Fireperf: Open-Source Tool for Stress-Testing Firewalls and Routers
The IPFire project has released fireperf, a new open-source tool designed to measure how network devices handle a high volume of connections, offering a distinct approach from traditional bandwidth testers.
The IPFire project has introduced fireperf, a novel open-source measurement tool engineered to rigorously test the connection-handling capabilities of firewalls, routers, and other stateful network devices. Unlike bandwidth testers like iperf3, which focus on data throughput between two points, fireperf is designed to simulate the real-world demands placed on network infrastructure by opening connections at a fixed rate and meticulously logging the outcome for each.
This tool provides administrators, developers, and testers with critical insights into device performance under load. It records the duration of each connection handshake and, crucially, logs the reasons for any failures, such as timeouts, connection refusals, or resource exhaustion on the testing machine. This granular detail is essential for identifying bottlenecks and potential weaknesses that might not be apparent during standard throughput tests.
Beyond simply opening and closing connections, fireperf can also maintain them for extended periods, allowing administrators to assess how effectively a firewall manages idle states. This is vital because a device might perform well in terms of raw throughput but still struggle with state table management, leading to performance degradation or unexpected failures over time.
Rico Hoppe, the creator of fireperf, explained that the project originated from a need to address limitations encountered with existing tools like iperf/iperf3 when attempting to generate sufficient traffic for comprehensive testing. The fundamental design of fireperf is event-loop based, a departure from the architecture of many other network testing utilities, which presented unique development challenges.
A key differentiator of fireperf is its server architecture, which can handle numerous clients simultaneously on a single port, each running its own independent test. This contrasts with iperf3's limitation of handling one test at a time. Furthermore, fireperf supports simulating various request-response patterns, such as a small request followed by a larger response, mimicking real-world application traffic more closely.
The tool is versatile, capable of interacting with iperf3 and iperf servers, and iperf3 clients can even test against a fireperf server. It offers flexible output options, including a live graph in a terminal, line-by-line logging, or JSON output for programmatic analysis. Hoppe emphasized that the tool is specifically built for "testing your infrastructure" by subjecting firewalls to significant load, not just in terms of packet volume but also through the creation of a large number of short-lived connections, which can stress Intrusion Prevention Systems (IPS) to their limits.
Signed packages for fireperf are available for popular Linux distributions including Debian, Arch Linux, RHEL and its derivatives (AlmaLinux, Rocky Linux), and openSUSE Tumbleweed. The source code is publicly accessible on the project's page. Building from source requires a C compiler, Autotools, pkg-config, ncursesw, gettext, and intltool, with liburing 2.3 or later being optional but recommended for enhanced performance.