Summary of the invention
The problem that technical scheme of the present invention will solve improves the flexibility of network testing device, diversity, high speed and cost performance, to meet more network test requirements.
For solving the problem, technical scheme of the present invention provides a kind of network test system, comprising:
Network testing device, bus interface and network interface; Described network testing device comprises field programmable gate array module;
Described network testing device is connected with described network interface with described bus interface respectively, described network interface realizes the data interaction between described network testing device and the network equipment, described bus interface realizes the data interaction between described network testing device and control system, and described control system comprises the operating system of mainboard and the lift-launch of described mainboard.
Optionally, described network testing device comprises data flow generation module, data stream reception module, data statistics module and concurrent connecting test module; Described data flow generation module is used for producing according to traffic parameter configuration information and sending data flow, described data stream packets includes network data flow, described data stream reception module is used for catching according to matched rule and receiving qualified network data flow, described data statistics module is for adding up transmitting-receiving speed and the transmitting-receiving sum of Various types of data stream or Frame, and described concurrent connecting test module is for testing the maximum concurrent connection number of the described network equipment and maximum newly-built speed.
Optionally, the field of the agreement that described data flow generation module editor is different produces the different data flow of attribute, and sends this data flow interval time with predetermined frame; The port of each described data flow generation module configures at most or adds 255 data flow.
Optionally, described field comprises source MAC field, object MAC field, data frame type field, source IP field, object IP field, IP protocol type field, source port field, destination interface field and is connected flag bit field; Described data flow generation module when editing the field of different agreement, for each field arranges field Changing Pattern.
Optionally, described field Changing Pattern comprises: fix, increase progressively, successively decrease, Stochastic sum specify in the combination of one or more.
Optionally, when described field Changing Pattern adopts and increases progressively and successively decrease, the step value increased progressively or step value value within the scope of specified quantity of successively decreasing.
Optionally, described predetermined frame interval time is fixed value or centrifugal pump; The Changing Pattern of described centrifugal pump is the one in the change of square wave rate waveform, the change of sinusoidal wave rate waveform and the change of triangular wave rate waveform.
Optionally, when described data stream reception module catches described network data flow, setting filtering rule filters described network data flow, and stores described network data flow, and the data space of the port of described data stream reception module is 2GB.
Optionally, the composition field of described filtering rule comprises source MAC field, object MAC field, data frame type field, source IP field, object IP field, IP protocol type field, source port field, destination interface field and the combination of one or more be connected in flag bit field, and different fields is according to application rule determination conditional attribute.
Optionally, described application rule comprise with or and non-, carry out with field must meet simultaneously bind a set condition, carry out or field be a set condition, to carry out non-field be one or condition, using flag bit, described composition field determines that whether it is as filter condition.
Optionally, described data statistics module is also added up with transmitting-receiving sum the transmitting-receiving speed of each port, described transmitting-receiving sum comprises transmission statistical parameter and receives statistical parameter, described reception statistical parameter comprises: received frame sum, receive IPv4 frame sum, receive IPv6 frame sum, receive VLAN frame sum, receive ARP bag sum, receive ICMP bag sum, receive TCP bag sum, receive UDP bag sum, receive broadcast packet number, receive crc error bag number, receive PRBS erroneous packets number, receive MPLS bag sum, receive Jumbo bag sum, receive Pause frame sum, receive Oversize bag sum, receive Undersize bag sum, receive Insequence bag number, receive Out of Sequence bag number, receive IPv4 Header Error verification bag number, receive IP size error verification bag number, receive TCP check erroneous packets number, receive UDP check errors bag number, receive Bytes sum, received frame speed and reception Byte speed, described transmission statistical parameter comprises: transmission frame sum, send IPv4 frame sum, send IPv6 frame sum, send VLAN frame sum, send ARP bag sum, send ICMP bag sum, send TCP bag sum, send UDP bag sum, send broadcast packet number, send crc error bag number, send PRBS erroneous packets number, send MPLS bag sum, send Jumbo bag sum, send Oversize bag sum, send Undersize bag sum, send Bytes sum, transmission frame speed and transmission Byte speed.
