Common tasks

Each of these is a complete command. Change the interface and the destination, and you’re running. Every example here is transmit-only, which is safe on a live box: nothing is taken away from the kernel. Where a receiver is involved, that’s called out.

Find the packet rate of a link

The classic small-frame test. 64-byte frames are the hardest thing a NIC does, so this is the number that tells you what your hardware is really worth.

sudo wireblast -i eno2 --dst-ip 192.0.2.10 \
  --packet-size 64 --pps unlimited -d 30s

10G line rate with 64-byte frames is 14.88 Mpps. If you’re well under that, finding your max rate walks through whether it’s your CPU, your driver or the path.

Start with a limit rather than unlimited if the interface carries anything you care about, then press + to ramp up while you watch. Wireblast will make you confirm an unlimited run on a default-route interface.

This measures the send rate, which is what you want here. A single flow reaches line rate because Wireblast fans it out across every transmit queue, so one flow is enough to saturate the NIC. Flow diversity only matters on the receive side: RSS hashes a single flow onto one queue, so a receiver counting a single flow tops out at one core’s worth of packets. If you want to verify the rate end to end on a second box, add --flows 100 --vary-dst-port so the receiver spreads across queues. See transmit and receive.

Fill a link with big frames

The opposite end. Large frames are easy on packet rate, so this measures bits rather than packets.

sudo wireblast -i eno2 --dst-ip 192.0.2.10 \
  --packet-size 1518 --bps 10G -d 30s

--bps is measured in L1, so --bps 10G means 10G line rate.

Run an IMIX test

A realistic mix of frame sizes rather than one artificial size. The classic 7:4:1 spread of 64, 594 and 1518-byte frames, averaging 362 bytes.

sudo wireblast -i eno2 --dst-ip 192.0.2.10 --mode imix \
  --flows 64 --pps 200k -d 30s

Real output:

[0:05] tx 949.81 k pkts  200 kpps  L1 610.96 Mbit/s  L2 578.96 Mbit/s  avg 362B

ran for 0:12
  tx: 2.4 M packets, 868.24 MB, 199.86 kpps, L1 610.52 Mbit/s, L2 578.54 Mbit/s, avg frame 362B

avg frame 362B is the confirmation that the mix came out right. To find the IMIX ceiling instead of running at a fixed rate, swap --pps 200k for --pps unlimited.

Replay a capture

Put real traffic back on the wire, frame for frame.

sudo wireblast -i eno2 --pcap capture.pcap --pps 100k -d 60s

By default the capture loops until the duration expires, and the pace comes from --pps. To reproduce the capture’s own timing instead:

sudo wireblast -i eno2 --pcap capture.pcap \
  --pcap-timing original --pcap-loop=false

Don’t have a capture handy? Make one:

sudo tcpdump -ni eno2 -c 1000 -w /tmp/sample.pcap

Exercise ECMP, LAG or RSS hashing

One flow only ever takes one path. To spread across a bundle, generate many flows.

sudo wireblast -i eno2 --dst-ip 192.0.2.10 \
  --flows 10000 --vary-dst-port --flow-order random \
  --packet-size 512 --pps 1M -d 60s

--vary-dst-port moves both ports per flow, which widens the hash space. --flow-order random scatters them so consecutive packets land on different tuples. To spread destination addresses too, give a CIDR:

sudo wireblast -i eno2 --dst-ip 10.0.0.0/24 --flows 254 --pps 1M -d 60s

Stress a firewall or load balancer’s connection table

Stateless SYNs, many flows, no handshake.

sudo wireblast -i eno2 --dst-ip 192.0.2.10 --mode tcp-syn \
  --dst-port 443 --flows 100000 --pps 2M -d 60s

This is a SYN flood. Only point it at something you own and have permission to test.

Test a switch’s VLAN handling

sudo wireblast -i eno2 --vlan 100 --dst-ip 192.0.2.10 \
  --packet-size 68 --pps 1M -d 30s

Two things to know: bind the physical NIC and let Wireblast build the tag, and the smallest tagged frame is 68 bytes rather than 64. VLAN-tagged traffic explains both.

