JP3427964B2 - Router test apparatus and method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a device for conducting a test of opening a router for delivering and relaying data on a network such as a LAN or WAN. In particular, it relates to a device for confirming delivery control based on router settings.

In a conventional router opening test, after setting a router, data is sent from a host on a network connected to the interface means of the router, and a host on another network confirms whether or not the data is received. The filtering and the routing are inspected by sending out the data from the host on the other network and checking whether the host on the network connected to the router has received the data. At this time, the inspector arbitrarily selects the destination of the data, the type of the data, etc. to perform the inspection.

[0003]

However, even if the inspection is completed normally, due to the omission of the inspection, in the transmission / reception in the network or the host other than the inspection target host arbitrarily selected by the inspector, the intended result in the router setting is not obtained. Sometimes you can't get it. This may cause security problems. Further, it takes a considerable amount of time and operation to check that all the set items are operating as intended by the setter.

An object of the present invention is to provide a router test apparatus and method capable of preventing inspection omissions due to setting mistakes, malfunctions, etc., and ensuring security and reducing the time and labor required for inspection. .

[0005]

A router test apparatus according to the present invention is a router test apparatus for performing a communication test of a router for relaying data delivery on a network such as a LAN and a WAN. Data input means for respectively inputting route information which is setting information to the router, filtering information, and network information corresponding to the network interface of the router under test, and filtering information inputted from the data input means,
For each set consisting of the network address or IP address and port number of each start point / end point, replace the start point or end point with the start point or end point of another set, or combine any values not included in the start point / end point. To generate a filtering test item, generate a routing test item from the destination network address or IP address and the destination router IP address in the route information input from the data input means, and input from the data input means. Test item generating means for generating a routing test item from the network interface and network address in the network information corresponding to the network interface of the tested router under test, and the filtering test item generated by the test item generating means. And Rute If the test items are received and the addresses in these test items are network addresses, the test items are expanded into some IP addresses in the network and the IP addresses of the adjacent networks, and the addresses in the test items are In the case of one IP address, the IP address is expanded to an adjacent IP address, and when the address or port number in the test item is not a single address or a single port by full or partial designation, When the test item is expanded to an arbitrary value within the specified range and the test item includes a port number, the test item is expanded to the adjacent port number, and the test item is expanded to a specific IP address or port. The number is expanded and a test packet is sent to the interface unit based on the expanded address, and the sent packet is sent to the router under test. Test control means for monitoring which network interface is returned, result display means for displaying the test result obtained by the test control means, and a plurality of one-to-one connected to the network interface of the router under test. And an interface section having interface means of.

In the present invention, a router (relay device) that handles TCP / IP and other routable protocols is subject to inspection of delivery routes, filtering, etc. for each protocol. Setting data for route information, filtering information, and network information connected to the router is input from the data input means.

The data input means for this purpose inputs data relating to the setting of the router in an arbitrary format, analyzes the data using an analysis template according to the data input format, and extracts the setting information of the router. Can be configured to. For example, the data may be the setting file itself set in the router. Further, when the analysis template defining the input format of the setting data is not included in the apparatus in advance, the analysis template can be input from the data input means.

The present invention further provides a router test method for carrying out an open test of a router for relaying data delivery on a network such as LAN, WAN, etc., wherein the method is route information which is setting information for the router under test. , A step of inputting filtering information and network information corresponding to the network interface of the router under test, and a starting point in the input filtering information.
For each group consisting of the network address or IP address and port number of each end point, the start point or end point is replaced with the start point or end point of another set, or filtering is performed by arbitrarily combining the values not included in the start point and end point. A step of generating a test item, a step of generating a routing test item from the destination network address or IP address and the destination router IP address in the input route information, and the input network interface of the router under test The step of generating a routing test item also from the network interface and the network address in the network information corresponding to the above, and the generated filtering test item and routing test item In the case of less is, IP network and the adjacent several IP addresses in the network
If the address in the test item is a single IP address, the address and port numbers in the test item are all specified / partial. If it is not a single address or a single port specified, it is expanded to an arbitrary value within the specified range, and if the test item contains a port number, it is expanded to the port number and the adjacent port number. In this way, the step of expanding the test item into a specific IP address or port number, and sending a test packet to the interface unit based on the expanded address, and the sent packet is a network interface in the router under test. To see if they come back from
And a step of displaying a test result obtained by sending and monitoring the test packet.

