Endpoint SD-WAN
Endpoint SD-WAN
Icegate puts the intelligence on the device. It measures the wireless first hop, decides how each request should travel, and keeps the session alive when the radio degrades. It runs on the connection you already have.
One session before, one session after. Not a benchmark suite. Bar length is measured frozen seconds and segment count is the measured number of freezes; individual freeze lengths are drawn evenly and are illustrative. Captured with chrome://webrtc-internals. Logs on request.
Yours, and fine
No owner, no metrics
Carrier maintains
ISP maintains
The app you want
Carrier capital expenditure stops at the tower. IT stops at the office. The radio hop between the device and whatever it associates with has no owner, no telemetry and no service level. The middle mile was solved years ago and you can rent it by API. The first hop was left where it was.
In an instrumented sample, up to every problem moment traced to the home Wi-Fi rather than the ISP. Full speed arrives at the door. The radio hop inside the home cannot carry it.
What one upload does to everything else on the same device. Outgoing data queues in the device's own buffers and every other packet waits behind it. Throughput drops by two thirds.
Of packets in a struggling session get sent twice. A healthy link retransmits under 1 percent. Averages hide this. The bad session is where the damage lives.
Captured with Cloudflare Speed Test and chrome://webrtc-internals. These four are baselines, not results. Session logs on request.
A speed test runs on an idle line and shows nothing wrong. The failure only appears under real use, which is why the FCC added latency under load as a separate metric.
The client reads every available channel for latency, jitter and loss, then decides per request where the traffic should go. Nothing sits in the office. Nothing gets shipped to a site.
Banking, government, and anything that should keep its local identity goes straight out. It never enters our path.
On networks that shape or interfere with traffic, the transport is wrapped so the session survives instead of stalling.
Packets that cannot afford a loss are sent more than once and de-duplicated on the far side. Everything else is left alone.
Work that breaks when the exit address moves keeps one identity for the length of the session.
Standard congestion control was backing off on ordinary radio noise. Changing the control loop on our ingress recovered 2.6 times the throughput without adding delay: loaded latency held at roughly 60 ms and jitter fell from 15.6 ms to 6.26 ms. One paired measurement on one link, not a benchmark.
The expensive part of the network stays commodity. The intelligence sits at the two ends we own, which is why there is no hardware to buy and no capital expenditure to approve.
The pipe that carries the traffic exists and has paying users on it. What does not exist yet is the part that decides, per request, how the traffic should move. That is the whole of this build, published here so you can hold us to it.
The hard part is already written. Icegate ships a client today that keeps people connected on networks built to block them, which is where the transport was proven and why the engine exists at all. The endpoint SD-WAN client is that engine pointed at a different problem.
The office LAN was the managed network. Now it is a cafe, a kitchen table, or a hotel.
The connection moves with the person and nothing about it was provisioned.
You need the delivery path to hold up and you are not going to build a data plane to get it.
We are onboarding a small number of teams alongside the next build. A person reads every request and answers it.
Email usOr write to avi@icegatevpn.com directly.
We carry ciphertext. Your traffic is already encrypted before it reaches us. We do not terminate TLS, we do not inspect it, and there is no inspection certificate anywhere in the path.