Without knowing how hardware forwarding engines work at any kind of detail, I would be wary of throwing more cores at this kind of problem, because you would ne

Without knowing how hardware forwarding engines work at any kind of detail, I would be wary of throwing more cores at this kind of problem, because you would need to decide how to divide up your work between cores. You could use a 5 or 3-tuple flow hash, but then you're limiting the speed of a single connection to what a single core can do. And if you use any other way to divide up work, you're bound to get out-of-order packets which kills TCP performance.