Ixia traffic test (Ethernet load)

[echelon360]

Hi,

Can someone with ixia experience pls advice how best to perform this test?

Attached is the test setup.

I'm trying to use ixia to generate packets to flood the ethernet module of the router.

-should i have each of the 3750<>2811 ports be setup with individual vlans?

-how do i define a closed loop traffic from an ixia perspective. If i were to use port 6/4, how do i configure ixia to treat this port as "closed traffic port"

[Giuseppe Larosa]

Hello Clive,

if the link connecting to IXIA port 6/4 is a routed port on 2811 you are going to measure the L3 performances of 2811 that is not able to support a GE port full rate.

if that link is on the switching module you have a chance to test it.

About your questions:

1) -should i have each of the 3750<>2811 ports be setup with individual vlans?

if you make every port member of a different vlan you have control on how traffic is sent over the links.

You can use specific static routes to send traffic to specific destinations over a specific link.

2) from the point of view of IXIA you define multiple flows with different source and destination. belonging to a subnet.

You can use two /24 on each link port6/3 can be 192.168.3.0/24

port 6/4 can use 192.168.4.0/24.

middle links can use /30 subnets from 192.168.0.0/24

you can use static routes of type 192.168.4.x with mask 255.255.255.248 so that groups of addresses use one specific link on C3750

the same in opposite direction

192.168.3.x with mask 255.255.255.248 so that groups of addresses use one specific link on the C2811.

Defining the same number of flows allow you to load the links in a fair manner.

Hope to help

Giuseppe

[echelon360]

thanks Giuseppe!

How can i improve this setup on port 6/4. Have this port connect to another port of the 3750 as well?

I will need to test out ACL limitations on the 2811 ethernet module and hence, i believe i will need to have each of the 9 port on an individual vlan then configure respective SVI to allow for the ACLs.

Pls let me know your thoughts.

[Giuseppe Larosa]

Hello Clive,

if your target is to verify the added load of ACLs on the 2811 I would do the following:

using the approach suggested in my first post fix an aggregate traffic load for all traffic flows.

Then, have an ACL applied inbound on interface towards IXIA port 6/4 (or on the SVIs for the9 point-to-point links).

Repeat the test using a different ACL:

first test: traffic matches first lines of ACL#1

second test: traffic matches lines after line 10 in new ACL#2

third test: traffic matches lines after 100 lines in ACL#3.

Being the aggregate traffic the same the additional cpu load you see during tests 2 and 3 are for the ACL.

Eventually do all this again with another aggregate traffic level

In this way you can characterize ACL impact on router.

We did so on C7500 some years ago

Hope to help

Giuseppe

[echelon360]

Thanks Giuseppe!

I have updated the test topology and included what i think will ensure tests for ethernet module stress test and ACL limitations. Pls let me know your thoughts

Ethernet Module

example port 1

ixia (6/4)

------

(192.168.4.0/24)

define stream on 6/4

>destination ip as 192.168.3.1

C3750

-----

-configure routed port connecting to 2811

>ip add:192.168.100.1

-static route

>ip route 192.168.3.1 255.255.255.255 192.168.100.2

2811

----

-create SVI 100 (connection bet 2811 and C3750)

>int vlan 100 (192.168.100.2)

-static route

>ip route 192.168.4.1 255.255.255.255 192168.100.1

ixia (6/3)

----------

(192.168.3.0/24)

define stream

-destination ip as 192.168.4.1

**i'm not sure if the Fa0/0 of the 2811 back to Ixia would pose as a bottleneck.

ACL Test

--------

i will need to specify ACLs on a per SVI basis. Hence, i would need to setup additional static routes to point traffic to an SVI then onto the Ixia subnet to provide for data traffic. Then include ACLs deny statements to match this traffic. Would this approach be suitable?

Pls let me know your thoughts

[Giuseppe Larosa · Accepted solution]

Hello Clive,

for testing purposes it is better to have permit statements in the ACLs so that packet losses can be seen as a sign of performance troubles.

As I wrote we did in this way and the position of the permit statement that matches has an effect on the cpu usage.

You can also use deny statements but this means that you would see 100% packet loss in any case.

Hope to help

Giuseppe

[echelon360]

thanks Giuseppe!