The Lite Data Message Flow window is used to define/edit Lite DMFs and Studio Scenarios converted into Lite DMFs. The Lite DMF format provides a simplified way to create and display a vast majority of data flows used for L4-L7 DPI testing (on Landslide).
NOTE: You may define a maximum of 20 Network Hosts per test case, which supports multiple different DMFs/connections within the same test case going to the same network host and Port combination |
The Lite DMF allows you to define transaction behavior, rates, throughput, sequence of messages over multiple sockets/connections and various message options. The Lite Data Message Flow window provides a quick view of the number of connections/5-tuples involved in each Lite DMF and calculates total bandwidth.
The following highlights the differences between a Lite DMF and a regular DMF
Lite DMF |
DMF |
Message flows from different connections (UDP, TCP etc) within the Lite DMF are sequential. |
Message sequence on are potentially concurrent. (In addition, the DMF has more settings and options available for your selection.) |
All the connections are defined within the same Lite DMF as ordered flows/connections. |
Each connection is defined in a new subflow. |
Studio Scenarios are pre-made/defined Lite DMFs that have been generated from different Apps, different OSs, and may include vulnerabilities and attacks. The Studio scenarios are played over real TCP/UDP sessions and simulate both ends of an application for Firewalls and DPI engines.
Studio Scenarios available for selection as Lite DMFs are based on system licensing. These Scenarios are categorized into groups and included in the Landslide libraries based upon their group and licenses. A small subset sampler of Studio App flows are included regardless of licensing in the basic library. The remaining Apps, vulnerabilities and attacks are located in separate licensed libraries.
The group of scenarios (folders/libraries) displayed depends on your system license. You may run the Studio Scenarios as is or edit them to add more messages, connections, etc, and save them.
NOTE: Landslide integrates many of these Scenarios for hundreds of Applications (Apps). (New Scenarios and Apps are provided with each new Landslide release). (Additional Licenses (groups) may be added in the future releases.) |
|
|
On Handover to Target Network | |
|
Use the drop-down list to define the number of times a transaction is executed after data traffic begins (when Data Start Delay expires after the MN session is established). A transaction can consist of an entire message flow or a subset of a message flow defined as a transaction loop. Options:
Default: Continuous When you use a transaction loop in a message flow with a limited number of transactions, the entire message flow is executed once, and the transaction loop is executed for the number of iterations you define. When you use a transaction loop with continuous transactions, the commands prior to the loop are executed once and the commands in the transaction loop are then continuously executed. Transaction Rate defines the number of times the loop is executed every second.
Related Measurements |
|
Transaction Rate (trans/s) |
The timing of the initial execution of the message flow is defined by the Traffic Start and Data Start Delay defined on the Data Traffic tab of the test case. Transaction Rate defines the number of times the test will attempt to execute the transaction every second in each of the MN sessions (see Transactions for the definition of a transaction). A separate timer is kept for every MN session, and if more than one transaction is executed, the message flow is serially executed in each session under the control of that session's timer. Range: Any value greater than 0. You can enter a fractional value to spread the message flow over a number of seconds: a rate of 0.5, for example, executes the transaction every two seconds. Default: 1.0 Transaction TimersTransactions can be timed to 1 millisecond granularity. The maximum consistent rate, therefore, is 1000 transactions/second (1000/1000 = 1 ms). While the test server may be able to handle a faster rate, depending on the resultant total bps and pps for the test considering the number of sessions and the packet size, the transaction timers will not be evenly distributed and the throughput may vary slightly between test intervals. If you are attempting to configure a Basic Data model that results in a specific bps or pps throughput, your Transaction Rate must result in a transaction interval (the number of milliseconds between transactions) that is divisible by 10 milliseconds in order for the transactions to be timed consistently. You can calculate the transaction interval manually with the following formula: Tinterval = 1000/Trate. Alternatively, you can click the Calculate button to display each MN session's bps rate, calculated from the defined Transaction Rate and Packet Size. The transaction interval is also calculated at that time and if your derived transaction interval is not optimal, you will be notified and prompted to accept an adjusted rate that conforms with the timer granularity. |
|
Throughput (bits/s) |
The bps rate of the payload portion of the data packets as defined by the Transaction Rate is displayed in Throughput when you click the Calculate button.
