Example HTTP Transaction Rate Test topology.

Transcription

1 RFC 3511 Suite Aptixia IxAutomate s RFC3511 suite works in conjunction with IxLoad to provide a standardized suite based on layer 4-7 protocols. The primary intent of RFC3511 is to firewall devices. This is done with very specific s that mix HTTP traffic with Denial of Service Syn attacks, IP fragmentation attacks and denied traffic. There are also s that measure maximum TCP and HTTP transaction rates and connection rates, free of DOS traffic. These s can be used for any networking device when connection oriented packet per second throughput rates need to be measured. Example HTTP Transaction Rate topology. RFC 3511 Suite Descriptions RFC 3511 Suite: Denial of Service The Denial of Service Handling determines the effect of a denial of P/N: Rev 4-7/23/ Page 1 of 5

2 Illegal Traffic IP Fragmentation IP Throughput Latency service attack on a DUT TCP connection establishment rate. The iterative process of the Max. TCP Connection Establishment Rate is running with the denial of service attack enabled and disabled. The difference between results is the effect of the denial of service attack on the DUTs performance. The DoS attack exploits the TCP s three way handshake mechanism by sending TCP SYN attack segments. Results include maximum TCP connection rates per port. To characterize the behavior of the DUT/SUT when presented with a combination of both legal and illegal traffic. Illegal traffic does not refer to an attack, but traffic which has been explicitly defined by a DUT access control list to drop the illegal traffic flow. The uses a Max HTTP Transaction Rate, but mixes legal and illegal traffic in a user definable percentage. Results include maximum HTTP transaction rates per port. The IP Fragmentation Handling sends packets which have been fragmented due to crossing a network that supports a smaller MTU (Maximum Transmission Unit) than the actual IP packet. This fragmentation may require the firewall to perform re-assembly prior to the rule set being applied. This will focus on determining how the additional processing associated with the re-assembly of the packets has on the forwarding rate of the DUT/SUT. This employs two types of traffic: HTTP 1.1 as non-fragmented traffic and UDP/IP fragmented packets. Results include average transfer rate of nonfragmented transactions and number of requests sent and received. The Throughput NDR uses network layer traffic (stream based) to determine the maximum packet No Drop Rate that can pass through the device or system under. A binary search with multiple iterations is used to determine this maximum. Multiple packet sizes can be configured. Results include total packets transmitted and received, frame loss, and a packets per second rate. The Latency is used determine and compare the latency of both connectionless network layer traffic and HTTP application layer traffic. Latency is measured for each type of traffic so that comparisons can be made. In addition, line rate and packet sizes can be configured. P/N: Rev 4-7/23/ Page 2 of 5

3 Results include the maximum and average latency per port. TCP Connections Capacity HTTP Maximum Transaction Rate HTTP Transfer Rate TCP Maximum Connections Rate The TCP Connections Capacity determines the maximum total number of TCP connections the device or system under can support. The uses a binary search routine that begins with an initial number of attempted concurrent connections, if successful the iterates by doubling the concurrent attempted connections until the maximum number of successful connections no longer meets the search tolerance that has been defined. Results include the maximum number of concurrent connections per port. The HTTP Maximum Transaction Rate uses a binary search routine to determine the maximum transaction rate for an HTTP requested object traversing the firewall. To achieve it a set of http client(s) are configured to initiate simultaneously connections to the http server(s). Results include attempted/maximum/average transaction rates per second and total HTTP requests and responses received. The HTTP Transfer Rate determines the transfer rate of HTTP requests per second traversing the device or system under. A definable number of clients are configured along with a Requests per Connection value and an object size. The calculates the aggregate transfer rate in bits per second. Results include Transfer Rate (bits/sec), and HTTP requests sent and received. The TCP Maximum Connections Rate finds the maximum TCP connection establishment rate the DUT can handle. To validate the connections, the application performs http transactions from the configured client networks to the server networks. The employs an iterative search algorithm to determine the maximum rate and the attempted connection rate is varied from iteration to iteration. Results include attempted and actual connection rate (TCP connections/sec.), HTTP requests/responses completed, and total bytes sent and received. P/N: Rev 4-7/23/ Page 3 of 5

4 RFC 3511 Suite Specifications s Traffic Type Pass Criteria HTTP Binary Search Connection- Oriented Connectionless Line Rate(BPS) Connection Rate Transfer Rate (PPS) Passed Fragments Transaction Rate Latency Concurrent Connections RFC 3511 Suite DOS Handling Illegal Traffic Handling IP Fragmentation IP Throughput Latency TCP Connection Capacity HTTP Max. Transaction Rate HTTP Transfer Rate HTTP Max. Connection Rate Requirements Windows 2000 or XP client PC with a minimum of 512 meg of RAM Linux/Unix support- command line only TCL 8.4 support only XM12, XM2, Optixia X16, Optixia XL10, IXIA 1600T, IXIA 400T, IXIA 250 P/N: Rev 4-7/23/ Page 4 of 5

5 At least one Ixia Load Module: Gigabit TXS Family, ALM and CPM, LSM10G Family, LSM1000XMV16, LSM1000XMS12/R12, LM622ATM/POS, MSM 2.5G (OC-48c), MSM10G, LM10GE700F1, LM10GE700F1-P. LMOC48C3 and SR. IxOS 4.10 or higher IxRouter 4.10 SP1 or higher IxNetwork 5.0 SP1 patch2 IxLoad 3.0 or higher Product Ordering Information All-In-One Software Bundle Base Software- Framework GUI RFC 3511 Suite This material is for informational purposes only and subject to change without notice. It describes Ixia's present plans to develop and make available to its customers certain products, features and functionality. Ixia is only obligated to provide those deliverables specifically included in a written agreement between Ixia and the customer. P/N: Rev 4-7/23/ Page 5 of 5