JPH10271184A - Router testing device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the omission of inspection with respect to erroneous setting and malfunction by inputting setting data of route information set to the router of an inspecting object, filtering information and network information connected to the router from a data input means by an optimum form and carrying out data analyzing through the use of an analytic template defining an inputting form. SOLUTION: Route information R, filtering information F set to the router and network information 1 to n I are inputted from the data input means and a testing item generating means 12 divides testing items into filtering testing items and routing testing items. A test control means 14 executes a test by developing the filtering testing items generated by the means 12 to an address to be tested actually and judges an address space which is not to be filtered. Based on this, the routing testing item is generated and executed to sort by each testing item to store the testing results E of filtering and routing.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an apparatus for performing an opening test of a router for delivering and relaying data on a network such as a LAN or WAN. In particular, the present invention relates to an apparatus for confirming delivery control based on router settings.

In a conventional router opening test, after setting a router, data is transmitted from a host on a network connected to the interface means of the router, and it is checked whether data is received by a host on another network. Inspection of filtering and routing is performed by sending data from a host on another network, and confirming whether or not data has been received by a host on a network connected to a router, thereby checking filtering and routing. At this time, the inspector arbitrarily selects the data transmission destination, the type of data, and the like, and performs the inspection.

[0003]

However, even if the test is completed normally, the result intended by the setting of the router in the transmission / reception on a network or a host other than the test target host arbitrarily selected by the tester due to the test omission is omitted. May not be obtained. This can cause security issues. In addition, it takes a considerable amount of operation and time to check that all the set items are operating as intended by the setter.

An object of the present invention is to provide an apparatus capable of preventing omission of an inspection for a setting error, a malfunction, and the like, and ensuring security and reducing time and labor involved in the inspection.

[0005]

In order to achieve the above object, a router test apparatus of the present invention has a data input means for inputting router setting data, and a router test item based on input information passed from the data input means. Test item generating means for generating a test item, an interface unit having a plurality of interface means connected to the router for inputting and outputting to the router, a result display means for outputting test results, and a test item generated by the test item generating means And test control means for transmitting data to the interface unit, controlling the test of the router, and transferring the test result to the result display means.

In the present invention, a delivery route, filtering, and the like are checked for each protocol for a router (relay device) that handles TCP / IP and other routable protocols. The route information, the filtering information, and the setting data of the network information connected to the router are input from the data input means.

[0007] The data input means for this purpose inputs data related to the router setting in an arbitrary format, analyzes the data using an analysis template corresponding to the data input format, and extracts the router setting information. Can be configured. For example, the data may be the setting file itself set in the router. If an analysis template that defines the input format of the setting data is not provided in the apparatus in advance, the analysis template can be input from the data input unit.

Further, in the present invention, the interface unit can be configured so that each interface unit is connected to all networks connected to the network interface unit of the router.

The test item generating means generates a test item for the router from input information such as path information, filtering information, and network information of the setting data passed from the data input means. In this case, the data input means
Using the analysis template in which the setting format information of the setting data is written, path information, filtering information, network information, and the like can be extracted from the setting data and passed to the test item generation means. If the setting data is in the format of a setting file to be input to the router, the analysis template is the format information of the setting file of the router.

In the test control means, test data is sent to the interface unit in accordance with the test items, and the interface unit outputs the test data one by one from each interface means, and sends the data to each network interface of the router connected to the interface means. Send out. At this time, a specific data string indicating test data is included in the test data.

At this time, the interface section of the router test apparatus fetches all output data output from the router from all interface means, analyzes the output data in the test control means, and specifies a specific data indicating that the data is test data. If the data includes a data string, the output interface means, routing destination, presence / absence of error, delay time, and the like are inspected, and the inspection result is accumulated.

In the interface section, a host or another router on a network to which the router is connected is partially emulated by using information of the connected interface means and corresponding network information, so that the router can communicate with the router. Can be transmitted. Further, the test control means collates the inspection items with the inspection results and integrates them as test results. The result display means displays the test results.