|
|
Calculate |
Define Transaction Rate, and click Calculate to determine the total throughput bits/second. As of Release 16.8, added Target Network Transaction Rate, Total Target Throughput (bits/s), Target Tx and Target Rx.
Related MeasurementsThe number of packets, command messages, and bytes sent by the Network Host and received by the MN reported on the Data Traffic and Network Host tabs will increase as this value is increased. |
|
Tx/Rx Ratio |
The fields will always show the left most digits after a calculation is done. Also, the Throughput values (overal, Tx, Rx) are rounded to the nearest .1 bits/s. |
|
Start Paused |
Select to start the Lite DMFs in the paused state. |
|
Total Retries |
The maximum number of attempts made by the client or server to send a request message after the Data Response Time has expired. Range: N/A Default: 5 |
Define transport layer connection elements. You may define each connection or flow within the Lite DMF in a separate row as a unique combination of Transport type, Source port, Destination Host and Destination Port. You can Add, Cut, Copy, Paste, Move the connection Up/Down, or Delete as required.
The maximum configured bytes per flow or Connection/5-tuple is 10MB. Configured bytes are the user defined bytes in each message, not including Padding/Content-TDFs/Auto-Fills, etc.
You may define multiple DMFs to use the same Transport, Destination Host, and Destination Port.
For example, the Lite DMF window illustrates using multiple connections going to the same Transport, Destination Host, and Destination Port. The Lite DMF window shows the first 2 connections in the table are TCP and point to Dest Host = 0 and Dest Port = 80, the standard HTTP port. The 3rd connection also uses Dest Host = 0 and Dest Port = 80 but the transport is UDP instead of TCP.
Connections 1 and 2 have the same (Dest Host = 0, Dest Port = 80, Transport = TCP) Triplet.
NOTES:
As long as the first 100 bytes of the message are different from the first message of the other possible connections, the network host will be able to bind to the correct socket. If the first message is less than 100 bytes for any connection, then the first message also cannot be a complete subset of any other connection's first message.
|
First Connection Persistent |
Select to indicate connections are persistent and clear selection to indicate that connections are not persistent. |
||||||||||
# |
Automatically generated when you Add a connection. |
||||||||||
Transport |
Select the transport protocols to be used. Options: tcp, udp |
||||||||||
Source Port |
The port to be used with the source IP address.
You can override this setting at run time and define a different port with the Instances and Assignments settings. Double click to display Edit Source/Client Port window.
|
||||||||||
Dest Host |
Select the Destination Host ID from the list. The Dest Host is the Target/Requested Dest host. |
||||||||||
Dest Port |
Enter the Port (used with the destination IP address) to where the traffic is sent. Default = 80 |
||||||||||
Initiator |
Select to indicate whether the traffic initiator is a Client or a Server. |
||||||||||
TOS/DSCP |
Enter the ToS/DSCP code with which to mark the packets.
Enter 0 for Default Forwarding (best effort) or see the IANA DSCP Registry for Class Selection, Assured Forwarding, and Expedited Forwarding pool values.
|
||||||||||
Segment Size |
When you use any protocol, you can define the maximum number of payload bytes in each packet. If the number of bytes in a message is larger than Segment Size, the message will be divided into the number of messages required to meet the threshold.
Range: 128 — 65535 Default: 1000 |
||||||||||
DNS Query |
Double click and Edit DNS Quesry Configuration window displays. Select DNS Query and enter the IP addresses and Domain Name query. You may also select to query only the first DMF transaction or query each DMF transaction. |
NOTES:
|
Define the order in which to send/receive messages and edit the message content. You can Add, Cut, Copy, Paste, Move the message Up/Down, or Delete as required.
