<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7233.48">
<TITLE>RE: [strongSwan-dev] load-tester plugin modification</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi Martin,<BR>
<BR>
> All application data is processed by the kernel, and any tool can be<BR>
> used to generated this traffic.<BR>
<BR>
> You'd have to generate the traffic that matches an existing IPsec<BR>
> connection. This can be done in the load-tester plugin, or in a<BR>
> dedicated tool.<BR>
<BR>
> What's wrong with using iperf or a similar tool to test your IPsec<BR>
> tunnel?<BR>
<BR>
So you mean that I can use the load tester to establish a number of tunnels and then generate traffic (i.e. pings) for each of these tunnels with iperf?<BR>
I thought that this is not supported by load-tester plugin.<BR>
<BR>
What I want to test is a lot of tunnels with traffic to a particular gateway.<BR>
<BR>
Regards,<BR>
Jerry<BR>
<BR>
-----Original Message-----<BR>
From: Martin Willi [<A HREF="mailto:martin@strongswan.org">mailto:martin@strongswan.org</A>]<BR>
Sent: Fri 29-Jul-11 13:16<BR>
To: Gerry Travlos<BR>
Cc: dev@lists.strongswan.org<BR>
Subject: Re: [strongSwan-dev] load-tester plugin modification<BR>
<BR>
Hi,<BR>
><BR>
> 1) Which is the main missing functionality that restricts load-tester<BR>
> from taking traffic?<BR>
<BR>
The load-tester plugin currently generates IKEv2 protocol exchanges,<BR>
mainly to test the daemon itself. It can simulate many clients, but only<BR>
the key exchange part.<BR>
<BR>
All application data is processed by the kernel, and any tool can be<BR>
used to generated this traffic. You can extend the load tester by<BR>
generating traffic to process by the kernel, but it won't have much in<BR>
common with the existing load-tester functionality.<BR>
><BR>
> 2) Is load-tester plugin the only part of the code that needs to be<BR>
> modified? Or should I look elsewhere as well?<BR>
<BR>
You'd have to generate the traffic that matches an existing IPsec<BR>
connection. This can be done in the load-tester plugin, or in a<BR>
dedicated tool.<BR>
><BR>
> 3) Am I after big and many changes or something trivial?<BR>
<BR>
Generating traffic is probably not that difficult, but it depends on<BR>
what you actually want to test.<BR>
><BR>
> 4) I've seen revision 015c1568: "Don't simulate traffic on load-tester<BR>
> kernel interface". Is this correction made in order not to allow<BR>
> traffic simulation?<BR>
<BR>
No. The load-tester can use a "faked" kernel interface stub, so that the<BR>
negotiated IPsec SAs won't get installed to the system. This is useful<BR>
in the load-tester if many identical tunnels get established that would<BR>
conflict in the kernel. This fix just changes the behavior of this stub.<BR>
><BR>
> 5) Something else that I should take into account?<BR>
<BR>
What's wrong with using iperf or a similar tool to test your IPsec<BR>
tunnel?<BR>
<BR>
Regards<BR>
Martin<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>