In the present invention, LAN, W
In routers used on networks such as ANs,
Relay route information, filtering information, and the like can be automatically inspected, and security holes, malfunctions, and the like due to setting errors and the like can be reliably found. In this case, by automatically generating the inspection items, the number of operations of the inspector can be reduced, and furthermore, the omission of the inspection by the inspector can be prevented.

By using an analysis template for analyzing the setting data, the setting data set in the router can be input as it is, and the setting information can be accurately grasped, and the accurate inspection items without waste. Can be generated, and the trouble of generating input information for the inspection apparatus can be omitted.

Further, by directly connecting the interface unit to the router, a test can be performed before the actual operation of the router. In addition, by connecting the interface unit to a network connected to the network interface unit of the router, it is possible to perform a test while the router is operating, and to perform a test of path information that dynamically changes during the operation. .

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention is to test a delivery route of a router which relays a routable protocol used in a LAN, a WAN, etc., and a relay function such as filtering. The protocol is TCP / IP, IPX,
Alternatively, any other protocol or the like is optional, but in the following description of the embodiment, a test of the relay function of TCP / IP will be described as an example. Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Embodiment 1] FIG. 1 is a block diagram showing an embodiment of a router test apparatus 1 according to the present invention. The router test apparatus 1 includes a data input unit 11, a test item generation unit 12, an interface unit 13, a test control unit 14, A result display means 15 is provided. In this embodiment, each of the interface means It1 to Itn of the interface unit 13 of the router test apparatus 1 of the present invention is connected to all the network interfaces Ir1 to Ir1 of the router 2 to be tested.
Connect directly to Irn. Next, the flow of processing of the embodiment will be described with reference to the flowchart of FIG.

Step S11 is a step of inputting setting data by the data input means 11. The data input means 11 is a keyboard, a LAN, a floppy disk, and other input devices. The setting data is route information R, filtering information F set in the router, and network information I. The setting data input from the data input unit 11 is information that serves as a key for the test item generation unit 12 to generate test items. The network information I is also used by the interface unit 13 to simulate hosts and routers connected to the network.

In TCP / IP, the route information R is
The filtering information F is defined by a combination of a destination address Rs (network address Rsn / netmask Rsm or IP address Rsi) and a destination address Rd (IP address of a router or the like).
And the start address Fs (network address Fsn / netmask Fsm or IP address Fsi, port number Fs
p) and the destination address Fd (network address Fdn /
Netmask Fdm or IP address Fdi, Port number F
dp), and the network information I is defined by a combination of a router network interface Ir, a network address In, a netmask Im, and a network interface IP address Ia.

Step S12 is a step in which the test item generation means 12 generates a test item. When the route information R, the filtering information F, and the network information I are input from the data input unit 11, the test item generation unit 12 generates test items according to the flow shown in FIG. The generation of test items is performed by generating test items for filtering (step S10).
1) and generation of test items for routing (step S103)
And two generation processes.

The filtering test item generation step in step S103 is generated and executed prior to the routing test item generation. This is to prevent the routing test from being invalidated by filtering the routing test items. Any algorithm may be applied to the generation of the filtering and routing test items.

Next, an example of an algorithm for generating a test item for filtering will be described. In generating test items for filtering in TCP / IP, filtering information F
And the source address F on the IP included in the
s (network address Fsn / netmask Fsm or IP address Fsi, port number Fsp) and destination address Fd (network address Fdn / netmask Fdm or IP address Fdi, port number Fdp) are used,
For each set of filtering information F (the Nth set is FN (FpN,
FsN, FdN) are generated.

The test item FTN is the protocol F on the IP.
pN, the test item FTNn (FpN, FsN, FdN) in which the start address FsN and the end address FdN are directly combined, and the test item FT in which the start address is replaced with another value and combined.
Ns (FpN, FTsN, FdN) and test item FTNd (FpN, FsN, FTN) which are combined by replacing the destination address with another value
The test items FTNz (FpN, FTsZ, FTdZ) are generated by arbitrarily combining dN) with addresses other than the above.

