+// * AS-1 is the hub of the test. Others are hereafter called children.
+// * All IPs are V4.
+// * Interface numbers are equal to the index of AS to which they connect.
+// * ISD/AS: <1 or 2>-ff00:0:<AS index>
+// * subnets are 192.168.<child AS number> except internal subnets that are 192.168.10*<AS>.<rtr>
+// * hosts are 192.168.s.<interface number>
+// * Mac addressed (when we can choose) derive from the IP
+// * Ports are always 50000 for external interfaces and 30042 for internal interfaces.
+//
+// Example:
+// * AS2 has only interface number 1 with IP 192.168.2.2 and mac address f0:0d:cafe:02:02 that
+//   connects to AS 1 interface number 2.
+// * AS1's interface number 2 has IP 192.168.2.1 and mac address f0:0d:cafe:02:01.
+// * AS1's 1st router interface 0 has IP 192.168.10.1 and mac address f0:0d:cafe:10:01.
+//
+// Functions are provided to generate all addresses following that scheme.
+
+// intfDesc describes an interface requirement
+type intfDesc struct {
+	ip     netip.Addr
+	peerIP netip.Addr
+}
+
+// publicIP returns the IP address that is assigned to external interface designated by the given
+// AS index and the peer AS (that is, the AS that this interface connects to).
+// Per our scheme, the subnet number is the largest of the two AS numbers and the host is always
+// the local AS. This works if there are no cycles. Else there could be subnet number collisions.
+func PublicIP(localAS byte, remoteAS byte) netip.Addr {
+	subnetNr := max(remoteAS, localAS)
+	return netip.AddrFrom4([4]byte{192, 168, subnetNr, localAS})
+}
+
+// publicIP returns the IP address that is assigned to external interface designated by the given
+// AS index and the peer AS, plus the port to go with.
+func PublicIPPort(localAS byte, remoteAS byte) (netip.Addr, layers.UDPPort) {
+	return PublicIP(localAS, remoteAS), layers.UDPPort(50000)
+}
+
+// internalIP returns the IP address that is assigned to the internal interface of the given
+// router in the AS of the given index.
+func InternalIP(AS byte, routerIndex byte) netip.Addr {
+	return netip.AddrFrom4([4]byte{192, 168, AS * 10, routerIndex})
+}
+
+// internalIPPort returns internalIP and the UDPPort to go with.
+func InternalIPPort(AS byte, routerIndex byte) (netip.Addr, layers.UDPPort) {
+	return InternalIP(AS, routerIndex), layers.UDPPort(30042)
+}
+
+// isdAS returns a complete string form ISD/AS number for the given AS index.
+// All are in ISD-1, except AS 4.
+func ISDAS(AS byte) addr.IA {
+	if AS == 4 {
+		return xtest.MustParseIA(fmt.Sprintf("2-ff00:0:%d", AS))
+	}
+	return xtest.MustParseIA(fmt.Sprintf("1-ff00:0:%d", AS))
+}
+
+func FakeMAC(AS byte) hash.Hash {
+	macGen, err := scrypto.HFMacFactory([]byte{AS})
+	if err != nil {
+		panic(err)
+	}
+	return macGen()
+}
+
+func Underlay(
+	srcIP netip.Addr,
+	srcPort layers.UDPPort,
+	dstIP netip.Addr,
+	dstPort layers.UDPPort) (*layers.Ethernet, *layers.IPv4, *layers.UDP) {
+
+	// Point-to-point.
+	ethernet := &layers.Ethernet{
+		SrcMAC:       MACAddr(srcIP),
+		DstMAC:       MACAddr(dstIP),
+		EthernetType: layers.EthernetTypeIPv4,
+	}
+
+	// Point-to-point. This is the real IP: the underlay network.
+	ip := &layers.IPv4{
+		Version:  4,
+		IHL:      5,
+		TTL:      64,
+		SrcIP:    srcIP.AsSlice(),
+		DstIP:    dstIP.AsSlice(),
+		Protocol: layers.IPProtocolUDP,
+		Flags:    layers.IPv4DontFragment,
+	}
+	udp := &layers.UDP{
+		SrcPort: srcPort,
+		DstPort: dstPort,
+	}
+	_ = udp.SetNetworkLayerForChecksum(ip)
+
+	return ethernet, ip, udp
+}
+
+// interfaceLabel returns a string label for the given AS and interface indices.