The test item generating means generates a test item for the router from the input information such as the route information, the filtering information and the network information of the setting data passed from the data inputting means. In this case, the data input means
By using the analysis template in which the setting format information of the setting data is written, the route information, the filtering information, the network information, etc. can be extracted from the setting data and passed to the test item generating means. When the setting data is in the format of the setting file input to the router, the analysis template is the format information of the setting file of the router.

In the test control means, the test data is sent to the interface section according to the test item, and the test data is output from the interface means one by one in the interface section, and the data is sent to each network interface of the router connected to the interface means. Send out. At this time, a specific data string indicating the test data is included in the test data.

At this time, the interface section of the router test apparatus takes in all the output data output by the router from all the interface means, analyzes the output data by the test control means, and specifies the test data as specific data. If the data includes a data string, the output interface means, routing destination, presence / absence of error, delay time, etc. are inspected and the inspection result is accumulated.

Further, in the interface section, by using the information of the connected interface means and the corresponding network information, a part of a host or another router on the network to which the router is connected is emulated. It is possible to enable the data transmission of. Further, in the test control means, the inspection item and the inspection result are collated and integrated as the test result. The result display means displays the test result.

In the present invention as described above, LAN, W
In routers used on networks such as AN,
The relay route information, filtering information, etc. can be automatically inspected, and security holes due to setting mistakes, malfunctions, etc. can be reliably found. In this case, by automatically generating the inspection items, it is possible to reduce the operation of the inspector and further prevent the inspection by the inspector.

Further, by using the analysis template for analyzing the setting data, it becomes possible to input the setting data set in the router as it is, the setting information can be accurately grasped, and accurate inspection items without waste. Can be generated, and the labor of generating the input information to the inspection device can be saved.

Further, by directly connecting the interface unit to the router, it is possible to perform a test before the router actually operates. Also, by connecting the interface unit to the network connected to the network interface unit of the router, it is possible to perform a test while the router is in operation, and to perform a test of route information that dynamically changes during operation. .

[0016]

BEST MODE FOR CARRYING OUT THE INVENTION The present invention tests a delivery function of a router for relaying a routable protocol used in LAN, WAN, etc., and a relay function such as filtering, and the protocol is TCP / IP, IPX,
Alternatively, although other protocols and the like are arbitrary, in the following description of the embodiments, the test of the TCP / IP relay function will be described as an example. Embodiments of the present invention will be described below with reference to the drawings.

[Embodiment 1] FIG. 1 is a block diagram showing an embodiment of the router test apparatus 1 of the present invention. The data input means 11, the test item generation means 12, the interface section 13, the test control means 14 and The result display means 15 is provided. In this embodiment, the interface units It1 to Itn of the interface unit 13 of the router test apparatus 1 of the present invention are replaced by all the network interfaces Ir1 to Ir1 of the router 2 to be tested.
Connect directly to Irn. Next, a processing flow of the embodiment will be described with reference to the flowchart of FIG.

Step S11 is a step of inputting setting data by the data input means 11. The data input means 11 is a keyboard, LAN, floppy disk, or other input device. The setting data is route information R, filtering information F set in the router, and network information I. Further, the setting data input from the data input means 11 is information serving as a clue for generating the test item by the test item generating means 12. The network information I is also used by the interface unit 13 to simulate hosts and routers connected to the network.

In TCP / IP, the route information R is
The destination address Rs (network address Rsn / net mask Rsm or IP address Rsi) and the destination address Rd (IP address of a router or the like) are defined, and the filtering information F is the protocol Fp on the IP.
And the start point address Fs (network address Fsn / net mask Fsm or IP address Fsi, port number Fs
p) and the end point address Fd (network address Fdn /
Net mask Fdm or IP address Fdi, port number F
The network information I is defined by a combination of the network interface Ir of the router, the network address In, the net mask Im, and the IP address Ia of the network interface.

