Re: [Tomahawk-users] Trouble reproducing CPS results

[Andrey F. <fa...@re...>]

Koconis, David wrote:
> Andrey,
>
> Although I did not participate in the testing cited by the
> whitepaper, I have contacted one of the authors who provided me with
> the cps script referred to on page 20 and gave me permission to share
> it with you and the list.  It is attached to this email.
>
> From what you have posted about your configuration, I do not see any
> issues.  I also reviewed the 1000conn.pcap you created and it looks
> very similar to the one the author provided me.
>
> One important thing to know before attempting to run the script is it
>  will only work with tomahawk version 1.0.
You are 100% correct about this. We are now getting good results with 1.0.
> Some of the changes made in release 1.1 will cause the command line
> in the script to fail. Specifically, the maximum number of handlers
> in v1.1 is 250, so "-n 10000" will fail.  Also, the second byte of
> the IP address, which is a shell variable $ADDR in the script, is now
> reserved for use as the handler ID.  Although I have not verified it,
> I believe the following changes should make things work with v1.1:
>
> loops=1000 time tomahawk -i eth0 -j eth1 -q -m 200 -r 10 -t 100 -a
> 10.0.0.0 -n 250 \ -l $loops -f /usr/local/pcaps/1000conn.pcap >
> /dev/null
>
We tried this, but got even worse results than when running the command
for 1.0.
> If you are still having difficulty getting the results you want,
> please post the command line you are using and the version of the
> code.
>
> Regards, David Koconis
>
Thank you for your help! Using 1.0, we are getting results, which is
good enough
for us.

Sorry it took so long to reply, we've been playing with tomahawk to see
if anything
strange would arise. Right now, tests over wire show worse results than
over our
IPS, but we suspect packets are not actually going over wire. We'll post
back if we
are unable to figure this out.

Thanks!

Best regards,
Andrey Falko