Send IPv6 traffic

Give Wireblast an IPv6 source and destination and it builds IPv6 frames. UDP, TCP SYN, IMIX, raw and PCAP all work over v6, and so do flows and CIDR cycling.

sudo wireblast -i eno2 --src-ip 2001:db8::1 --dst-ip 2001:db8::2 \
  --packet-size 100 --pps 1M -d 30s

Next-hop resolution uses IPv6 neighbour discovery (NDP) exactly as the IPv4 path uses ARP. The smallest frame is a little larger than IPv4, 66 bytes for UDP and 78 for TCP (add 4 with a VLAN tag), because the IPv6 header is 40 bytes and its UDP checksum is mandatory. To cycle destinations across a prefix:

sudo wireblast -i eno2 --dst-ip 2001:db8::/64 --flows 1000 \
  --dst-mac 3c:ec:ef:b4:c2:dc --pps 1M -d 30s

Unlike IPv4 there is no network or broadcast address to skip, so every address in the prefix is used. On the receive side, the address-based filters (cidr, generated-flow, keep-management, all) work for IPv6; the port filters (udp-port, tcp-port) are still IPv4 only.

Send raw Ethernet with no IP at all

For testing switches, tag handling, or anything that shouldn’t care what’s inside the frame.

sudo wireblast -i eno2 --mode raw --ethertype 0x88b5 \
  --dst-mac 3c:ec:ef:b4:c2:dc --packet-size 128 --pps 1M -d 30s

--dst-mac is required here. Raw frames carry no IP addresses, so there’s nothing to resolve a next hop from.

Count what arrives on a box

Turn a machine into a sink. This one does take packets from the kernel, so read transmit and receive first and use an interface you aren’t logged in over.

sudo wireblast -i eno2 --mode receive \
  --rx-mode udp-port --rx-port 9000 -d 60s

Pair it with a sender on another box for a full end-to-end check. See the two-box test.

Run it from a script

No wizard, no dashboard, plain text on stdout.

sudo wireblast --no-tui -i eno2 --dst-ip 192.0.2.10 \
  --packet-size 512 --pps 1M -d 30s -y

Exit code 0 on success, 1 on error, with the reason on stderr. Scripting and automation covers parsing the output and running unattended.

Soak test a link overnight

sudo nohup wireblast --no-tui -i eno2 --dst-ip 192.0.2.10 \
  --mode imix --pps 500k -d 28800s -y > /var/log/wireblast.log 2>&1 &

kill on that PID gives you a clean summary rather than a truncated log, because Wireblast drains its rings and detaches before exiting.

Try any of this with no hardware

Every recipe above works across a veth pair, at whatever rate your CPU manages. Build one in about four commands with the namespace lab.

More examples

The repository ships a numbered set of runnable examples, each with its own README and a run.sh you can execute directly, from a first run through line-rate tuning, IMIX, PCAP replay, VLAN tags and IPv6.

Examples on GitHub

001 through 023, including 022-ipv6-udp and 023-ipv6-flows for IPv6.

Getting started

Concepts

Traffic patterns

Guides

Reference

Find the packet rate of a link

Fill a link with big frames

Run an IMIX test

Replay a capture

Exercise ECMP, LAG or RSS hashing

Stress a firewall or load balancer’s connection table

Test a switch’s VLAN handling

Send IPv6 traffic

Send raw Ethernet with no IP at all

Count what arrives on a box

Run it from a script

Soak test a link overnight

Try any of this with no hardware

More examples

Examples on GitHub

​Find the packet rate of a link

​Fill a link with big frames

​Run an IMIX test

​Replay a capture

​Exercise ECMP, LAG or RSS hashing

​Stress a firewall or load balancer’s connection table

​Test a switch’s VLAN handling

​Send IPv6 traffic

​Send raw Ethernet with no IP at all

​Count what arrives on a box

​Run it from a script

​Soak test a link overnight

​Try any of this with no hardware

​More examples

Examples on GitHub

Find the packet rate of a link

Fill a link with big frames

Run an IMIX test

Replay a capture

Exercise ECMP, LAG or RSS hashing

Stress a firewall or load balancer’s connection table

Test a switch’s VLAN handling

Send IPv6 traffic

Send raw Ethernet with no IP at all

Count what arrives on a box

Run it from a script

Soak test a link overnight

Try any of this with no hardware

More examples