+// Such names are those used when responding to the show-interfaces command and when translating
+// the --interface option.
+func interfaceLabel(AS int, intf int) string {
+	return fmt.Sprintf("%d_%d", AS, intf)
+}
+
+var (
+	// intfMap lists the required interfaces. That's what we use to respond to showInterfaces
+	intfMap map[string]intfDesc = map[string]intfDesc{
+		interfaceLabel(1, 0): {InternalIP(1, 1), InternalIP(1, 2)},
+		interfaceLabel(1, 2): {PublicIP(1, 2), PublicIP(2, 1)},
+		interfaceLabel(1, 3): {PublicIP(1, 3), PublicIP(3, 1)},
+	}
+
+	// deviceNames holds the real (os-given) names of our required network interfaces. It is
+	// created and populated from the values of the --interface options by InitInterfaces.
+	deviceNames map[string]string
+
+	// macAddresses keeps the mac addresses associated with each IP. It is created and populated
+	// from the values of the --interface options by InitInterfaces. There can be two items for each
+	// interface since we record the neighbor's addresses too. Additional IPs not from intfMap have
+	// no known mac addresses; we are free to make them up to make credible packets.
+	macAddrs map[netip.Addr]net.HardwareAddr
+)
+
+// InitInterfaces collects the names and mac addresses for the interfaces setup by the invoker
+// according to instructions given via listInterfaces().
+// This information is indexed by our own interface labels.
+func InitInterfaces(pairs []string) {
+	deviceNames = make(map[string]string, len(pairs))
+	macAddrs = make(map[netip.Addr]net.HardwareAddr, len(pairs)*2)
+	for _, pair := range pairs {
+		p := strings.Split(pair, "=")
+		label := p[0]
+		info := strings.Split(p[1], ",")
+		addr, err := net.ParseMAC(info[1])
+		if err != nil {
+			panic(err)
+		}
+		peerAddr, err := net.ParseMAC(info[2])
+		if err != nil {
+			panic(err)
+		}
+		deviceNames[label] = info[0]               // host-side name
+		macAddrs[intfMap[label].ip] = addr         // ip->mac
+		macAddrs[intfMap[label].peerIP] = peerAddr // peerIP->peerMAC
+	}
+}
+
+// interfaceName returns the name of the host interface that this test must use in order to exchange
+// traffic with the interface designated by the given AS and interface indices.
+func DeviceName(AS int, intf int) string {
+	return deviceNames[interfaceLabel(AS, intf)]
+}
+
+// macAddr returns the mac address assigned to the interface that has the given IP address.
+// if that address is imposed by our environment it is listed in the macAddrs map and that is what
+// this function returns. Else, the address is made-up according to our scheme.
+func MACAddr(ip netip.Addr) net.HardwareAddr {
+	// Look it up or make it up.
+	mac, ok := macAddrs[ip]
+	if ok {
+		return mac
+	}
+	as4 := ip.As4()
+	return net.HardwareAddr{0xde, 0xad, 0xbe, 0xef, as4[2], as4[3]}
+}
+
+// hostAddr returns a the SCION Hosts addresse that corresponds to the given underlay address.
+// Except for SVC addresses (which we do not support here), this is a restating of the underlay
+// address.
+func HostAddr(ip netip.Addr) addr.Host {
+	return addr.HostIP(ip)
+}
+
+// ListInterfaces outputs a string describing the interfaces of the router under test.
+// The invoker of this test gets this when using the show-interfaces command and is expected
+// to set up the network accordingly before executing the test without that option.
+// We do not choose interface names or mac addresses those will be provided by the invoker
+// via the --interfaces options.