Optionally, described concurrent connecting test module adopts single port to realize C mode or two-port to realize C/S model and test the maximum concurrent connection number of the described network equipment and maximum newly-built speed.
Optionally, described single port realize C mode comprise setting concurrent parameter realize Concurrency Access, realize concurrent connecting test; Described concurrent connecting test module carries out dns resolution, carries out address learning before testing; Described concurrent parameter comprises the minimum value of source IP address, the maximum of source IP address, address mask, maximum newly-built speed limit value and target.
Optionally, described two-port realizes C/S model and refers to that Single port is set to C mode, provides access services simultaneously, realize concurrent connecting test with another port analog service end.
Optionally, described concurrent connecting test module tests out the maximum concurrent connection number of TCP, the maximum newly-built speed of TCP, the maximum concurrent connection number of HTTP and the maximum newly-built speed of HTTP simultaneously, in test process, adopts only to build and does not tear open and build while tear two kinds of modes open.
Optionally, described bus interface is PCI, CPCI/PXI or PCIE bus, and supports hot plug mode; Described network interface is provided with four and supports the network interface of 10M/100M/1000Mbit/s and the network interface of two support 10Gbit/s.
The present invention takes above technical scheme, compared with prior art, has the following advantages:
(1) network test system of technical solution of the present invention can send the data flow of specific field change, field Changing Pattern comprise increase progressively, successively decrease, Stochastic sum specifies, thus enhances the flexibility of network test.
(2) can adjust in real time the interval time of the network test system transmission data flow of technical solution of the present invention, thus enhance the actual effect of network test.
(3) network test system of technical solution of the present invention can be caught network data in conjunction with multiple field, and multiple field can by with or, the logic such as non-forms and combines filter condition.
(4) network test system of technical solution of the present invention realizes the concurrent connecting test of the network equipment by C/S model, and containing building while tear open and only build and do not tear two kinds of modes open.
(5) network test system of technical solution of the present invention comprehensively adopt above some can reach comparatively complete network test effect.
Embodiment
For enabling above-mentioned purpose of the present invention, feature and advantage more become apparent, and are described in detail the specific embodiment of the present invention below in conjunction with accompanying drawing.
Set forth detail in the following description so that fully understand the present invention.But the present invention can be different from alternate manner described here to implement with multiple, those skilled in the art can when without prejudice to doing similar popularization when intension of the present invention.Therefore the present invention is not by the restriction of following public embodiment.
Fig. 1 is the application schematic diagram of the network test system that the embodiment of the present invention provides, and Fig. 2 is the structure chart of the network test system that the embodiment of the present invention provides, and describes in detail below in conjunction with Fig. 1 and Fig. 2.
Described network test system comprises:
Network testing device 10, bus interface 40 and network interface 50; Described network testing device 10 comprises field programmable gate array module (field programmable gate array module also claims FPGA module);
Described network testing device 10 is connected with described network interface 50 with described bus interface 40 respectively, described network interface 50 realizes the data interaction between described network testing device 10 and the network equipment 20, described bus interface 40 realizes the data interaction between described network testing device 10 and control system 30, and described control system 30 comprises the operating system of mainboard and the lift-launch of described mainboard.
Described bus interface 40 can be PCI, CPCI/PXI or PCIE bus, and supports hot plug mode.Described network interface 50 is provided with the network interface of support four 10M/100M/1000Mbit/s and the network interface of two support 10Gbit/s.
Described network testing device 10 comprises data flow generation module, data stream reception module, data statistics module and concurrent connecting test module; Described data flow generation module is used for producing according to traffic parameter configuration information and sending data flow, described data stream packets includes network data flow, described data stream reception module is used for catching according to matched rule and receiving qualified network data flow, described data statistics module is for adding up transmitting-receiving speed and the transmitting-receiving sum of Various types of data stream or Frame, and described concurrent connecting test module is for testing the maximum concurrent connection number of the described network equipment 20 (also referred to as destination network device) and maximum newly-built speed.