Msg # | Automatically generated when you Add a message/packet. | ||||||
Connections/5-Tuple | Select the Connection type used for the message. The number of Connections available depends on the Connections you added in the Connections/5-Tuples pane on the General Tab. | ||||||
Direction | Select the direction of data from client to server (arrow left to right) or from server to client (arrow right to left). | ||||||
Time (ms) | The time is calculated based on the Send Delay, measured in milliseconds, from the beginning of the stream until the packet is sent. Double-click the cell to edit this field. | ||||||
Delay (ms) |
The delay, measured in milliseconds, from the time the previous packet in the stream was sent. That is, the Delay corresponds to the Send Delay field of a message. Double-click the cell to edit this field. |
||||||
Data |
The first several bytes of data in the packet. Unprintable characters are replaced by a dot (.). You can view/edit the entire packet in the ASCII Editor or HEX Editor. |
||||||
Message Options | |||||||
Verification |
You can direct the receiving entity to validate the integrity of the message by checking Receiving end should verify message and then specifying the First byte to check and Number of bytes to check.
|
||||||
Fill/Padding |
The Fill/Padding pane allows you to select not to include any filler, include automatic padding, enter a Test Data File or Signed Content. Starting Offset represents the insertion/padding start point and is available for both Automatic Padding and Insert Test Data File. The Advanced DMFs and Lite DMFs both support new Message Editor with new "Filler" option for "Signed Content". For Signed content you can Add a Certificate Test Data File, Private Key Test Data File. Select a File Format (either RSA or EVP) and enter the Number of Entries (range: 0 to <= the total entries of certificate files). Use Auto-Fills <Signed_Start>/<Signed_End> to define range, <Cert_Insert> is Optional. All labels and variables have been changed to reflect that we are signing data, not encrypting it. Moved the Cert Insert and Signed Data Offset Range to be pure Auto-Fills. No longer set on the "Filler Panel". Added the URL Encode Auto-Fills, which let you set multiple ranges of URL Encoding. URL Encoding happens last after all other Auto-Fills occur. First pass normal Auto-Fills occur, Second pass Signing Data happens, Third pass URL Encoding happens. Added new usability improvements:
You can provision explicit values for each DMF by using a Test Data File. |
||||||
Auto-Fill Fields |
The Auto-Fill Viewer pane allows you to view the placement of the fields and filler embedded in the content defined on the editing sub-tabs. See the Static and Dynamic content sections for more information on these areas. |
||||||
Editing Sub-tabs | |||||||
|
Whenever your cursor is in a field that specifies a byte offset, a starting byte, or a range of bytes, the applicable byte(s) in the Hex-Ascii and Text Editor sub-tabs are highlighted. The bytes highlighted will dynamically change as you modify parameter values.
|
||||||
Auto-Fill Viewer |
The Auto-Fill Viewer pane allows you to view the placement of the fields and filler embedded in the content defined on the editing sub-tabs. See the Static and Dynamic content sections for more information on these areas. |
||||||
CRLF Viewer |
The CRLF Viewer tab allows you to view the generated CRLF characters, highlighted for ease of reference. For example, the following shows the same message viewed in Auto-Fill Viewer and CRLF Viewer.
|
You can capture any value from one message and insert those bytes into any subsequent messages with the Copy Buffer and Paste Buffer fields. Place a Copy Buffer in a defined message to capture the actual value contained in the message when it is received. Place the corresponding Paste Buffer in any subsequent messages to insert the captured value into the message before it is sent. If a DMF contains subflows, the same Paste Buffer can be used to insert values in the mainflow and any associated subflows.