+func ListInterfaces() string {
+	var sb strings.Builder
+	for l, i := range intfMap {
+		sb.WriteString(l)
+		sb.WriteString(",")
+		sb.WriteString("24")
+		sb.WriteString(",")
+		sb.WriteString(i.ip.String())
+		sb.WriteString(",")
+		sb.WriteString(i.peerIP.String())
+		sb.WriteString("\n")
+	}
+	// "our_label,24,<ip on router side>,<ip on far side>\n"
+
+	return sb.String()
+}
diff --git a/acceptance/router_newbenchmark/conf/br.toml b/acceptance/router_newbenchmark/conf/br.toml
new file mode 100644
index 0000000000..d583bb7307
--- /dev/null
+++ b/acceptance/router_newbenchmark/conf/br.toml
@@ -0,0 +1,14 @@
+[general]
+id = "br1a"
+config_dir = "/share/conf"
+
+[metrics]
+prometheus = "192.168.10.1:30442"
+
+[features]
+
+[api]
+addr = "192.168.10.1:31142"
+
+[log.console]
+level = "error"
diff --git a/acceptance/router_newbenchmark/conf/keys/master0.key b/acceptance/router_newbenchmark/conf/keys/master0.key
new file mode 100644
index 0000000000..8bd063d0ac
--- /dev/null
+++ b/acceptance/router_newbenchmark/conf/keys/master0.key
@@ -0,0 +1 @@
+V9SOOHqV4KdAL6utGnvEtA==
\ No newline at end of file
diff --git a/acceptance/router_newbenchmark/conf/keys/master1.key b/acceptance/router_newbenchmark/conf/keys/master1.key
new file mode 100644
index 0000000000..5505c43fa4
--- /dev/null
+++ b/acceptance/router_newbenchmark/conf/keys/master1.key
@@ -0,0 +1 @@
+mdPcnujoYi4JmWALGeKbSQ==
\ No newline at end of file
diff --git a/acceptance/router_newbenchmark/conf/prometheus.yml b/acceptance/router_newbenchmark/conf/prometheus.yml
new file mode 100644
index 0000000000..d35f139f99
--- /dev/null
+++ b/acceptance/router_newbenchmark/conf/prometheus.yml
@@ -0,0 +1,10 @@
+global:
+  evaluation_interval: 1s
+  external_labels:
+    monitor: scion-monitor
+  scrape_interval: 1s
+scrape_configs:
+  - job_name: BR
+    static_configs:
+    - targets:
+      - 192.168.10.1:30442
diff --git a/acceptance/router_newbenchmark/conf/topology.json b/acceptance/router_newbenchmark/conf/topology.json
new file mode 100644
index 0000000000..a6ea582030
--- /dev/null
+++ b/acceptance/router_newbenchmark/conf/topology.json
@@ -0,0 +1,46 @@
+{
+  "attributes": [
+    "core"
+  ],
+  "isd_as": "1-ff00:0:1",
+  "mtu": 1400,
+  "border_routers": {
+    "br1a": {
+      "internal_addr": "192.168.10.1:30042",
+      "interfaces": {
+        "2": {
+          "underlay": {
+            "public": "192.168.2.1:50000",
+            "remote": "192.168.2.2:50000"
+          },
+          "isd_as": "1-ff00:0:2",
+          "link_to": "child",
+          "mtu": 1280
+        },
+        "3": {
+          "underlay": {
+            "public": "192.168.3.1:50000",
+            "remote": "192.168.3.3:50000"
+          },
+          "isd_as": "1-ff00:0:3",
+          "link_to": "child",
+          "mtu": 1280
+        }
+      }
+    },
+    "br1b": {
+      "internal_addr": "192.168.10.2:30042",
+      "interfaces": {
+        "4": {
+          "underlay": {
+            "public": "192.168.4.1:50000",
+            "remote": "192.168.4.4:50000"
+          },
+          "isd_as": "2-ff00:0:4",
+          "link_to": "core",
+          "mtu": 1280
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/router_newbenchmark/test.py b/acceptance/router_newbenchmark/test.py
new file mode 100644
index 0000000000..b9d5b24411
--- /dev/null
+++ b/acceptance/router_newbenchmark/test.py
@@ -0,0 +1,331 @@
+#!/usr/bin/env python3
+
+# Copyright 2023 SCION Association
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import shutil
+import time
+
+from collections import namedtuple
+from plumbum import cli
+from plumbum.cmd import docker, whoami
+from plumbum import cmd
+
+from acceptance.common import base
+
+import logging
+import json
+from http.client import HTTPConnection
+from urllib.parse import urlencode
+
+logger = logging.getLogger(__name__)
+
+# Those values are valid expectations only when running in the CI environment.
+TEST_CASES = {
+    'in': 270000,
+    'out': 240000,
+    'in_transit': 270000,
+    'out_transit': 240000,
+    'br_transit': 260000,
+}
+
+
+def sudo(*args: [str]) -> str:
+    # -A, --askpass makes sure command is failing and does not wait for
+    # interactive password input.
+    return cmd.sudo("-A", *args)
+
+
+# Convenience types to carry interface params.
