[unisog] network traffic simulations

Valdis.Kletnieks@vt.edu Valdis.Kletnieks at vt.edu
Thu Mar 9 16:33:05 GMT 2006

On Thu, 09 Mar 2006 07:39:35 PST, Isac Balder said:

> TCPREPLAY is nice, but you have to have a copy of
> traffic from something.  It can sometimes be
> challanging to find and / or create the traffic you
> wish to repeatedly simulate.

On the other hand, if you're trying to do "burn in" of gear
that's going to go on your backbone, just snarfing up an hour
of traffic off a spanning port on your backbone, and replaying
that, will give a good simulation of 'average' activity.  If
you feel the need to stress the routers, just play the hour's
traffic back in just 30 minutes, or 15.

A bigger problem is that this doesn't stress the corner cases
on the router.  For instance, there was a worm a while ago that
melted down a lot of routers when it generated an outrageous
number of flows by ICMP PING'ing half the known world....

A bigger problem is that if you're trying to stress test a router,
you may need a non-trivial test rig.  A router we were beating up
on recently wasn't even breathing hard at 4 million flows/second.

Generating 4 million new flows per second is left as an exercise
for the student. ;) 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/unisog/attachments/20060309/701f3022/attachment.bin

More information about the unisog mailing list