In specific implementation process, network test system comprises network testing device 10 and (possesses the board of network interface 50 and CPCI interface, core is fpga chip, also claims FPGA module) and control system 30 (mainboard of tape operation system, above running control software).Control system 30 i.e. mainboard, this mainboard operation system, network testing software also runs in mainboard, by bus and FPGA testing apparatus (being included in network testing device 10) interaction data.
The field of the agreement that described data flow generation module editor is different produces the different data flow of attribute, and sends this data flow interval time with predetermined frame; The port of each described data flow generation module configures at most or adds 255 data flow.
Described field comprises source MAC field, object MAC field, data frame type field, source IP field, object IP field, IP protocol type field, source port field, destination interface field and is connected flag bit field; Described data flow generation module when editing the field of different agreement, for each field arranges field Changing Pattern.
Described field Changing Pattern comprises: fix, increase progressively, successively decrease, Stochastic sum specify in the combination of one or more.When described field Changing Pattern adopts and increases progressively and successively decrease, the step value increased progressively or step value value in preset range of successively decreasing; In described field Changing Pattern employing preset range during value, its quantitative range is less than or equal to 255.
Described predetermined frame interval time is fixed value or centrifugal pump; The Changing Pattern of described centrifugal pump is the one in the change of square wave rate waveform, the change of sinusoidal wave rate waveform and the change of triangular wave rate waveform.
During described data stream reception module capture network data stream, setting filtering rule filters described network data flow, and stores described network data flow, and the data space of the port of described data stream reception module is 2GB.The composition field of described filtering rule comprises source MAC field, object MAC field, data frame type field, source IP field, object IP field, IP protocol type field, source port field, destination interface field and the combination of one or more be connected in flag bit field, and different fields is according to application rule determination conditional attribute.Described application rule be respectively with or, non-three kinds, the field of carrying out "AND" must meet simultaneously binds a set condition, the field of carrying out "or" is a set condition, the field of carrying out " non-" is a "or" condition, using flag bit, described composition field determines that whether it is as filter condition.
The transmitting-receiving speed of described data statistics module statistics Various types of data stream or Frame and transmitting-receiving sum, described data statistics module is also added up with transmitting-receiving sum the transmitting-receiving speed of each port, described transmitting-receiving sum comprises transmission statistical parameter and receives statistical parameter, and described reception statistical parameter comprises: received frame sum, receive IPv4 frame sum, receive IPv6 frame sum, receive VLAN frame sum, receive ARP bag sum, receive ICMP bag sum, receive TCP bag sum, receive UDP bag sum, receive broadcast packet number, receive crc error bag number, receive PRBS erroneous packets number, receive MPLS bag sum, receive Jumbo bag sum, receive Pause frame sum, receive Oversize bag sum, receive Undersize bag sum, receive Insequence bag number, receive Out of Sequence bag number, receive IPv4 Header Error verification bag number, receive IP size error verification bag number, receive TCP check erroneous packets number, receive UDP check errors bag number, receive Bytes sum, received frame speed and reception Byte speed, described transmission statistical parameter comprises: transmission frame sum, send IPv4 frame sum, send IPv6 frame sum, send VLAN frame sum, send ARP bag sum, send ICMP bag sum, send TCP bag sum, send UDP bag sum, send broadcast packet number, send crc error bag number, send PRBS erroneous packets number, send MPLS bag sum, send Jumbo bag sum, send Oversize bag sum, send Undersize bag sum, send Bytes sum, transmission frame speed and transmission Byte speed.