+IntfReq = namedtuple("IntfReq", "label, prefixLen, ip, peerIp")
+Intf = namedtuple("Intf", "name, mac, peerMac")
+
+
+# Make-up an eth mac address as unique as the given IP.
+# Assumes ips in a /16 or smaller block (i.e. The last two bytes are unique within the test).
+def mac_for_ip(ip: str) -> str:
+    ipBytes = ip.split(".")
+    return 'f0:0d:ca:fe:{:02x}:{:02x}'.format(int(ipBytes[2]), int(ipBytes[3]))
+
+
+class RouterBMTest(base.TestBase):
+    """
+    Tests that the implementation of a router has sufficient performance in terms of packets
+    per available machine*second (i.e. one accumulated second of all configured CPUs available
+    to execute the router code).
+
+    This test runs and execute a single router. The outgoing packets are not observed, the incoming
+    packets are fed directly by the test driver. The other routers in the topology are a fiction,
+    they exist only in the routers configuration.
+
+    The topology (./conf/topology.json) is the following:
+
+    AS2 (br2) ---+== (br1a) AS1 (br1b) ---- (br4) AS4
+                 |
+    AS3 (br3) ---+
+
+    Only br1 is executed and observed.
+
+    Pretend traffic is injected by brload's. See the test cases for details.
+    """
+
+    ci = cli.Flag(
+        "ci",
+        help="Do extra checks for CI",
+        envname="CI"
+    )
+
+    def create_interface(self, req: IntfReq, ns: str):
+        """
+        Creates a pair of virtual interfaces, with one end in the given network namespace and the
+        other in the host stack.
+
+        The outcome is the pair of interfaces and a record in intfMap, which associates the given
+        label with the network interface's host-side name and two mac addresses; one for each end
+        of the pair. The mac addresses, if they can be chosen, are not chosen by the invoker, but
+        by this function.
+
+        We could add:
+          sudo("ip", "addr", "add", f"{req.peerIp}/{req.prefixLen}", "dev", hostIntf)
+          sudo("ip", "link", "set", hostIntf, "address", peerMac)
+        But it not necessary. The ARP seeding on the other end is enough. By not setting these
+        addresses on the host side we make it look a little weird for anyone who would look at it
+        but we avoid the risk of colliding with actual addresses of the host.
+
+        Args:
+          IntfReq: A requested router-side network interface. It comprises:
+                   * A label by which brload indetifies that interface.
+                   * The IP address to be assigned to that interface.
+                   * The IP address of one neighbor.
+          ns: The network namespace where that interface must exist.
+
+        """
+
+        hostIntf = f"veth_{req.label}_host"
+        brIntf = f"veth_{req.label}"
+        peerMac = mac_for_ip(req.peerIp)
+        mac = mac_for_ip(req.ip)
+
+        # The interfaces
+        sudo("ip", "link", "add", hostIntf, "type", "veth", "peer", "name", brIntf)
+        sudo("ip", "link", "set", hostIntf, "mtu", "8000")
+        sudo("ip", "link", "set", brIntf, "mtu", "8000")
+        sudo("sysctl", "-qw", f"net.ipv6.conf.{hostIntf}.disable_ipv6=1")
+        sudo("ethtool", "-K", brIntf, "rx", "off", "tx", "off")
+        sudo("ip", "link", "set", brIntf, "address", mac)
+
+        # The network namespace
+        sudo("ip", "link", "set", brIntf, "netns", ns)
+
+        # The addresses (presumably must be done once the br interface is in the namespace).
+        sudo("ip", "netns", "exec", ns,
+             "ip", "addr", "add", f"{req.ip}/{req.prefixLen}", "dev", brIntf)
+        sudo("ip", "netns", "exec", ns,
+             "ip", "neigh", "add", req.peerIp, "lladdr", peerMac, "nud", "permanent",
+             "dev", brIntf)
+        sudo("ip", "netns", "exec", ns,
+             "sysctl", "-qw", f"net.ipv6.conf.{brIntf}.disable_ipv6=1")
+
+        # Fit for duty.
+        sudo("ip", "link", "set", hostIntf, "up")
+        sudo("ip", "netns", "exec", ns,
+             "ip", "link", "set", brIntf, "up")
+
+        self.intfMap[req.label] = Intf(hostIntf, mac, peerMac)
+
+    def setup_prepare(self):
+        super().setup_prepare()
+
+        # get the config where the router can find it.