Step S12 is a step in which the test item generating means 12 generates a test item. When the route information R, the filtering information F, and the network information I are input from the data input unit 11, the test item generating unit 12 generates a test item according to the flow shown in FIG. The test item is generated by generating a test item for filtering (step S10).
1) and generation of test items for routing (step S103)
And 2 generation processes are performed separately.

The test item generation step for filtering in step S101 is generated and executed prior to the test item generation for routing. This is to prevent the routing test from being invalidated by filtering the routing test items. Any algorithm may be applied to generate test items for filtering and routing.

Next, an example of an algorithm for generating a test item for filtering will be described. In the test item generation of filtering in TCP / IP, the filtering information F
IP protocol Fp and source address F
s (network address Fsn / net mask Fsm or IP address Fsi, port number Fsp) and end point address Fd (network address Fdn / net mask Fdm or IP address Fdi, port number Fdp) are used.
For each set of filtering information F (Nth set is FN (FpN,
The test item FTN is generated for FsN, FdN).

The test item FTN is a protocol F over IP.
Test item FTNn (FpN, FsN, FdN) in which pN, start point address FsN and end point address FdN are combined as they are, and test item FT in which the start point address is replaced with another value and combined.
Ns (FpN, FTsN, FdN) and test item FTNd (FpN, FsN, FT) which is combined by replacing the end point address with another value.
It is generated as a test item FTNz (FpN, FTsZ, FTdZ) in which dN) and an address other than the above are arbitrarily combined.

As the starting point address FTsN in the test item FTNs (FpN, FTsN, FdN), the starting points of all the sets set in the filtering information F are applied. That is, FTsN = FsX. Here, FsX is FN in the filtering information F.
It is the starting point address of all pairs FX other than.

As the end point address FTdN in the test item FTNd (FpN, FsN, FTdN), the end points of all the sets set in the filtering information F are applied. That is, FTdN = FdX. Here, FdX is FN in the filtering information F.
It is the end point address of all sets FX other than.

Test item FTNz (FpN, FTsZ, FTdZ)
Generates a test item with a value not included as a starting point in all the sets in the filtering information F as a starting point value FTsZ and a value not included as an ending point as an ending point value FTdZ. That is, FTsZ ≠ FsN, FTsZ ≠ FsX FTdZ ≠ FdN, FTdZ ≠ FdX.

Further, for the protocol Fpα on the IP not described in the filtering information F, the test item is generated assuming that Fα (Fpα, *, *) exists. Here, * indicates all addresses.

The filtering test item thus generated is executed by the test control means 14 (see FIG. 7).
Step S102). At this time, the test item development of step S13 is performed. The test control means 14 expands the address into the address to be actually tested when executing the test and executes the test.

Next, an example of address expansion of filtering test items in the test control means 14 will be shown. -In the case of a test item whose address is a network address, when a test is executed, it is expanded as several IP addresses distributed in the network in the same network, and some tests are executed. Further, the test is executed with the IP address arbitrarily selected from the addresses of the preceding and succeeding networks. -If the address is an IP address, a test with this IP address and a test with the IP addresses before and after this IP address are executed.・ If no address and port number are specified, if all addresses and port numbers are specified, or if addresses and port numbers other than specific numbers are specified, then any value is selected and tested. Is executed. -When the port number FspN or FdpN is included at the start or end of the test item FTN, the port numbers before and after FspN or FdpN are also tested.

When the filtering test item generated by the test item generating means 12 is tested by the test control means 14, an unfiltered address space is found, and based on this, the test item generating means 12 generates a routing test item. This is performed (step S103 in FIG. 7).

Next, an example of an algorithm for generating a test item for routing will be shown. In the generation of the test item for routing in TCP / IP, the destination address Rs (network address Rsn / netmask Rsm or IP address Rsi) and the destination address Rd included in the route information R are used.
(IP address of router etc.), interface means It, network address In and netmask Im included in the network information are used.

