Tomahawk is a command line tool for testing network-based intrusion prevention systems (NIPS). To date, the tools for testing NIPS have been expensive and limited in functionality. They are typically designed for testing other products, such as switches (e.g., SmartBits/ IXIA), server infrastructure (e.g., WebAvalanche), or Firewalls and Intrusion Detection Systems (Firewall Informer or IDS Informer). None of these tools simulate the harsh environment of real networks under attacks.
Tomahawk is designed to fill this gap. It can be used to test the throughput and blocking capabilities of network-based intrusion prevention systems (NIPS).
The throughput of many NIPSs is highly dependent on the protocol mix. A NIPS must reassemble and inspect application level data encapsulated in network traffic. It must decode network and application level protocols. Since some protocols are more computationally intensive to decode than others, the effect a NIPS has on network performance can be highly dependent on the protocol mix that must flow through the NIPS.
Tomahawk can test the throughput of a NIPS using the most realistic mix of protocols possible: one obtained by taking a sample of traffic from the network and replaying it. A single Tomahawk server can generate 200-450 Mbps of traffic. By using multiple servers and aggregating the traffic through a switch, 1 Gbps or more of traffic can be replayed through the NIPS.
Tomahawk can also test the connections/second rating of a NIPS. By capturing a packet trace that contains a simple connection setup and teardown (6 packets: SYN, SYN_ACK, ACK, FIN_ACK, FIN_ACK, ACK) and replaying the traffic using Tomahawk, a single PC can generate 25-50 thousand connections/second of network traffic. With 3 inexpensive PCs, about 90K connections/sec can be generated, enough to test the limits of any NIPS.
In addition to throughput testing, Tomahawk can test the blocking capabilities of a NIPS by replaying attacks embedded in packet traces. Tomahawk reports if an attack completes or is blocked, allowing independent verification of the attack blocking capabilities in a NIPS.
By replaying the same attack hundreds of times, Tomahawk can also test how reliably a NIPS blocks an attack. A NIPS that blocks an attack only 9 in 10 times is not worth much in a worm outbreak.
Tomahawk compiles under RedHat 7.* and later. We recommend a 1.4 GHz + Pentium with at least 512 MB and 3 NICs, 2 of wich are Gigabit NICs.
To compile Tomahawk, you'll need to get Libnet 1.02a and Libpcap 0.8.1, as well as the Tomahawk source:
For your convenience, the following binaries are available:
We welcome enhancements to Tomahawk. While it is managable, I'll coordinate the enhancements manually. Please email me patches and other enhancements. If this becomes unmanageable, we'll start using CVS to manage the project.