+        shutil.copytree("acceptance/router_newbenchmark/conf/", self.artifacts / "conf")
+
+        # We need a custom network so can create veth interfaces of our own chosing.
+        docker("network", "create",  "-d", "bridge", "benchmark")
+
+        # This test is useless without prometheus. Also, we need a running container to have
+        # a usable network namespace that we can configure before the router runs. So, start
+        # prometheus now and then have the router share the same network stack.
+
+        # FWIW, the alternative would be to start the router's container without the router,
+        # configure the interfaces, and then start the router. We'd still need prometheus, though,
+        # and we'd need to expose the router's metrics port to prometheus in some way. So, this is
+        # simpler.
+        docker("run",
+               "-v", f"{self.artifacts}/conf:/share/conf",
+               "-d",
+               "--network", "benchmark",
+               "--publish", "9999:9090",
+               "--name", "prometheus",
+               "prom/prometheus:v2.47.2",
+               "--config.file", "/share/conf/prometheus.yml")
+
+        # Link that namespace to where the ip commands expect it. While at it give it a simple name.
+        sudo("mkdir", "-p", "/var/run/netns")
+        ns = docker("inspect",
+                    "prometheus",
+                    "-f", "{{.NetworkSettings.SandboxKey}}").strip()
+        sudo("ln", "-sfT", ns, "/var/run/netns/benchmark")
+
+        # Set the default TTL for outgoing packets to the common
+        # value 64, so that packets sent from router will match the expected value.
+        sudo("ip", "netns", "exec", "benchmark", "sysctl", "-w", "net.ipv4.ip_default_ttl=64")
+
+        # Run test brload test with --show-interfaces and set up the veth that it needs.
+        # The router uses one end and the test uses the other end to feed it with (and possibly
+        # capture) traffic.
+        # We supply the label->(host-side-name,mac,peermac) mapping to brload when we start it.
+        self.intfMap = {}
+        brload = self.get_executable("brload")
+        output = brload("show-interfaces")
+
+        for line in output.splitlines():
+            elems = line.split(",")
+            if len(elems) != 4:
+                continue
+            t = IntfReq._make(elems)
+            self.create_interface(t, "benchmark")
+
+        # We don't need that symlink any more
+        sudo("rm", "/var/run/netns/benchmark")
+
+        # Now the router can start.
+        docker("run",
+               "-v", f"{self.artifacts}/conf:/share/conf",
+               "-d",
+               "-e", "SCION_EXPERIMENTAL_BFD_DISABLE=true",
+               "-e", "GOMAXPROCS=4",
+               "--network", "container:prometheus",
+               "--name", "router",
+               "posix-router:latest")
+
+        time.sleep(2)
+
+    def teardown(self):
+        docker["logs", "router"].run_fg(retcode=None)
+        docker("rm", "-f", "prometheus")
+        docker("rm", "-f", "router")
+        docker("network", "rm", "benchmark")  # veths are deleted automatically
+        sudo("chown", "-R", whoami().strip(), self.artifacts)
+
+    def execBrLoad(self, case: str, mapArgs: list[str], count: int) -> str:
+        brload = self.get_executable("brload")
+        return sudo(brload.executable,
+                    "run",
+                    "--artifacts", self.artifacts,
+                    *mapArgs,
+                    "--case", case,
+                    "--num-packets", str(count),
+                    "--num-streams", "2")
+
+    def runTestCase(self, case: str, mapArgs: list[str]):
+        logger.info(f"==> Starting load {case}")
+
+        output = self.execBrLoad(case, mapArgs, 10000000)
+        for line in output.splitlines():
+            print(line)
+            if line.startswith('metricsBegin'):
+                _, beg, _, end = line.split()
+
+        logger.info(f"==> Collecting {case} performance metrics...")
+
+        # The raw metrics are expressed in terms of core*seconds. We convert to machine*seconds
+        # which allows us to provide a projected packet/s; ...more intuitive than packets/core*s.
+        # We're interested only in br_transit traffic. We measure the rate over 10s. For best
+        # results we sample the end of the middle 10s of the run. "beg" is the start time of the
+        # real action and "end" is the end time.