For each set of route information R (the Nth set is RN (Rs
N, RdN)), the test item RTN (RsN, Rd
N) is generated. The test item RTN (RsN, RdN) is an item for testing that the destination address RsN is set as the destination and is sent to the destination address RdN corresponding to the destination address RsN. Also, for each set of network information I (the N-th set is represented as IN (IrN, InN, ImN)), the destination is the host in the connected network In / Im, and the corresponding network interface Ir Items ITN (IrN, InN, ImN) are also generated which are tested to be sent to the host.

The routing test items thus generated are executed by the test control means 14 (step S104 in FIG. 7). When executing the test, the test control means 14 expands the address into the address to be actually tested and executes the test (step S13). Further, when performing a test, the protocol on IP, the sender address, the sender port number, the destination port number, etc. are set as dummy values that are not filtered. Here, the unfiltered address space extracted by the filtering test is referenced.

Next, an example of the address expansion of the routing test item in the test control means 14 will be shown. -In the case of a test item whose address is a network address, when a test is executed, it is expanded as several IP addresses distributed in the network in the same network, and some tests are executed. Further, the test is executed with the IP address arbitrarily selected from the addresses of the preceding and succeeding networks. -If the address is an IP address, a test with this IP address and a test with the IP addresses before and after this IP address are executed.

In the test packet transmitting step of step S14, the test data is passed from the test control means 14 to the interface section 13. In the test control means 14, when the test item is passed from the test item generating means 12, the test item is expanded as described above, but at this time it is shown that it is test data and a unique test item can be specified. Data string is I
It is included in the data area of the P datagram. The expanded test items are sequentially passed to the interface unit 13, and the test packet is output from the interface unit It of the interface unit 13 to the IP address Ia of the network interface Ir of the router included in the network information I.

The test packet fetch step of step S16 is performed by the interface section 13. When the test packet is sent, the interface unit 13 monitors the data output from the router, and if the test data is passed to the test control unit 14, the test control unit 14 stores it.

At this time, the Arp pseudo answer step of step S15 is executed. That is, in the interface unit 13, the data output from the router is an inquiry (arp) of the physical address of the host specified by the IP address, and when it is output from the correct network interface Ir, it is passed to the test control means 14. . At this time, the test control means 14 artificially generates a physical address corresponding to the IP address, saves the generated IP address and physical address in the Arp table A, and also the interface unit 13
The arp reply is sent from the network means that accepted the inquiry.

The interface means It of the interface unit 13 is a network device for Ethernet, ISDN.
Interface device for ATM, network device for ATM, network device for FDDI, network device for token ring, or other network device.

The test result generation step of step S17 is
It is executed by the test control means 14. When all the test items are executed, the test control means 14 compares the test items with the data received and accumulated from the router, classifies the test results for each test item, and filters the address space,
The judgment as to whether the routing is performed correctly is sought and accumulated as the test result E.

The test result display step of step S18 is
It is executed by the result display means 15. When the test control means 14 obtains the test result E, the result display means 15 outputs this test result to the output device. The output device is a display, printer, floppy disk, or other device.

[Embodiment 2] FIG. 3 is a block diagram showing another embodiment of the router test apparatus 1 of the present invention.
As in the case of, the data input means 11 and the test item generation means
An interface unit 13, a test control unit 14, and a result display unit 15 are provided. However, in this embodiment, the data input means 11 is provided with the analysis template T. Others are the same as in the case of the first embodiment.

Next, the processing flow of the embodiment will be described with reference to the flowchart of FIG. Step S21 is a step of inputting setting data by the data input means 11.
The data input means 11 is means for inputting the setting file of the router to be tested and the analysis template T of the router and analyzing the input information. Input device is keyboard, LA
N, floppy disk, and other input devices. The analysis template T is a file for analyzing a router setting file, and is an analysis script (program), data defining a format (defining a data type, a format, etc.), a file by another method, and the like.

Further, an analysis template which is frequently used, such as an analysis template corresponding to a general router setting data format, may be stored in advance as a file in the data input means. When the analysis template corresponding to the router is not stored, the corresponding analysis template can be input from the data input means 11.

