Fireperf: Open-source network testing tool for firewalls and routers
The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one. It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that keep a state for every connection.
What fireperf does
iperf3, the widely used bandwidth tester, measures how much data two computers can push between them. A firewall has to do that and also take on many new connections per second and manage them over a long period, which is the rate fireperf was built to measure. It logs how long each handshake took across every connection it opens, and when one fails to come up it records why: a timeout, a refusal, or the test machine itself running out of resources.
fireperf also holds connections open and rechecks them, so an administrator can see how many a firewall discarded after a long idle period. A device can post a clean throughput number and still be expiring state behind it.
“The project started as an experiment about five years ago since we often found problems of not being able to generate enough traffic using iperf/iperf3. The fundamental design of fireperf is very different and event-loop based which was not easy to integrate into the then current design of the other tools,” Rico Hoppe, the creator of fireperf, told Help Net Security.
Many clients, one port
One fireperf server handles any number of clients on the same port at once, each with its own test running, where iperf3 works through one test at a time. Beyond plain data throughput, it can simulate request-response patterns, such as a 100-byte request answered by 10 KB. It talks to iperf3 and iperf servers, and iperf3 clients can test against a fireperf server. In a terminal it draws a live graph alongside an overview of every client; with no terminal it prints line by line, and –json emits one JSON object every second.
Hoppe said: “Testing your infrastructure is exactly what this has been built for. Put firewalls under a lot of load, but that does not only mean to send a lot of packets. Sometimes we need to create a large number of short-lived connections to put an IPS under maximum load.”
Signed packages cover Debian, Arch Linux, RHEL and compatible distributions including AlmaLinux and Rocky Linux, and openSUSE Tumbleweed. The source code sits on the project page. A build from source needs a C compiler, Autotools, pkg-config, ncursesw, gettext and intltool, with liburing 2.3 or later optional but recommended.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
