<svg viewBox="0 0 960 540" xmlns="http://www.w3.org/2000/svg">
<defs>
<style>
.bg { fill: #0f172a; }
.card { fill: #1e293b; rx: 12; ry: 12; stroke: #334155; stroke-width: 1.5; }
.card-sub { fill: #0f172a; rx: 8; ry: 8; stroke: #334155; stroke-width: 1; }
.text-title { fill: #f8fafc; font-family: system-ui, sans-serif; font-weight: 700; font-size: 22px; }
.text-subtitle { fill: #94a3b8; font-family: system-ui, sans-serif; font-size: 14px; }
.text-header { fill: #38bdf8; font-family: system-ui, sans-serif; font-weight: 600; font-size: 16px; }
.text-body { fill: #e2e8f0; font-family: system-ui, sans-serif; font-size: 13px; }
.text-muted { fill: #64748b; font-family: system-ui, sans-serif; font-size: 12px; }
.badge-sw { fill: #f59e0b; font-size: 12px; font-weight: bold; }
.badge-hw { fill: #10b981; font-size: 12px; font-weight: bold; }
.warn-text { fill: #fbbf24; font-weight: bold; }
.divider { stroke: #334155; stroke-dasharray: 6,6; }
</style>
<linearGradient y2="100%" x2="100%" y1="0%" x1="0%" id="sw-grad">
<stop stop-opacity="0.1" stop-color="#3b82f6" offset="0%"></stop>
<stop stop-opacity="0.1" stop-color="#f59e0b" offset="100%"></stop>
</linearGradient>
<linearGradient y2="100%" x2="100%" y1="0%" x1="0%" id="hw-grad">
<stop stop-opacity="0.1" stop-color="#3b82f6" offset="0%"></stop>
<stop stop-opacity="0.1" stop-color="#10b981" offset="100%"></stop>
</linearGradient>
</defs>
<rect class="bg" height="540" width="960"></rect>
<text class="text-title" y="45" x="40">图 2.4：软件 NAT (CPU处理) vs 硬件 NAT (PPE/HNAT) 数据转发路径对比</text>
<text class="text-subtitle" y="70" x="40">展示首包建立连接与后续数据包在 Linux Kernel 路径与 PPE 硬件加速路径的区别</text>
<line stroke-width="2" class="divider" y2="495" x2="480" y1="95" x1="480"></line>
<rect fill="url(#sw-grad)" class="card" height="400" width="425" y="95" x="40"></rect>
<text fill="#f59e0b" class="text-header" y="125" x="60">❌ 传统软件 NAT (Slow Path / CPU转发)</text>
<rect class="card-sub" height="45" width="385" y="145" x="60"></rect>
<text class="text-body" y="172" x="75">1. 网卡驱动 (NIC RX Interrupt) → 触发 CPU 中断</text>
<rect class="card-sub" height="45" width="385" y="200" x="60"></rect>
<text class="text-body" y="227" x="75">2. Netfilter 框架 (PREROUTING → FORWARD → conntrack 跟踪)</text>
<rect stroke="#ef4444" class="card-sub" height="45" width="385" y="255" x="60"></rect>
<text fill="#fca5a5" class="text-body" y="282" x="75">3. CPU 修改 IP/Port (iptables / nftables SNAT/DNAT)</text>
<rect class="card-sub" height="45" width="385" y="310" x="60"></rect>
<text class="text-body" y="337" x="75">4. 路由表查找 (Routing Decision) + POSTROUTING</text>
<rect class="card-sub" height="45" width="385" y="365" x="60"></rect>
<text class="text-body" y="392" x="75">5. 网卡发送 (NIC TX) → 消耗大量 CPU 资源与延迟</text>
<rect stroke-width="1" stroke="#f59e0b" rx="6" fill="#2d1b0e" height="55" width="385" y="425" x="60"></rect>
<text class="badge-sw" y="447" x="75">特点：每一个数据包都要经过 CPU 与 Netfilter 栈</text>
<text class="text-muted" y="467" x="75">吞吐量受限 CPU 算力（千兆/万兆易挤爆），小包延迟偏高，容易丢包</text>
<rect fill="url(#hw-grad)" class="card" height="400" width="425" y="95" x="495"></rect>
<text fill="#10b981" class="text-header" y="125" x="515">⚡ 硬件加速 NAT (Fast Path / PPE/HNAT)</text>
<rect stroke="#38bdf8" class="card-sub" height="55" width="395" y="145" x="515"></rect>
<text fill="#38bdf8" class="text-body" y="168" x="530">【首包 Fast Path 建立】</text>
<text class="text-muted" y="188" x="530">CPU 正常处理第 1 个包，并在 HNAT/PPE 硬件表中写入 Offload 流表</text>
<rect fill-opacity="0.2" fill="#064e3b" stroke="#10b981" class="card-sub" height="200" width="395" y="210" x="515"></rect>
<text fill="#6ee7b7" class="text-body" y="235" x="530">【后续所有数据包 (Direct Path)】</text>
<path stroke-width="1" stroke="#047857" d="M 530 250 L 890 250"></path>
<text class="text-body" y="275" x="540">① 网卡接收物理信号 (WAN/LAN PHY)</text>
<text fill="#a7f3d0" class="text-body" y="310" x="540">② PPE/HNAT 硬件引擎直接匹配流表并修改 IP/Port</text>
<text class="text-body" y="345" x="540">③ 硬件直接转发至目标网卡 (LAN/WAN PHY)</text>
<text fill="#34d399" class="text-muted" y="385" x="540">💡 后续数据包完全绕过 Linux Kernel、CPU 及 Netfilter！</text>
<rect stroke-width="1" stroke="#10b981" rx="6" fill="#022c22" height="55" width="395" y="425" x="515"></rect>
<text class="badge-hw" y="447" x="530">特点：线速转发，CPU 占用率接近 0%</text>
<text class="text-muted" y="467" x="530">大幅降低 P2P 游戏包转发延迟</text>
<text class="text-muted warn-text" y="483" x="530">⚠️ 但部分平台HNAT可能导致Full Cone规则失效（以 NatTypeTester 实测为准）</text>
</svg>