+        sampleTime = (int(beg) + int(end) + 10) / 2
+        promQuery = urlencode({
+            'time': f'{sampleTime}',
+            'query': (
+                'sum by (instance, job) ('
+                f'  rate(router_output_pkts_total{{job="BR", type="{case}"}}[10s])'
+                ')'
+                '/ on (instance, job) group_left()'
+                'sum by (instance, job) ('
+                '  1 - (rate(process_runnable_seconds_total[10s])'
+                '       / go_sched_maxprocs_threads)'
+                ')'
+            )
+        })
+        conn = HTTPConnection("localhost:9999")
+        conn.request('GET', f'/api/v1/query?{promQuery}')
+        resp = conn.getresponse()
+        if resp.status != 200:
+            raise RuntimeError(f'Unexpected response: {resp.status} {resp.reason}')
+
+        # There's only one router, so whichever metric we get is the right one.
+        pld = json.loads(resp.read().decode('utf-8'))
+        results = pld['data']['result']
+        for result in results:
+            ts, val = result['value']
+            return int(float(val))
+        return 0
+
+    # Fetch and log the number of cores used by Go. This may inform performance
+    # modeling later.
+    def logCoreCounts(self):
+        logger.info('==> Collecting number of cores...')
+        promQuery = urlencode({
+            'query': 'go_sched_maxprocs_threads{job="BR"}'
+        })
+
+        conn = HTTPConnection("localhost:9999")
+        conn.request('GET', f'/api/v1/query?{promQuery}')
+        resp = conn.getresponse()
+        if resp.status != 200:
+            raise RuntimeError(f'Unexpected response: {resp.status} {resp.reason}')
+
+        pld = json.loads(resp.read().decode('utf-8'))
+        results = pld['data']['result']
+        for result in results:
+            instance = result['metric']['instance']
+            _, val = result['value']
+            logger.info(f'Router Cores for {instance}: {int(val)}')
+
+    def _run(self):
+        # Build the interface mapping arg
+        mapArgs = []
+        for label, intf in self.intfMap.items():
+            mapArgs.extend(["--interface", f"{label}={intf.name},{intf.mac},{intf.peerMac}"])
+
+        # Run one (10% size) test as warm-up to trigger the frequency scaling, else the first test
+        # gets much lower performance.
+        self.execBrLoad(list(TEST_CASES)[0], mapArgs, 1000000)
+
+        # At long last, run the tests
+        rateMap = {}
+        for testCase in TEST_CASES:
+            rateMap[testCase] = self.runTestCase(testCase, mapArgs)
+
+        self.logCoreCounts()
+
+        # Log and check the performance...
+        # If this is used as a CI test. Make sure that the performance is within the expected
+        # ballpark.
+        rateTooLow = []
+        for tt, exp in TEST_CASES.items():
+            if self.ci and exp != 0:
+                logger.info(f'Packets/(machine*s) for {tt}: {rateMap[tt]} expected: {exp}')
+                if rateMap[tt] < 0.8 * exp:
+                    rateTooLow.append(tt)
+            else:
+                logger.info(f'Packets/(machine*s) for {tt}: {rateMap[tt]}')
+
+        if len(rateTooLow) != 0:
+            raise RuntimeError(f'Insufficient performance for: {rateTooLow}')
+
+
+if __name__ == "__main__":
+    base.main(RouterBMTest)
diff --git a/go.mod b/go.mod
index 77f168f212..2b148740e9 100644
--- a/go.mod
+++ b/go.mod
@@ -130,4 +130,4 @@ require (
 	modernc.org/token v1.0.1 // indirect
 )
 
-go 1.18
+go 1.21
diff --git a/go.sum b/go.sum
index c53bec95f1..3ce7f0a0b2 100644
--- a/go.sum
+++ b/go.sum
@@ -77,6 +77,7 @@ github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnht
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/containerd/stargz-snapshotter/estargz v0.12.1 h1:+7nYmHJb0tEkcRaAW+MHqoKaJYZmkikupxCqVtmPuY0=
+github.com/containerd/stargz-snapshotter/estargz v0.12.1/go.mod h1:12VUuCq3qPq4y8yUW+l5w3+oXV3cx2Po3KSe/SmPGqw=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -92,9 +93,13 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeC
 github.com/deepmap/oapi-codegen/v2 v2.0.0 h1:3TS7w3r+XnjKFXcbFbc16pTWzfTy0OLPkCsutEHjWDA=
 github.com/deepmap/oapi-codegen/v2 v2.0.0/go.mod h1:7zR+ZL3WzLeCkr2k8oWTxEa0v8y/F25ane0l6A5UjLA=
