The attacker in the gap.

What am I looking at?

The topology (top to bottom). Hosts sit at the bottom. Each host connects up to one edge switch (top-of-rack). Edge switches connect up to the aggregation switches in their pod, which connect up to the core spine that links pods together. At the very top, the core uplinks to a small WAN gateway tier — the border routers that carry internet-bound (north-south) traffic out of the datacenter. There are multiple parallel links at every tier — that redundancy is exactly what ECMP is meant to load-balance across.

The packets. Each moving dot is a flow being forwarded. It climbs host → edge → agg → (for cross-pod traffic) core, then descends the mirror path down to the destination host. The route each packet takes is notrandom per-packet — it is the deterministic ECMP hash of that flow's 5-tuple, keyed by each switch's salt. Same flow, same path every time (flow affinity).

The attacker. When launched, the red-ringed host (ATTACKER) floods the VICTIM with crafted flows — all share one destination, only the source port varies. It sweeps source ports offline to find a collision set: ports whose ECMP hash steers the flow onto the same deep core→aggregation link (the dashed target link), chosen deep in the fabric precisely because that is the tier ECMP is meant to spread load across (9 equal-cost paths into the victim's pod here). Under a predictable salt every crafted flow converges there — a red funnel collapses onto the victim while the rest of the fabric stays calm. Under CSPRNG/QRNG the attacker's guessed salt is wrong, the same ports hash to random paths, and the flood sprays across all 9 links — each carrying a negligible slice. A single host targeting one link, no botnet.

The link colours. A link's tint shows its cumulative share of traffic: green = lightly used, amber = busy, red = saturated. Links also thicken with live packet occupancy. Under the weak shared salt you will see a handful of links go red while others stay dim — that is hash polarization: correlated hash choices across stacked switches funnel unrelated flows onto the same physical links. Under CSPRNG/QRNG the whole fabric stays evenly warm.

The fairness numbers. Jain's index is 1.0 when every link carries an equal share and drops toward 0 as load concentrates. Polarizationis the busiest link's load divided by the mean — 1.0 is perfect, higher means worse hot spots. Both are computed live from the real delivered-packet counts, not scripted. Note: because the traffic itself is skewed (popular servers), even CSPRNG won't hit a perfect 1.0 — what matters is the gap: the weak PRNG is clearly worse, adding hash polarization on top of the natural skew.

Where QEaaS comes in. Weak entropy is the root cause of both failures above — the polarized fabric and the landed attack. Fixing it means every switch needs an independent, strong, fresh salt, and in a regulated or multi-tenant setting you also need to prove it was. QEaaS serves exactly that: per-switch quantum entropy over a simple API, each draw stamped with a signed provenance receipt (entropy epoch, request id, attestable source) you can hand an auditor. Select QRNG above to see the receipt live — strong balancing, scattered attack, and a paper trail for the randomness underneath it.

Footnotes (honest scope). (1) Single-switch caveat: entropy quality is invisible at one hop — SHA-256 spreads uniformly for any salt; polarization is a multi-stage effect that only appears when switches on a path share a salt. (2) In this threat model a good CSPRNG spreads traffic and blunts the attack just as well as QRNG; QRNG's distinguishing contribution here is attestable provenance and deliver-as-a-service deployability, not a better hash.