As the start address FTsN in the test items FTNs (FpN, FTsN, FdN), the start points of all the sets set in the filtering information F are applied. That is, FTsN = FsX. Here, FsX is FN in the filtering information F.
Other than the set FX.

As the end point address FTdN in the test item FTNd (FpN, FsN, FTdN), the end points of all the sets set in the filtering information F are applied. That is, FTdN = FdX. Here, FdX is FN in the filtering information F.
Other than the set FX.

Test item FTNz (FpN, FTsZ, FTdZ)
The test item is generated by setting a value not included as a start point in all sets in the filtering information F as a start point value FTsZ, and a value not included as an end point as an end point value FTdZ. That is, FTsZ ≠ FsN, FTsZ ≠ FsX FTdZ ≠ FdN, FTdZ ≠ FdX.

For the protocol Fpα on the IP not described in the filtering information F, a test item is generated as if Fα (Fpα, *, *) exists. Here, * indicates all addresses.

The filtering test items generated in this way are executed by the test control means 14 (FIG. 7).
Step S102). At this time, the test items are expanded in step S13. In the test control means 14, when the test is executed, the address is expanded to the address to be actually tested, and the test is executed.

Next, an example of address expansion of filtering test items in the test control means 14 will be described. In the case of a test item whose address is a network address, when the test is executed, it is developed as several IP addresses distributed in the network in the same network, and some tests are executed. Further, a test is performed with an IP address arbitrarily selected from the addresses of the preceding and following networks. If the address is an IP address, a test using this IP address and a test using IP addresses before and after this IP address are executed. -If the address and port number are not specified, if all addresses and port numbers are specified, or if the address and port number excluding specific numbers are specified, an arbitrary value is selected and tested Is executed. -If the start point or end point of the test item FTN includes the port number FspN or FdpN, the test is also performed on the port numbers before and after FspN or FdpN.

When the filtering test item generated by the test item generating means 12 is tested by the test control means 14, an unfiltered address space is found, and the test item generating means 12 generates a routing test item based on this. This is performed (Step S103 in FIG. 7).

Next, an example of an algorithm for generating a routing test item will be described. In generating a test item for routing in TCP / IP, a destination address Rs (network address Rsn / netmask Rsm or IP address Rsi) and a destination address Rd included in the routing information R
(IP address of router, etc.), and interface means It, network address In, and netmask Im included in the network information.

Each set of route information R (the N-th set is denoted by RN (Rs
N, RdN)) for the test item RTN (RsN, Rd
N) is generated. The test item RTN (RsN, RdN) is an item for testing that the destination is the destination address RsN and that the destination address RsN is sent to the destination address RdN corresponding to the destination address RsN. Also, for each set of network information I (the N-th set is denoted by IN (IrN, InN, ImN)), the host in the connected network In / Im is addressed to the corresponding network interface Ir and An item ITN (IrN, InN, ImN) for testing to be sent to the host is also generated.

The thus generated routing test items are executed by the test control means 14 (step S104 in FIG. 7). When executing the test, the test control means 14 expands the address to the address to be actually tested and executes the test (step S13). When a test is performed, a value that is not filtered is set as a dummy in the protocol on the IP, the source address, the source port number, the destination port number, and the like. Here, the unfiltered address space extracted by the filtering test is referred to.

Next, an example of address expansion of a routing test item in the test control means 14 will be described. In the case of a test item whose address is a network address, when the test is executed, it is developed as several IP addresses distributed in the network in the same network, and some tests are executed. Further, a test is performed with an IP address arbitrarily selected from the addresses of the preceding and following networks. If the address is an IP address, a test using this IP address and a test using IP addresses before and after this IP address are executed.

In the test packet sending step of step S 14, test data is passed from the test control means 14 to the interface unit 13. When the test item is passed from the test item generation unit 12, the test control unit 14 expands the test item as described above. At this time, the test item indicates test data and a unique test item can be specified. Data string I
It is included in the data area of the P datagram. The developed test items are sequentially passed to the interface unit 13, and a test packet is output from the interface means It of the interface unit 13 to the IP address Ia of the network interface Ir of the router included in the network information I.

