Wireguard isn't doing to bad considering its not hardware accelerated like AES-GCM.

Also looks like AF_PACKET and AF_XDP are basically an alternative to DPDK with similar functionality but built into the kernel using kernel drivers, new to me.