 github.com/docker/cli v20.10.20+incompatible h1:lWQbHSHUFs7KraSN2jOJK7zbMS2jNCHI4mt4xUFUVQ4=
+github.com/docker/cli v20.10.20+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
+github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.20+incompatible h1:kH9tx6XO+359d+iAkumyKDc5Q1kOwPuAUaeri48nD6E=
+github.com/docker/docker v20.10.20+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
+github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -106,6 +111,7 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
 github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
+github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/getkin/kin-openapi v0.118.0 h1:z43njxPmJ7TaPpMSCQb7PN0dEYno4tyBPQcrFdHoLuM=
@@ -126,6 +132,7 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
@@ -258,12 +265,14 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
+github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -299,6 +308,7 @@ github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -318,8 +328,11 @@ github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6
 github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
 github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
 github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
+github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
+github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
@@ -373,6 +386,7 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
@@ -381,6 +395,7 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
 github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
 github.com/smartystreets/goconvey v1.7.2 h1:9RBaZCeXEQ3UselpuwUQHltGVXvdwm6cv1hgR6gDIPg=
@@ -426,7 +441,9 @@ github.com/ugorji/go v1.2.7 h1:qYhyWUUd6WbiM+C6JZAUkIJt/1WrjzNHY9+KCIjVqTo=
 github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
 github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
+github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/vbatts/tar-split v0.11.2 h1:Via6XqJr0hceW4wff3QRzD5gAk/tatMw/4ZA7cTlIME=
+github.com/vbatts/tar-split v0.11.2/go.mod h1:vV3ZuO2yWSVsz+pfFzDG/upWH1JhjOiEaWq6kXyQ3VI=
 github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
 github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae h1:4hwBBUfQCFe3Cym0ZtKyq7L16eZUtYKs+BaHDN6mAns=
@@ -495,6 +512,7 @@ golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPI
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -803,6 +821,7 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -833,7 +852,9 @@ modernc.org/cc/v3 v3.40.0/go.mod h1:/bTg4dnWkSXowUO6ssQKnOV0yMVxDYNIsIrzqTFDGH0=
 modernc.org/ccgo/v3 v3.16.13 h1:Mkgdzl46i5F/CNR/Kj80Ri59hC8TKAhZrYSaqvkwzUw=
 modernc.org/ccgo/v3 v3.16.13/go.mod h1:2Quk+5YgpImhPjv2Qsob1DnZ/4som1lJTodubIcoUkY=
 modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
+modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
+modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
 modernc.org/libc v1.22.5 h1:91BNch/e5B0uPbJFgqbxXuOnxBQjlS//icfQEGmvyjE=
 modernc.org/libc v1.22.5/go.mod h1:jj+Z7dTNX8fBScMVNRAYZ/jF91K8fdT2hYMThc3YjBY=
 modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=
@@ -847,9 +868,11 @@ modernc.org/sqlite v1.24.0/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk
 modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
+modernc.org/tcl v1.15.2/go.mod h1:3+k/ZaEbKrC8ePv8zJWPtBSW0V7Gg9g8rkmhI1Kfs3c=
 modernc.org/token v1.0.1 h1:A3qvTqOwexpfZZeyI0FeGPDlSWX5pjZu9hF4lU+EKWg=
 modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
+modernc.org/z v1.7.3/go.mod h1:Ipv4tsdxZRbQyLq9Q1M6gdbkxYzdlrciF2Hi/lS7nWE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/router/connector.go b/router/connector.go
index 7b744b2c41..cd7e5c04e2 100644
--- a/router/connector.go
+++ b/router/connector.go
@@ -85,7 +85,7 @@ func (c *Connector) AddExternalInterface(localIfID common.IFIDType, link control
 	intf := uint16(localIfID)
 	log.Debug("Adding external interface", "interface", localIfID,
 		"local_isd_as", link.Local.IA, "local_addr", link.Local.Addr,
-		"remote_isd_as", link.Remote.IA, "remote_addr", link.Remote.IA,
+		"remote_isd_as", link.Remote.IA, "remote_addr", link.Remote.Addr,
 		"owned", owned, "bfd", !link.BFD.Disable)
 
 	if !c.ia.Equal(link.Local.IA) {