Testing device and testing method

Abstract

To allow a packet load test to be effectively performed without reducing a packet transmission amount in response to an instruction to change a communication method.SOLUTION: In a testing device 10, a command testing unit 15a detects whether or not a communication method change instruction is issued, using a predetermined command for a device to be processed. A test scenario unit 15b transmits a test packet generated based on a predetermined scenario to the device to be processed, using a communication method according to whether or not the communication method change instruction is issued.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a test apparatus and a test method.

Background Art

[0002] Conventionally, a technique for performing a packet load test by transmitting packets for applying a load to network equipment is known (see Non-Patent Document 1).

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, according to the prior art, it may be difficult to perform a packet load test without reducing the packet transmission amount in response to TCP Fallback. For example, in a packet load test such as a test simulating a denial-of-service attack on a DNS (Domain Name Server) server, packets set in advance are transmitted. Therefore, when a TCP Fallback, which is a request to retransmit using TCP instead of UDP, is received by a DNS server or a security device installed in the middle, there is a risk that subsequent test packets will all be discarded as invalid and cannot be handled. Also, in a test using an existing command that supports TCP Fallback, since the packet transmission amount per unit time is small, there is a problem that thousands of devices are required for a packet load test simulating a denial-of-service attack on a DNS server.

[0005] The present invention has been made in view of the above, and an object thereof is to enable an effective packet load test without reducing the packet transmission amount in response to a communication method change instruction such as TCP Fallback.

Means for Solving the Problems

[0006] In order to solve the above-described problems and achieve the object, a test apparatus according to the present invention includes a detection unit that detects the presence or absence of a communication method change instruction using a predetermined command for a device to be processed, and a communication method according to the presence or absence of the change instruction. And a transmission unit that transmits test packets generated based on a predetermined scenario to the device to be processed.

Effects of the Invention

[0007] According to the present invention, it is possible to effectively execute a packet load test without reducing the packet transmission amount in response to a communication method change instruction.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Embodiments for Carrying Out the Invention

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited by this embodiment. In the description of the drawings, the same parts are denoted by the same reference numerals.

[0010] [Overview of the Test Device] FIG. 1 is a diagram for explaining the overview of the test device of the present embodiment. FIG. 1 illustrates a test environment including a test device 10 and a test target network 20 to be processed. For example, the test device 10 generates and transmits preset packets to the DNS server 20c shown in FIG. 1 using existing commands such as dig and nslookup. In this case, there may be a case where so-called TCP Fallback is instructed to retransmit DNS packets from the DNS server 20c etc. by TCP instead of UDP. For example, TCP Fallback is instructed when so-called truncation occurs in the DNS server 20c exceeding the size that can be transmitted by UDP, or when the security device 20b detects an abnormal packet volume.

[0011] When TCP Fallback is instructed, the test device 10 generates test packets according to the TCP protocol and transmits them to the DNS server 20c. At that time, the test device 10 generates test packets based on a test scenario created by a script or the like. Thereby, even when TCP Fallback is instructed, it becomes possible to respond without reducing the packet transmission volume per unit time, and it becomes possible to effectively execute a packet load test.

[0012] Note that this test process is not limited to the test for the DNS server 20c, and is also applicable to tests for, for example, the network device 20a and the security device 20b. In that case, the test device 10 transmits test packets such as service denial attack packets and normal packets using a protocol suitable for each of the network device 20a and the security device 20b. Thereby, it becomes possible to conduct a security tolerance investigation and a bottleneck investigation of the test target network device 20a, security device 20b, and DNS server 20c.

[0013] [Configuration of the Test Device] FIG. 2 is a schematic diagram illustrating a schematic configuration of the test apparatus according to the present embodiment. As illustrated in FIG. 2, the test apparatus 10 according to the present embodiment is realized by a general-purpose computer such as a personal computer, and includes a communication control unit 13, a storage unit 14, and a control unit 15.

[0014] The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between an external device and the control unit 15 via a telecommunication line such as a LAN (Local Area Network), a VPN (Virtual Private Network), or the Internet. For example, the communication control unit 13 controls the transmission and reception of packets between a command test unit 15a and a test scenario unit 15b, which will be described later, and a network device 20a, a security device 20b, a DNS server 20c, etc. to be processed. The communication control unit 13 also controls the transmission and reception of packets accompanying the execution of a monitoring unit 15c and a management unit 15e, which will be described later.