n |
Ten field types, Copy Buffer 1 through Copy Buffer 10, allow you to capture bytes from a received message. You can specify the bytes to capture in one of two ways:
Buffer ConfigurationWhen you use the copy and paste buffers, you must define each buffer that will be used in the Buffer Fields window. You can optionally set the initial, or default, values and assign names to the buffers and you must set the size. You can choose to use the same initial values for every MN, auto-incrementing values for each MN, or provision different, explicit values for each MN in a Test Data File. Regardless of the provisioning method you choose, these values will be used in the following scenarios:
Click the Paste Buffer Configuration button in the Data Message Flow window... to access the following settings.
|
|
Name |
You can rename the buffers with labels that indicate the type of information that will be captured or inserted. The name is displayed in the field Type drop-down list and the Auto-Fill Viewer sub-tab, preceded by either "Copy_" or "Paste_" depending on the operation to be performed. Range: Up to 15 alphanumeric or underscore (_) characters. Names are not case-sensitive and each name must be unique. Default: Buffer_n |
|
Size |
The maximum number of bytes contained in a buffer. Each buffer includes a terminating null byte, therefore the defined size should equal the number of bytes required for the largest possible value + 1. If the Initial Value provisioned for any buffer exceeds the buffer's size, the test will fail run-time validation and an error will be noted in the Test Log.
Range: 0 — 4095 Default: 0 |
|
Initial Value |
The same value will be used for all MNs unless you use the Legacy Auto-Increment syntax or check the Apply DMF Initialization from Test Data File box and use a file to provision the values. Non-alphanumeric ASCII values and non-ASCII values can be represented with a hexadecimal string. The format is : "0x" leading hexadecimal string (0x#(<hex>) per UE or #(<decimal>). The supported format for hex increment is : 0x#(abcd), where abcd is valid hex digit. No combination with base string is supported. No repeat is supported. For example: "0x0d0a8ff611191ba2be49aa09", 2 hex characters represent 1 byte hex value, the CR-LF pair is represented as "0d0a". Will accept up to 4095 ASCII characters in the field based on max buffer size of 4095 bytes. The validation will attempt to prevent using an initial value > size of buffer. If using auto-increment syntax, e.g. #(23232), validation will subtract 3 characters from the length to account for # ( and ) characters. You can obtain a sample Test Data File from your Technical Support representative. See Parameter Features for more information on provisioning parameters with Test Data Files. |
NOTE: You are allowed to paste copied buffers/information between licensed Scenario Lite DMFs. You cannot copy from a licensed scenario Lite DMF into a non-Licensed Scenario Lite DMF or a different group of licensed Scenario Lite DMFs. |
NOTES:
|
Convert To aDMF (advanced DMF) |
Allows you to save a copy of the Lite DMF to an Advanced DMF. You may also convert an imported PCAP file to an Advanced DMF by importing PCAP to Lite DMF, then saving it as an Advanced DMF. Click Convert To aDMF. A Save Converted Advanced DMF in UserDirectory (your default user directory) window opens. Navigate to the required directory, enter a name, and save the converted file.
|
NOTE: If you are licensed, you may Import Studio XML files. The Lite DMF editor allows you to import the Landslide-ready XML generated by Studio Scenarios. This option is available to systems with appropriate license key. Any Lite DMF created by importing Studio XML, is assigned to the Scenario Group Import and associated with the relevant license key. |
Studio Scenarios are multi-protocol message exchanges that recreate specific situations (such as login authentication, streaming video, or VoIP communications) on a network. A list of Studio, Scenarios in the system, include:
Application Scenarios |
Contain traffic for network activity such as VoIP phone calls, Facebook status updates, or movies streamed over the Internet. Use these Scenarios to test how network devices handle specific applications and enforce policies on that traffic. |
Attack Scenarios |
Contain traffic with vulnerability signatures for known attacks. Use these Scenarios to test how your intrusion detection and/or prevention devices and software applications recognize known exploits—and how well those devices and applications are protecting your network from known attacks. |