The test packet capturing step of step S16 is performed by the interface unit 13. When the test packet is transmitted, the interface unit 13 monitors the data output from the router. If the test packet is test data, the data is passed to the test control means 14, and the test control means 14 accumulates the data.

At this time, the Arp pseudo answer step of step S15 is executed. That is, in the interface unit 13, the data output from the router is an inquiry (arp) of the physical address of the host specified by the IP address, and when the data is output from the correct network interface Ir, the data is passed to the test control means 14. . At this time, the test control means 14 generates a physical address corresponding to the IP address in a pseudo manner, stores the generated IP address and the physical address in the Arp table A,
The response of arp is sent from the network means that received the inquiry of arp.

The interface means It of the interface unit 13 is a network device for Ethernet, ISDN
Interface device, an ATM network device, an FDDI network device, a token ring network device, or another network device.

The test result generation step of step S17 includes:
This is executed by the test control means 14. When all the test items are executed, the test control means 14 compares the test items with the data received and accumulated from the router, classifies the test results for each test item, and filters the address space,
A determination is made as to whether the routing is performed correctly, and the result is accumulated as a test result E.

The test result display step of step S18 is as follows.
This is executed by the result display means 15. When the test result E is obtained by the test control means 14, the result display means 15 outputs the test result to the output device. The output device is a display, printer, floppy disk, or other device.

[Embodiment 2] FIG. 3 is a block diagram showing another embodiment of the router test apparatus 1 according to the present invention.
As in the case of the above, the data input means 11, the test item generation means
12, an interface unit 13, a test control unit 14, and a result display unit 15. However, in this embodiment, the data input means 11 is provided with the analysis template T. Others are the same as in the first embodiment.

Next, the flow of processing of the embodiment will be described with reference to the flowchart of FIG. Step S21 is a step of inputting setting data by the data input means 11.
The data input means 11 is a means for inputting a setting file of a router to be tested and an analysis template T of the router, and analyzing input information. Input device is keyboard, LA
N, floppy disk, and other input devices. The analysis template T is a file for analyzing a setting file of the router, and is an analysis script (program), data for defining a format (definition of data type, format, and the like), a file in another format, and the like.

For frequently used analysis templates, such as an analysis template corresponding to a setting data format of a general router or the like, the analysis template may be stored in advance in the data input means as a file. When the analysis template corresponding to the router is not stored, the corresponding analysis template can be input from the data input unit 11.

Step S22 is a step of analyzing the setting file. This is performed by the data input means 11. When the router setting file and the router analysis template T are input to the data input unit 11, the data input unit 11 analyzes the setting file using the analysis template T, and obtains the route information R, the filtering information F, and the network information I. Take out. Step S23 and subsequent steps are the same as step S12 and subsequent steps of the first embodiment.

[Embodiment 3] FIG. 5 is a block diagram showing still another embodiment of the router test apparatus 1 of the present invention. As in the case of the first embodiment, the data input means 11 and the test item generation means are provided. 12, an interface unit 13, a test control unit 14, and a result display unit 15. However, in this embodiment, each of the interface means It1 to Itn of the interface unit 13 is connected to all the network interfaces It1 of the router 2 to be tested.
Connect to the network to which r1 to Irn are connected. Others are the same as in the first embodiment.

Next, the flow of processing of this embodiment will be described with reference to the flowchart of FIG. Steps S31 and S32 are the same as steps S11 and S12 of the first embodiment.

The address expansion of the filtering test item by the test control means 14 in the test item expansion step of step S33 is performed as follows. If the destination address is the address of the network connected to the router, the IP address of the host actually connected to the network
The test is arbitrarily selected from the addresses and executed. In the case of a test item whose address is a network address, when the test is executed, it is developed as several IP addresses distributed in the network in the same network, and some tests are executed. Further, a test is performed with an IP address arbitrarily selected from the addresses of the preceding and following networks. If the address is an IP address, a test using this IP address and a test using IP addresses before and after this IP address are executed. -If the address and port number are not specified, if all addresses and port numbers are specified, or if the address and port number excluding specific numbers are specified, an arbitrary value is selected and tested Is executed. -If the start point or end point of the test item FTN includes the port number FspN or FdpN, the test is also performed on the port numbers before and after FspN or FdpN.

