Starting a DDoS single packet flood test
FortiTester tests the DUT's ability to handle different types of DDoS attacks. This test attempts to deplete the DUT's resources by flooding the DUT with non-session based attacks.
To start a single packet flood test:
- Go to Cases > Security Testing > DDoS > Single Packet Flood to display the test case summary page.
- Click + Create New to display the Select case optionsdialog box.
- In the popup dialog, for the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
- Select a Certificate Group if applicable.
- Click OK to continue.
- Configure the test case options described below.
- Click Start to run the test case.
FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.
|
Tip 1: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case. Tip 2: You can add or edit a comment when the test is running. This comment can be used to search for the test result in the Results page. This is useful especially when the test runs for a long time. |
DDoS Single Packet Flood Test Case configuration
| Settings | Guidelines |
|---|---|
| Basic Information | |
| Name | Specify the case name, or just use the default. The name appears in the list of test cases. |
| Ping Server Timeout | If a FortiTester connects to a DUT via a switch, the switch might cause a ping timeout, resulting in the test case failing to run. If this occurs, increase the timeout. The default is 15 seconds. The valid range is 0 to 600. Note: You can disable this end-to-end connectivity test by entering a setting of 0. If the DUT is unable to return packets, it is recommended you do so. |
| Number of Samples | Select the number of samples. The default is 20, which means the web UI will show the last 20 sample data (about 20 seconds) in the test case running page. You can select 20, 60, or 120. |
|
Script Config |
Select the script that will run before/after the test. To create a script, see Using script object templates. |
| Steady Duration | Specify the test duration. The default is 10 minutes. The test stops automatically after the duration you specify. |
| Stopping Status in Second | The maximum time out in seconds allotted for FortiTester to close all TCP connections after the test finishes. |
|
DNS Host Group |
Select the DNS host group to look up the IP address of a domain name. To create a DNS host group, see Creating DNS host group. |
|
DUT Monitor |
Select to monitor a FortiGate device under test (DUT). If selected, you can monitor the DUT from the DUT Monitor tab on the management interface. To create a DUT monitoring, see Using DUT monitoring. |
| Network Settings If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings. |
|
| Load | |
| DDoS Type | |
|
Packet Config |
Default—DDoS attack traffic: Single Packet Flood. After you select a type, selection boxes for subtypes are displayed below. To change the percentage mix of subtypes, double-click the pie chart and adjust the percentages. |
|
Packet Group |
Advanced—This object represents one network packet. The user uses a Single Packet group to specify the packet types and percentages rather than select from a list of existing DDoS types (as in the "default" case). The user will be able to configure the packet details in Security Testing > Objects > Single Packet Group. The specific parameters depend on the packet type, which the user selects when creating the object. The payload contents of the packets will be random (excluding UDP VSE). For all of the packet types (excluding ARP, which is IPv4 only), the user also needs to specify the IP version. See: Single Packet Group. |
| Client Profile | |
| Source Port Range | Specify a client port range. The valid range is 10,000 to 65,535, which is also the default. |
| IP Change Algorithm/Port Change Algorithm | Select a change algorithm: Increment or Random. This setting determines how the system changes source/destination IP addresses and ports to simulate multiple client requests. The Increment option uses the next IP address or port in the range, for example: 10.11.12.1 -> 10.11.12.2; port 10000 -> 10001. The Random option selects an IP address or port in the range randomly. |
| Server Profile | |
| Case Server Port | The server port where the test case traffic arrives. |
| Client/Server Network | |
| Network MTU | The maximum transmission unit size. |
| IP Option DSCP | Provide quality of service (QoS). |
| Client Limit | |
| Bandwidth | Bandwidth in Mbps. The default is 0, which means the device will send traffic as fast as possible. |
| Server Limit | |
| Bandwidth | Bandwidth in Mbps. The default is 0, which means the device will send traffic as fast as possible. |