Step S22 is a step of analyzing the setting file. This is done by the data input means 11. When the router setting file and the router analysis template T are input to the data input unit 11, the data input unit 11 analyzes the setting file using the analysis template T, and the route information R, the filtering information F, and the network information I. Take out. The steps after step S23 are the same as the steps after step S12 in the first embodiment.

[Embodiment 3] FIG. 5 is a block diagram showing still another embodiment of the router test apparatus 1 of the present invention. As in the case of Embodiment 1, the data input means 11 and the test item generation means are shown. An interface unit 13, a test control unit 14, and a result display unit 15 are provided. However, in this embodiment, the interface units It1 to Itn of the interface unit 13 are connected to all the network interfaces I of the router 2 to be tested.
Connect to the network to which r1-Irn are connected. Others are the same as in the case of the first embodiment.

Next, the processing flow of this embodiment will be described with reference to the flowchart of FIG. Steps S31 and S32 are the same as steps S11 and S12 of the first embodiment.

Address expansion of the filtering test item by the test control means 14 in the test item expanding step of step S33 is performed as follows. -If the destination address is the address of the network connected to the router, the IP of the host actually connected to the network
The address is arbitrarily selected and the test is executed. -In the case of a test item whose address is a network address, when a test is executed, it is expanded as several IP addresses distributed in the network in the same network, and some tests are executed. Further, the test is executed with the IP address arbitrarily selected from the addresses of the preceding and succeeding networks. -If the address is an IP address, a test with this IP address and a test with the IP addresses before and after this IP address are executed.・ If no address and port number are specified, if all addresses and port numbers are specified, or if addresses and port numbers other than specific numbers are specified, then any value is selected and tested. Is executed. -When the port number FspN or FdpN is included at the start or end of the test item FTN, the port numbers before and after FspN or FdpN are also tested.

The address expansion of the routing test item is as follows. -When the destination address is the address of the network connected to the router, the IP address of the host actually connected to the network is arbitrarily selected and the test is executed. -In the case of a test item whose address is a network address, when a test is executed, it is expanded as several IP addresses distributed in the network in the same network, and some tests are executed. Further, the test is executed with the IP address arbitrarily selected from the addresses of the preceding and succeeding networks. -If the address is an IP address, a test with this IP address and a test with the IP addresses before and after this IP address are executed.

In the test packet sending step of step S34, the test data is passed from the test control means 14 to the interface section 13. In the test control means 14, when the test item is passed from the test item generating means 12, the test item is expanded as described above, but at this time it is shown that it is test data and a unique test item can be specified. Data string is I
It is included in the data area of the P datagram. The expanded test items are sequentially passed to the interface unit 13, and the test packet is output from the interface unit It of the interface unit 13 to the IP address Ia of the network interface Ir of the router included in the network information I.

The test packet monitor step of step S36 is performed by the interface section 13. When the test packet is transmitted, the interface unit 13 monitors the data output from the router, and if the test data is passed to the test control unit 14, the test control unit 14 stores it.

At this time, the Arp investigation in step S35 is performed. That is, the interface unit 13 checks the IP address and physical address of the host connected to the network to which the router is connected by arp inquiry or the like prior to the test execution, and the Arp table A of the test control means 14 is checked.
Accumulate in. In addition, the answers of arp inquiries flowing on the network are constantly monitored, and the Arp table A is constantly updated. Others are the same as in the first embodiment.

[0052]

As described above, according to the present invention,
When installing a router, it is possible to automatically detect security holes, malfunctions, etc. due to misconfiguration of route information, filtering information, etc., and it is possible to reduce the operation of inspectors, and further inspect by inspectors It becomes possible to prevent leakage. Also, a test can be performed before connecting to the network, and operation can be confirmed before actual operation.

Further, according to the present invention, when normal communication cannot be performed through the router, when the cause of the failure is determined whether the cause is the router, the host, the network, or some other reason, With the router still functioning on the network, a dummy test packet can be sent from the device and the output from the router can be inspected, and the setting information is functioning normally or operates as intended. It becomes possible to perform a test such as

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a router test apparatus of the present invention.

