benchmark tool for netfilter - any recommendations ?

Hi,

I am looking for a traffic generator type aplication that can generate a realistic workload to test a netfilter firewall.

There are some cool tools out there for throughput measurements, like netpipe, etc. but they are not ideal to test connection tracking performance. The way I see it, you either have tools that:

- flood the network with traffic over just one TCP connection or UDP stream. Not a lot of use in testing connection tracking performance as it's just one ESTABLISHED connection.

or

- flood the network with more or less random crap as far as IP addresses/ports is concerned. Not a very realistic workload either.

IMHO a realistic workload for testing connection tracking performance is a workload that has a limited number of IP addresses on one side of the firewall (a DMZ with 64 hosts, or a LAN with 100-500 hosts) and a wide range of IP addresses at the other side (the Internet). The tool should be able to mimic normal network behavior like short connections (http) vs. longer lived connection (ftp download), etc.

It would be nice to have a client/server tool that you could be used in this type of setup:

client ------ FW ------ server

and where either client and/or server could generate traffic from various IP addresses/ports in a controlled way.

I am currently looking at Web-Polygraph (www.web-polygraph.org) from the Squid developers, but upon installation, I realized the license doesn't allow the publishing of the results.

Are there any tools worth looking at ? Is there anything else a decent netfilter (firewall ?) performance benchmarking tool should be able to do ?

Regards,
Filip

|On 18 Jun 2002 14:11:22 +0200
|"Filip Sneppe (Cronos)" <[email protected]> wrote
| about benchmark tool for netfilter - any recommendations ?:

We are building a tool for such goal. It is based in libnet. We parse several parameters such as: Protocol distribution (X% HTTP, Y% FTP, Z%H.323, etc), connection burst or not, num packets, etc Then we build in-memory descriptors of the traffic, to later dump full packets to the table. A second machine is prepared behind the firewall to answer part of the traffic in order to activate contrack mechanism of a netfilter/iptables firewall in between.

Is this what you were looking for ? It should be finished in early july. I do not know yet if my boss will allows us to release it as open source. If so I'll announce it here, otherwise get in thouch with us by then that I'll read the price tag for you ;o)

best regards
Senra

Rodrigo Senra         
MSc Computer Engineer   (GPr Sistemas Ltda)     [email protected] 
http://www.ic.unicamp.br/~921234  (LinUxer 217.243) (ICQ 114477550)