Described concurrent connecting test module adopts single port to realize C mode or two-port and realizes C/S model and test the maximum concurrent connection number of the described network equipment 20 and maximum newly-built speed.Described single port realize C mode comprise setting concurrent parameter realize Concurrency Access, realize concurrent connecting test; Described concurrent connecting test module carries out dns resolution, carries out address learning before testing; Described concurrent parameter comprises the minimum value of source IP address, the maximum of source IP address, address mask, maximum newly-built speed limit value and target.Described two-port realizes C/S model and refers to that Single port is set to C mode, provides access services simultaneously, realize concurrent connecting test with another port analog service end.Described concurrent connecting test module tests out the parameters such as the maximum concurrent connection number of TCP, the maximum newly-built speed of TCP, the maximum concurrent connection number of HTTP, the maximum newly-built speed of HTTP simultaneously, and mode has only to build and does not tear open and build while tear two kinds open (that is, in test process, the connection between described network test system and the network equipment 20 is only disconnected by described network test system or is only disconnected by the described network equipment 20).
Technical scheme of the present invention provides a kind of 1G/10Gbit/s express network test macro realized based on FPGA, and described network testing device comprises field programmable gate array network testing device.Technical scheme of the present invention adopts the hardware implementation mode (fpga chip and PHY chip are welded in described network testing device) in conjunction with scale programmable logic device (fpga chip) and physical layer interface device (PHY chip), the outside external memory storage (as Fig. 2) also connecting DDR RAM etc. and be suitable for of network testing device.
In technique scheme, described scale programmable logic device (FPGA) comprises five module sections:
In layer 2-3 data transmit-receive processing module 101 (comprising transmission processing module and receiving processing module), the parameter that transmission processing module sets according to user, is generated corresponding Ethernet bag and gives PHY chip, sent by 10GE or GE port.Transmission processing module further can be refined as transmission processing and the TCP process of layer 2-3, completes corresponding processing capacity respectively.Receiving processing module receives the Ethernet bag brought from PHY, analyzes each bag, completes the demand of corresponding statistics and user's setting, such as to the seizure etc. of specified packet.Also need to receive the mutually mutual of sending module in TCP process aspect, according to the TCP connection received, send corresponding TCP and respond to complete TCP establishment of connection and dismounting work etc.
TCP connects the connection establishment of primary responsibility TCP and connection management of accelerating processing module 102 and the framing carrying out tcp data frame according to the storage information be stored in outside QDRII, and QDRII stores the essential information that each TCP connects, as state etc.
Data Analysis and the process of 4-7 layer protocol processing module 103 mainly in order to carry out more than three layers when realizing network interface card function, usually, mainly provide the transmission channel between a upper and lower computer.
Framing module carries out framing to the information from transmitting-receiving processing module according to Ethernet protocol, and adds timestamp, the information such as bag sequence number and CRC.
Frame parsing module is mainly resolved the data come in automatic network, comprise CRC to detect, the detection of test platform self mark, then the mac source address will parsed, destination address, agreement, IP source address, IP destination address, bag sequence number, timestamp information etc. are delivered to each functional module and are processed accordingly.
As shown in Figure 3, in preferred embodiment of the present invention, carry out Denial of Service attack test to by the server of Firewall Protection, comprise the following steps:
(1) configuration FTP service in destination server 201 (being called for short server 201), in advance by the service of terminal PC 202 access destination, record access situation and access rate thereof.
(2) specified network test macro 203 (comprises A and B two ports, terminal PC 202 is connected by switch 204 with network test system 203) in test port (this test port is the network test interface on network test system or network testing device), and be each port arrangement test data stream, data flow configuration information has: source MAC is set to fixed value, object MAC is set to broadcast address, IP agreement is set to Transmission Control Protocol, source IP address facilities (arranges minimum value, maximum is set, step value is set, increment mode is set), object IP is set to the IP address of destination server 201, source port facilities (arranges minimum value, maximum is set, step value is set, increment mode is set), destination interface is set to FTP serve port, sequence number is set to stochastic model, TCP connects mark SYN and is set to ' 1 '.The source MAC of each port should be set to inconsistent.
(3) each test port of network test system 203 carries out address learning according to source IP address scope binding source MAC in advance.
(4) IPG of each test port of network test system 203 is set to square-wave variations pattern, and the cycle should be inconsistent respectively.
