GSP stands up a complete parallel internet on your own hardware — real ISPs running real BGP, contested SATCOM and Starshield-class link effects, and your real devices living on its emulated public address space. Fully airgapped. Inside your wire, in minutes.
Forward-deployed systems live on denied, disrupted, intermittent, and limited networks — geostationary lag, Starlink handover hiccups, rain fade, congestion, and outright loss. Lab networks are flawless: sub-millisecond, zero loss, infinite patience.
Systems validated on a perfect network fail in theater, and the failure report arrives from the field. GSP makes the lab lie stop — it rebuilds the messy real internet, satellites included, on hardware you already own, with no connection to the outside world.
Every ping through GSP crosses real routers, real BGP paths, and real impairment. When it holds up here, you have numbers — and you can prove it again.
$ gspcli connect afloat-02 ✓ identity 175.148.93.101 (customer afloat-02, isp pacific) ✓ tunnel up (userspace WireGuard, endpoint 10.20.1.197:31840) ✓ routes added: 11.207.0.0/16, 175.148.0.0/16 (default untouched) $ ping 89.69.91.10 # across the emulated Pacific, geo-satcom link 64 bytes from 89.69.91.10: icmp_seq=1 ttl=58 time=561 ms 64 bytes from 89.69.91.10: icmp_seq=2 ttl=58 time=574 ms Request timeout for icmp_seq 3 ← that's the point 64 bytes from 89.69.91.10: icmp_seq=4 ttl=58 time=559 ms
Nothing in GSP is mocked. The routers are real routers, the routing is real routing, and your devices get public identities inside its emulated address space — behaving exactly as they would on the real internet.
Namespaced VyOS routers form full ISP networks — multi-area OSPF inside each ISP, iBGP route reflection, eBGP peering between them, provider/customer transit. TTLs decrement hop by hop; traceroute reads exactly like the real internet, because structurally it is.
GEO/MEO SATCOM lag, Starshield-class LEO with ~15 s handover spikes, rain fade that rolls in and recovers, congestion, bit errors, loss bursts — applied live, per direction, per link.
Laptops, radios, servers, entire enclaves join over the LAN, isolated VLANs, or a single gspcli connect — each with a public identity in the emulated address space, behind a true public/private boundary: shared PAT like home broadband, 1:1 NAT like cloud elastic IPs, or a delegated prefix like a carrier handoff.
Build one verified package on a connected host, carry it across the wire, deploy. Nodes never touch the internet — no pulls, no phone-home, sha256-checked end to end.
One config.yaml declares the whole battlespace. Every deploy is idempotent: re-runs converge, drift is repaired, and unchanged state is untouched. plan shows the diff before you commit.
A live 3D globe of your deployed topology — routers on the Earth, animated links, satellites at arc apex, per-device SSH and health. Everything it shows is driven by a REST API you can script.
We surveyed the market — commercial emulators and open-source stacks — before building. The gaps we found are exactly what GSP delivers.
GSP's WAN emulator inserts as a transparent Layer-2 device between two routers. Same subnet, same MACs, same direct adjacency — BGP and OSPF stay up while the link degrades. Commercial tools force the network to be rebuilt around them, which changes the very thing under test.
Not "add 300 ms and hope." A LEO link hiccups every ~15 seconds at satellite handover. A rain-fade cycle attenuates bandwidth, raises bit errors, then recovers on a 90-second storm curve. Time-varying, deterministic, reproducible with a seed.
The same config renders a byte-identical internet on every deploy, and stochastic impairments take a seed. The test that failed at 2 a.m. re-runs at 9 under the exact same conditions — so you regression-test the fix instead of arguing about ghosts.
A single Go binary and a set of containers, built on battle-tested Linux kernel networking. No phone-home, no cloud dependency, no hypervisor tricks — any x86-64 Linux that runs Kubernetes runs GSP, entirely inside your enclave.
Shake out C2, data sync, and comms plans against the exact link conditions of the objective area — before wheels up.
Prove mission systems ride out LEO handovers, GEO lag, and weather fade — with numbers, repeatably.
A realistic gray-space internet — real BGP, real DNS, real public addressing — under your training environment.
1 — Build the package. On any connected machine, gspcli package build fetches and verifies everything: Kubernetes, CNI, router images, emulators, the UI. One tarball, one manifest of hashes.
2 — Cross the wire. Move the package by whatever your transfer policy allows. Every artifact is sha256-verified on the far side; a tampered file refuses to deploy.
3 — Deploy the internet. gspcli deploy provisions the cluster over SSH and brings up ISPs, customers, WAN emulation, and the UI as independently reconcilable layers.
$ gspcli deploy layer k8s cluster nodes Ready 3/3 layer internet ISPs up 4/4 · OSPF full · eBGP established layer customers gateways reconciled 2/2 · CPEs up 6/6 layer wanemu emulators inserted 3/3 (geo-satcom, leo-starlink…) layer ui serving at http://any-node:30909 ✓ parallel internet operational $ gspcli deploy # run it again — nothing to do. that's the design. ✓ up to date
A live demonstration takes under an hour: we stand up a parallel internet, degrade it like theater, and put your device on it.