[0015] The storage unit 14 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores in advance a processing program for operating the test apparatus 10, data used during the execution of the processing program, etc., or temporarily stores them each time processing is performed. Note that the storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

[0016] The control unit 15 is implemented using a CPU (Central Processing Unit), an NP (Network Processor), an FPGA (Field Programmable Gate Array), etc., and executes a processing program stored in a memory. Thereby, as illustrated in FIG. 2, the control unit 15 functions as a command test unit 15a, a test scenario unit 15b, a monitoring unit 15c, a log analysis unit 15d, and a management unit 15e to execute test processing. Note that these functional units may be implemented on different hardware, either individually or partially. For example, the monitoring unit 15c and the log analysis unit 15d may be implemented on an analysis device different from other functional units. Further, the control unit 15 may include other functional units.

[0017] The command test unit 15a functions as a detection unit and detects the presence or absence of an instruction to change the communication method using a predetermined command for the device to be processed. For example, the command test unit 15a uses a predetermined command for the DNS server to detect the presence or absence of a TCP Fallback instruction as an instruction to change the communication method.

[0018] Specifically, the command test unit 15a generates and transmits a packet or the like that requests communication start according to the DNS protocol to the DNS server 20c of the test target network 20 using commands such as dig and nslookup. Further, the command test unit 15a notifies a part of the first packet or the like to the test scenario unit 15b on the same IP address described later. Thereby, the test scenario unit 15b can grasp the formal content of the DNS packet, and in the following processing, it becomes possible to transmit and receive packets conforming to the DNS protocol to and from the DNS server 20c.

[0019] Further, the command test unit 15a checks whether TCP Fallback is instructed, for example, by setting the TC bit, in the DNS response packet received from the DNS server 20c or the like.

[0020] Here, the TCP Fallback instruction may be sent from the DNS server 20c when packet truncation occurs. Alternatively, it may be sent when the security device 20b detects an abnormal DNS packet volume. In this case, the security device 20b protects the DNS server 20c by discarding packets with a source IP address that does not follow the TCP Fallback instruction. Therefore, by sending a formal DNS packet via TCP according to the TCP Fallback instruction, it becomes possible to perform a packet load test on the DNS server 20c after passing the monitoring of the security device 20b.

[0021] When TCP Fallback is instructed, the command test unit 15a notifies the test scenario unit 15b, which will be described later. Also, the command test unit 15a regenerates a DNS packet via TCP and sends it to the DNS server 20c, and notifies a part of the generated DNS packet to the test scenario unit 15b. As a result, the test scenario unit 15b can grasp the content of the formal DNS packet, and in the following process, it becomes possible to send and receive formal packets conforming to the DNS protocol to and from the DNS server 20c.

[0022] The test scenario unit 15b functions as a transmission unit and sends test packets generated based on a predetermined scenario to the device to be processed using a communication method according to the presence or absence of a change instruction. For example, the test scenario unit 15b sends the generated test packets to the device to be processed using either UDP or TCP according to the presence or absence of the TCP Fallback instruction.

[0023] Specifically, the test scenario unit 15b generates test packets for the security resistance test against the DNS server 20c based on a scenario created with a script or the like. At this time, the test scenario unit 15b refers to the DNS packets generated by the command test unit 15a, and changes domain information, subdomain information, etc. queried to the DNS server 20c to generate test packets. In addition, the test scenario unit 15b may randomly add subdomain information by simulating an attack. As a result, abnormal packets that the DNS server 20c cannot resolve domains can be generated and transmitted. Then, the test scenario unit 15b continuously transmits the generated test packets to the DNS server 20c without waiting for a response from the DNS server 20c.

[0024] Here, when there is no indication of TCP Fallback, the test scenario unit 15b transmits the generated test packets to the DNS server 20c using UDP.