(5) start test data stream to send, after 5 seconds, check the resource consumption situation of destination server 201, if resource consumption is larger, then show that fire compartment wall 205 fails stop Denial of Service attack data flow or fail to protect destination server 201, utilize terminal PC 202 to initiate normal access simultaneously and confirm further to test effect; If resource consumption is little or do not have significant change, then show that fire compartment wall 205 prevents Denial of Service attack data flow or carried out timely protection to destination server 201, utilize terminal PC 202 to initiate normal access simultaneously and confirm test effect further.
As shown in Figure 4, in preferred embodiment of the present invention, to source IP address and the IP protocol type configuration audit test of gateway device, but be not limited only to this test event, it comprises the following steps:
(1) network test system 203 retains two ports for test, specifies A port to be test data stream transmit port, specifies B port to be test data stream receiving port, and A port and B port send data flow to tested gateway device 206 by switch 204.
(2) configuration testing data flow port (A port): test data banish put as follows, the IP address that source MAC is set to fixed value, object MAC is set to broadcast address, IP agreement is set to specified protocol (tested agreement), source IP address facilities (arrange minimum value, arrange maximum, arrange step value, arrange increment mode), object IP are set to test data stream receiving port (B port), other fields are set to fixed value.
(3) configuration testing data stream reception port (B port): source IP address and IP agreement are set to filter condition, and other fields are not set to filter condition, and source IP address is set and IP agreement is "AND" rule (application rule).
(4) test data stream transmit port (A port) carries out address learning according to source IP address scope binding source MAC in advance.
(5) test data stream receiving port (B port) carries out address learning according to the port IP address binding source MAC in advance.
(6) start test data stream to send and receive, after data flow, receiving port data receiver situation, if receive sent data, then such data showing to meet IP address and IP agreement fail to be filtered or to stop; If send data and be not received, then show that tested gateway device 206 has carried out filtering or stoping to the corresponding class data that meet IP address and IP agreement.
(7) the filtering rule situation of gateway device can be tested and find to above testing procedure fast, and examine it.
As shown in Figure 5, in preferred embodiment of the present invention, test the concurrent concatenation ability of fire compartment wall or server, but be not limited only to this test event, it comprises the following steps:
(1) configuration WEB service (http: // 192.168.0.100/index.html) in destination server 201 (being called for short server 201), nominative testing port simultaneously (B port) is service of simulation end, and simulate WEB service (http: // 192.168.0.100/index.html), nominative testing port (A port) is emulates client.
(2) network test system 203 retains two ports (A and B) for test, and A port and B port send data flow to fire compartment wall 205 by switch 204.During the newly-built concatenation ability of test target server 201, configuration testing port (A port): the lowest address of setting source IP, the maximum address of source IP, address mask, destination interface, URL and maximum newly-built speed.
(3) start test, carry out address learning according to source IP address scope binding source MAC in advance.Start to initiate new connection gradually to destination server, and get instruction is carried out on connection basis, carrying out in new connection procedure, when discovery connection failure number increase or when can not connect, record current total linking number, also namely substantially can characterize the maximum newly-built speed of the test result of destination server.
(4) when testing the concurrent concatenation ability of fire compartment wall, configuration testing port (A port): the lowest address of setting source IP, the maximum address of source IP, address mask, destination interface, URL and maximum newly-built speed limit value.
(5) test is started, A port is made to carry out address learning according to source IP address scope binding source MAC in advance, B port is made to carry out address learning according to the port IP address binding source MAC in advance, A port starts to initiate new connection gradually to the service end of B port emulation, and get instruction is carried out on connection basis, carrying out in new connection procedure, when discovery connection failure number increase or when can not connect, record current total linking number, also namely substantially can characterize the maximum concurrent connection number of target fire compartment wall.
Technical scheme of the present invention provides a kind of express network test macro realized based on FPGA, flexibility is high, test level is perfect, at a high speed, cost performance is high, and the test request of network operation and detection, network equipment exploitation and test can be met, enhance the diversity of network test and improve the efficiency of network test, the demand of a large number of users to network test can be met.
The above is only the preferred embodiment of the present invention; it should be pointed out that for those skilled in the art, under the premise without departing from the principles of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.