The address expansion of the routing test items is as follows. If the destination address is the address of the network connected to the router, the test is executed by arbitrarily selecting from the IP addresses of the hosts actually connected to the network. In the case of a test item whose address is a network address, when the test is executed, it is developed as several IP addresses distributed in the network in the same network, and some tests are executed. Further, a test is performed with an IP address arbitrarily selected from the addresses of the preceding and following networks. If the address is an IP address, a test using this IP address and a test using IP addresses before and after this IP address are executed.

In the test packet sending step of step S34, test data is passed from the test control means 14 to the interface unit 13. When the test item is passed from the test item generation unit 12, the test control unit 14 expands the test item as described above. At this time, the test item indicates test data and a unique test item can be specified. Data string I
It is included in the data area of the P datagram. The developed test items are sequentially passed to the interface unit 13, and a test packet is output from the interface means It of the interface unit 13 to the IP address Ia of the network interface Ir of the router included in the network information I.

The test packet monitoring step of step S36 is performed by the interface unit 13. When the test packet is transmitted, the interface unit 13 monitors data output from the router. If the test packet is test data, the data is passed to the test control means 14, and the test control means 14 accumulates the data.

At this time, an Arp check in step S35 is performed. That is, the interface unit 13 checks the IP address and the physical address of the host connected to the network to which the router is connected by arp query or the like before executing the test, and checks the Arp table A of the test control unit 14.
To accumulate. In addition, it constantly monitors the response to the arp inquiry flowing on the network and constantly updates the Arp table A. Others are the same as the first embodiment.

[0052]

As described above, according to the present invention,
When a router is introduced, security holes and malfunctions due to mistakes in the setting of routing information, filtering information, etc., can be automatically detected, reducing the number of inspectors' operations. Leakage can be prevented. In addition, a test can be performed before connecting to a network, and operation can be confirmed before actual operation.

Further, according to the present invention, when communication cannot be normally performed through the router, the cause of the failure, whether the cause is in the router, in the host, in the network, or else, is determined. With the router still functioning on the network, a dummy test packet can be sent from the device and the output from the router can be inspected, and the configuration information is working properly or behaving as intended. Test can be performed.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of a router test apparatus according to the present invention.

FIG. 2 is a flowchart for explaining the flow of processing in the embodiment of FIG. 1;

FIG. 3 is a block diagram showing another embodiment of the router test apparatus of the present invention.

FIG. 4 is a flowchart for explaining a processing flow of the embodiment of FIG. 3;

FIG. 5 is a block diagram showing still another embodiment of the router test apparatus of the present invention.

FIG. 6 is a flowchart for explaining a processing flow of the embodiment in FIG. 5;

FIG. 7 is a flowchart of test item generation.

[Explanation of symbols]

 Reference Signs List 1 router test apparatus 2 router 11 data input means 12 test item generation means 13 interface unit 14 test control means 15 result display means A Arp table E test result F filtering information I network information R route information T analysis template Ir network interface It interface means

Claims (3)

[Claims] 1. A data input means for inputting setting data of a router, a test item generating means for generating a test item of a router from input information passed from the data input means, and connecting to the router to perform input / output to / from the router An interface unit having a plurality of interface units, a result display unit for outputting test results, and a test item generated by the test item generation unit, receiving data, sending data to the interface unit, controlling a router test, A router test apparatus comprising test control means for delivering test results to a result display means. 2. The data input means inputs data related to router settings in an arbitrary format, analyzes the data using an analysis template corresponding to the data input format, and extracts router setting information. The router test apparatus according to claim 1, wherein: 3. The router test apparatus according to claim 1, wherein the interface unit connects the interface unit to a network connected to a network interface unit of the router.