FIG. 2 is a flow chart for explaining the flow of processing of the embodiment of FIG.

FIG. 3 is a block diagram showing another embodiment of the router test apparatus of the present invention.

FIG. 4 is a flowchart for explaining the flow of processing of the embodiment in FIG.

FIG. 5 is a block diagram showing still another embodiment of the router test apparatus of the present invention.

6 is a flow chart for explaining the flow of processing of the embodiment in FIG.

FIG. 7 is a flowchart of test item generation.

[Explanation of symbols]

1 Router test equipment 2 routers 11 Data input means 12 Test item generation means 13 Interface part 14 Test control means 15 Result display means A Arp table E test results F filtering information I network information R route information T analysis template Ir network interface It interface means

Claims (4)

(57) [Claims] 1. A router test apparatus for conducting a test of opening a router for relaying data delivery on a network such as a LAN or a WAN, wherein the apparatus is route information which is setting information for a router under test and filtering information. And data input means for inputting network information corresponding to the network interface of the router under test, and the network address or I of each of the start and end points in the filtering information input from the data input means.
For each group consisting of P address and port number, generate a filtering test item by replacing the start point and end point with the start point and end point of another set, or by arbitrarily combining the values not included in the start point and end point. The routing test item is generated from the destination network address or IP address and the destination router IP address in the route information input from the data input unit, and the network of the router under test input from the data input unit. Test item generating means for generating a routing test item from the network interface and network address in the network information corresponding to the interface, and the filtering test item and the routing test item generated by the test item generating means are received. Within the test items If the address is a network address, it is expanded into several IP addresses in the network and the IP addresses of adjacent networks. If the address in the test item is a single IP address, the I
Expand to the P address and the adjacent IP address. If the address or port number in the test item is not a single address or a single port by full or partial specification, expand it to any value within the specified range. If a port number is included in the test item, the test item is expanded to a specific IP address or port number so that the port number and the adjacent port number are expanded to the expanded address. A test packet is sent to the interface unit based on the test packet, and the test control unit for monitoring from which network interface in the router under test the sent packet is returned, and the test result obtained by the test control unit are displayed. And a plurality of interface means for connecting to the network interface of the router under test in a one-to-one relationship. Router testing apparatus characterized in that it comprises a interface unit. 2. The test control means is actually connected to the network when the end point address or the destination address of the test item in the test control means is the address of the network connected to the router under test. The IP address of the host is arbitrarily selected to expand the address, and the interface means of the interface unit is connected to the network connected to the network interface of the router under test one-to-one. The router test apparatus according to claim 1. 3. A router test method for conducting an opening test of a router that relays data on a network such as a LAN and a WAN, the method being route information and filtering information which are setting information for a router under test. And a step of inputting network information corresponding to the network interface of the router under test, and a starting point for each set of network addresses or IP addresses and port numbers of respective starting and ending points in the input filtering information. And the end point are replaced with the start point and the end point of another set, or the step of generating the filtering test item by arbitrarily combining the values not included in the start point and the end point, and the destination network in the input route information. Address or IP address and destination router IP address Generating a routing test item from the router, a step of generating a routing test item from the network interface and the network address in the network information corresponding to the input network interface of the router under test, and the generated filtering test Items and routing test items, if the addresses in these test items are network addresses, then some I
Expanded to the P address and the IP address of the adjacent network, if the address in the test item is a single IP address, expanded to the IP address adjacent to the IP address and the address in the test item If the port number is not a single address or a single port by full or partial designation, expand it to any value within the specified range, and if the test item contains a port number, A step of expanding the test item to a specific IP address or port number so that it is expanded to an adjacent port number, and a test packet is transmitted to the interface unit based on the expanded address, and the transmitted packet is Monitoring from which network interface the router under test returns, and sending and monitoring the test packet Router test method comprising the steps, the thus displaying the test results obtained. 4. In the step of expanding the test item into a specific IP address or port number, if the end point address or destination address of the test item is an address of a network connected to the router under test, 4. The router test method according to claim 3, wherein the IP address of the host actually connected to the network is arbitrarily selected to expand the address.