[0025] On the other hand, when TCP Fallback is indicated, the test scenario unit 15b transmits the generated test packets using TCP in the same manner as when there is no indication of TCP Fallback. Also in this case, the test scenario unit 15b continuously transmits the generated test packets to the DNS server 20c without waiting for a response from the DNS server 20c. As a result, even when TCP Fallback is indicated, it is possible to transmit test packets with a large number of packets per unit time without reducing the packet transmission volume to the DNS server 20c to be tested.

[0026] Note that the test scenario unit 15b may generate test packets based on a scenario and transmit them to the DNS server 20c to be tested without going through the command test unit 15a. In that case, the test scenario unit 15b analyzes response packets from the DNS server 20c or the like, and checks whether there is an indication of TCP Fallback, such as when the TC bit is set. Then, the test scenario unit 15b transmits the generated test packets using a communication method according to the presence or absence of the indication, that is, either UDP or TCP.

[0027] The monitoring unit 15c monitors the packet filter status and processing load status of the DNS server 20c. For example, as the packet filter status, the monitoring unit 15c monitors the number of test packets, the amount of bytes, and the response packets from the DNS server 20c to be tested per unit time for each source IP address, and grasps the source IP addresses for which response packets for the test packets have stopped arriving. In that case, the monitoring unit 15c causes the storage unit 14 to store the number of test packets, the amount of bytes, and the timestamp that were transmitted immediately before the time when the response packets stopped arriving, as the packet filter threshold value of the DNS server 20c to be tested.

[0028] The log analysis unit 15d functions as an analysis unit and analyzes the logs related to the test packets collected from each device on the traffic path for the device to be processed. For example, the log analysis unit 15d collects logs from the security device 20b, the DNS server 20c, etc., and analyzes the reaction of each device to the test packets, such as whether the processing load is increasing and whether normal packets are being discarded without being involved.

[0029] The management unit 15e changes the amount of test packets to be transmitted to the DNS server 20c according to the status of the processing load of the DNS server 20c. Thereby, it becomes possible to grasp the operation according to the processing load of the DNS server 20c.

[0030] Also, when the processing load of the security device 20b or the DNS server 20c exceeds a predetermined threshold value, the management unit 15e changes the content of the test packets to be transmitted to these security device 20b and DNS server 20c. Thereby, it becomes possible to grasp the limit of the processing load of the security device 20b and the DNS server 20c.

[0031] Also, when the test device 10 operates as a representative of a plurality of test devices 10, the management unit 15e may synchronize the test scenario and give instructions to execute / stop to other test devices 10.

[0032] [Test Processing] Next, with reference to FIG. 3, the test processing by the test apparatus 10 according to the present embodiment will be described. FIG. 3 is a flowchart showing the test processing procedure. The flowchart of FIG. 3 starts, for example, at the timing when a user performs an operation input instructing start.

[0033] First, the command test unit 15a detects the presence or absence of a TCP Fallback instruction using a predetermined command for the device to be processed (steps S1 to S2). For example, the command test unit 15a generates and transmits a packet such as a packet requesting communication start according to the DNS protocol using a predetermined command for the DNS server 20c. Further, the command test unit 15a checks whether a TCP Fallback is instructed, for example, by the TC bit being set in the DNS response packet received from the DNS server 20c or the like.

[0034] When there is no TCP Fallback instruction (step S2, No), the test scenario unit 15b generates test packets for a security resistance test for the DNS server 20c based on a scenario created by a script or the like, and transmits them to the DNS server 20c via UDP (step S4). Thereby, a series of test processing ends.

[0035] On the other hand, when there is a TCP Fallback instruction (step S2, Yes), the command test unit 15a notifies the test scenario unit 15b. In that case, the test scenario unit 15b generates test packets for a security resistance test for the DNS server 20c based on a scenario created by a script or the like, and transmits them to the DNS server 20c via TCP (step S3). Thereby, a series of test processing ends.

[0036] [Effect] As described above, in the test apparatus 10 of the present embodiment, the command test unit 15a detects the presence or absence of a communication method change instruction using a predetermined command for the device to be processed. The test scenario unit 15b transmits a test packet generated based on a predetermined scenario to the device to be processed using a communication method according to the presence or absence of the change instruction.

[0037] For example, the command test unit 15a detects the presence or absence of a TCP Fallback instruction as a communication method change instruction using a predetermined command for the DNS server 20c. In that case, the test scenario unit 15b transmits the generated test packet to the device to be processed using either UDP or TCP according to the presence or absence of the TCP Fallback instruction.

