Page History

Testing TCP/IP Network Stacks

When working on the network stack there is a need to test and verify the changes made.
While problems may be discovered by chance, it is hard to reproduce such situations.
The following sections show some methods to stress the target or generate some specific
traffic.

In the examples the target has the IP address 192.168.2.135

SYN Flood Attack

Flood the target with SYN packets to exhaust its resources.
It's a good way to test the network driver's buffer management.

sudo hping3 --flood -S -p 80 192.168.2.135

Building Packets with Scapy

A wonderful network testing tool is the Scapy lib.
It enables you to build pretty much any packet constellation you need for testing.

...

sudo iptables -D OUTPUT -p tcp --tcp-flags RST RST -d 192.168.2.135 -j DROP

Testing Re-transmission behavior

When sending a 3-way handshake only, the target should time out
and reset the connection.

...

#!/usr/bin/env python

import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import *

get = 'GET / HTTP/1.1\r\n\r\n'

ip = IP(dst="192.168.2.135")
port = RandNum(1024, 65535)

# Create SYN packet
SYN = ip/TCP(sport=port, dport=80, flags="S", seq=42)

# Send SYN and receive SYN,ACK
SYNACK = sr1(SYN)

# Create ACK with GET request
ACK = ip/TCP(sport=SYNACK.dport, dport=80, flags="A", seq=SYNACK.ack, ack=SYNACK.seq + 1)

# SEND our ACK
send(ACK)

reply, err = sr(ip/TCP(sport=SYNACK.dport, dport=80, flags="A", seq=SYNACK.ack, ack=SYNACK.seq + 1) / get)

Simulating Packet Loss

With simulating packet loss one can test the retransmission behaviour of the
target stack.

...

# for the incoming packets:
sudo iptables -D INPUT -m statistic --mode random --probability 0.1 -j DROP

# and for the outgoing packets
sudo iptables -D OUTPUT -m statistic --mode random --probability 0.1 -j DROP

Fuzz-Testing

For fuzz testing network applications the excellent
SPIKE tool
can be used. To make it compile under Ubuntu 14.04 LTS you have to add
-fno-stack-protector to CFLAGS in src/Makefile.in.

...