Slashdot Mirror

If you're serious about it, you basically need to give in and spend serious $.

The main game in town is Spirent.

In the IPS & firewall testing world, they're what everyone uses, but even in lots of load balancing applications etc they're what people use.

There are a few software solutions around that do an ok job, but very few that can do much at decent speed (ie > 400Mbit). I have a pretty crack team of devs, and using hand tuned open source, and home-spun apps, we got by for a few years, but should have given in years earlier and just got a set of Spirent gear. You'll save time.

Their Smartbits line are basically hardware based packet generators, able to blast away for a variety of scenarios.

Their Avalanche line are hardware based full session generators, so you can re-create a web server being hammered by thousands of clients. I just signed a cheque for > $100k for a single pair of avalanche boxes however, so bring your cash box...

You'll probably find Spirent's hw based solutions frustrating, but if you work with others doing similar work they're very widely used, and you can exchange scripts etc..

There is an Irish company that was moving in to this space, and had an ok product, but it was a bit immature when I last tried it. Sorry, but their name escapes me- google should know.

--Q

And doesn't Spirent Communication own the trademark word "Avalanche" for their high-speed HTTP packet accelerator?

And doesn't Spirent Communication own the trademark word "Avalanche" for their high-speed HTTP packet accelerator?

No they rely on things like this:
http://www.spirentcom.com/analysis/product_line.cf m?pl=33&wt=2
and this:
http://www.ixiacom.com/products/chassis/ch_display .php?skey=ch_1600t_400t_100

I used one of these to demonstrate to the IT department of my megacorp exactally why my networking lab needed it's own isolated subnet on its own Cat6K, and its own servers.
Once I started pumping out thousands of frames per second of random IP and MAC addresses their routers started dying under the loads.
I got everything I asked for :-)
-nB

... can be obtained by using specialized testing tools like Smartbits (just one example out of thousands of them. Basically, these devices/tools generate manged traffic. So, you can direct one of these devices to your servers/networks and start measuring points of saturation. Just spend few minutes on google searching for testing tools and you will end up with a list of 100s of them to be used in different areas like wired/wireless, security, VoiP, etc .... --- Evil thrives, when good men do nothing!

The best utility to do large bandwidth testing is probably the SmartBits from Spirent Communications. It wouldn't be easy to fill up a 2.5Gbps link with a normal server.

I am afraid if you do you are in for a RUDE awakening. The fact of the matter is that these $20,000 solutions cost that much for a reason, and the reason is they've spent years optimizing them for high speed links. This is something the hobbiest programmers who work on Snort cannot compete with. For instance, what open source coder has a SMARTBITS on their desk? Something like that is essential to test these things, but they cost upwards of $10,000.

So I would say yes, if all you want to do is monitor a T1 or two, and you're willing to tinker alot, something like Snort would work. But if you have a SERIOUS network with lots of bandwidth, you're gonna have to pony up the dough.

Disclosure: I helped build one of the systems that Snort supposedly beat, and I analyzed the source code for another one that was bought by that company. Snort CANNOT beat either one in a high bandwidth situation. I've seen the code, I've run the tests, trust me.

I no longer work for that company so have little to gain by saying this.