[0038] In this way, the test apparatus 10 detects the presence or absence of a communication method change instruction such as a TCP Fallback instruction using an existing command with low packet transmission performance, and transmits a test packet generated according to a scenario using a communication method according to the presence or absence of the instruction. Thereby, for example, when a change in the communication method such as TCP Fallback is instructed, a large number of test packets generated according to the scenario can be continuously transmitted using the instructed communication method such as TCP without reducing the transmission amount per unit time. Also, it is possible to avoid monitoring in which the security device 20b detects an abnormal DNS packet amount and discards the packet. Therefore, it becomes possible to effectively execute a packet load test without reducing the packet transmission amount in response to a communication method change instruction.

[0039] In addition, the log analysis unit 15d analyzes a log related to a test packet collected from each device on the traffic path for the device to be processed. Thereby, the test apparatus 10 can analyze, for example, an increase in processing load or the occurrence of normal packet discard based on the reaction of each device to the test packet.

[0040] [Program] It is also possible to create a program that describes the processing executed by the test apparatus 10 according to the above embodiment in a language executable by a computer. As one embodiment, the test apparatus 10 can be implemented by installing a test program that executes the above test processing as package software or online software on a desired computer. For example, by causing the information processing apparatus to execute the above test program, the information processing apparatus can function as the test apparatus 10. The information processing apparatus referred to here includes a desktop-type or notebook-type personal computer. In addition, the information processing apparatus also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and further includes slate terminals such as PDAs (Personal Digital Assistant) within its scope. Further, the functions of the test apparatus 10 may be implemented on a cloud server.

[0041] FIG. 4 is a diagram showing an example of a computer that executes a test program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0042] Memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System), for example. The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041, for example. A mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050, for example. A display 1061 is connected to the video adapter 1060, for example.

[0043] Here, the hard disk drive 1031 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored in, for example, the hard disk drive 1031 or the memory 1010.

[0044] Also, the test program is stored in the hard disk drive 1031 as a program module 1093 in which instructions executed by the computer 1000 are described, for example. Specifically, a program module 1093 in which each process executed by the test apparatus 10 described in the above embodiment is described is stored in the hard disk drive 1031.

[0045] Also, the data used for information processing by the test program is stored in the hard disk drive 1031 as program data 1094, for example. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed, and executes each of the above-described procedures.

[0046] Note that the program modules 1093 and program data 1094 related to the test program are not limited to being stored in the hard disk drive 1031. For example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program modules 1093 and program data 1094 related to the test program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0047] As described above, the embodiments to which the invention made by the present inventor is applied have been described. However, the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to this embodiment. That is, all other embodiments, examples, operation techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of the present invention.

Explanation of Reference Numerals

[0048] 10 Test apparatus 13 Communication control unit 14 Storage unit 15 Control unit 15a Command test unit (detection unit) 15b Test scenario unit (transmission unit) 15c Monitoring unit 15d Log analysis unit 15e Management unit 20 Test target network 20a Network device 20b Security device 20c DNS server

Claims

1. A detection unit that uses a predetermined command for a device to be processed to detect the presence or absence of an instruction to change the communication method; A transmission unit that transmits a test packet generated based on a predetermined scenario to the device to be processed using a communication method according to the presence or absence of the change instruction; A test device, characterized by comprising the above.

2. The detection unit uses a predetermined command for a DNS server to detect the presence or absence of a TCP Fallback instruction as the instruction to change the communication method; The test device according to claim 1, wherein the transmission unit transmits the test packet to the device to be processed by either UDP or TCP according to the presence or absence of the TCP Fallback instruction.

3. The test device according to claim 1, further comprising an analysis unit that analyzes a log related to the test packet collected from each device on the traffic path for the device to be processed.

4. A test method executed by a test device, comprising: A detection step of using a predetermined command for a device to be processed to detect the presence or absence of an instruction to change the communication method; A transmission step of transmitting a test packet generated based on a predetermined scenario to the device to be processed using a communication method according to the presence or absence of the change instruction. A test method, characterized by including the above.

Images