Fuzzing (L3–L7)
The Fuzzing (L3–L7) plugin tests how network devices handle malformed or randomly modified fields in UDP/TCP traffic. It helps evaluate DUT behavior when packets carry invalid checksums, variable IP/TCP fields, random payloads, and concurrent L4 flows.
Fuzzing does not replace specialized L7 scenarios. Use the separate WAF and Network Vulnerabilities (CVE) plugins for WAF tests against HTTP payloads and for CVE replay. Fuzzing (L3–L7) primarily targets L3–L4 profiles: malformed UDP/TCP packets, TCP Flow, and UDP Flow.
Use Fuzzing only in an isolated test environment. Malformed packets are intentionally capable of causing drops, processing errors, session resets, and security-system events.
Table 187 — Fuzzing (L3–L7) modules
| Module | Side | Test purpose |
|---|---|---|
| UDP: invalid checksum | Client | Sends UDP packets with an invalid L4 checksum |
| UDP: random IP TTL | Client | Tests UDP packets whose TTL is selected from a configured value or range |
| UDP: random DSCP/ECN | Client | Tests UDP packets with variable ToS fields |
| UDP: random IP ID | Client | Tests UDP packets with a variable IP identification field |
| UDP: random Payload Data | Client | Sends UDP packets with a random payload of the configured size |
| TCP: PSH/ACK without handshake | Client | Sends TCP PSH/ACK packets without first establishing a TCP session |
| TCP: invalid checksum | Client | Sends TCP packets with an invalid L4 checksum |
| TCP: random SEQ | Client | Tests TCP packets whose sequence number is selected from a configured value or range |
| TCP: random MSS | Client | Tests TCP packets with a variable MSS |
| TCP: random Window Scale | Client | Tests TCP packets with a variable Window Scale |
| TCP: random window | Client | Tests TCP packets with a variable receive window |
| TCP: random Payload Data | Client | Sends TCP packets with a random payload of the configured size |
| TCP Flow: stateful sessions | Client, server | Establishes valid TCP sessions with configurable TCP fields |
| UDP Flow: stateful flows | Client, server | Generates valid UDP flows with configurable IP fields |
Only the TCP Flow and UDP Flow modules are available on the server side. The client sends modules with invalid checksums, stateless TCP packets, and random payloads.
Configuring modules
In the Fuzzing (L3–L7) form, enable the required modules with their toggles. Fields specific to each module appear when it is enabled. Enter either a single number or a hyphen-separated range, such as 64 or 64-128. For UDP ECN, select one or more codes: 00, 01, 10, 11.
Table 188 — Configurable Fuzzing fields
| Field | Used by | Default | Allowed value |
|---|---|---|---|
| Payload Data | Modules with a fixed payload | 256 bytes | Number or range from 0 to 9000 |
| UDP TTL | UDP TTL, UDP Flow | 1-255 | Number or range from 0 to 255 |
| UDP DSCP | UDP DSCP/ECN, UDP Flow | 0-63 | Number or range from 0 to 63 |
| UDP ECN | UDP DSCP/ECN, UDP Flow | 00, 01, 10, 11 | One or more ECN codes |
| UDP IP ID | UDP IP ID, UDP Flow | 0-65535 | Number or range from 0 to 65535 |
| UDP Payload Data | UDP random payload | 1-1400 bytes | Number or range from 0 to 9000 |
| TCP SEQ | TCP SEQ, TCP Flow | 0-4294967295 | Number or range from 0 to 4294967295 |
| TCP MSS | TCP MSS, TCP Flow | 536-1460 | Number or range from 0 to 65535 |
| TCP Window Scale | TCP Window Scale, TCP Flow | 0-14 | Number or range from 0 to 255 |
| TCP window | TCP window, TCP Flow | 1-65535 | Number or range from 0 to 65535 |
| TCP Payload Data | TCP random payload | 1-1400 bytes | Number or range from 0 to 9000 |
If a range is reversed, contains an unsupported ECN code, or exceeds the allowed bounds, the task does not start and the user receives a validation error.
Load settings
Configure the overall load profile in the plugin's standard sections:
| Setting | Use in Fuzzing |
|---|---|
| Packets per second | Aggregate packet-per-second budget shared by all enabled Fuzzing modules |
| Total sessions | Aggregate session budget shared by enabled flow modules |
| Connections per second | Flow session opening rate |
| Duration | Profile runtime |
At startup, Packets per second is divided among all enabled Fuzzing modules: individual stateless UDP/TCP modules, TCP Flow, and UDP Flow. If the value is not evenly divisible, the first module in the form receives the remainder.
For example, with 9 enabled modules and a rate of 1000 packets per second, the first module receives 112 packets/s and each of the other 8 receives 111 packets/s. If only one module is enabled, it receives the entire budget.
Total sessions and Connections per second are divided only among enabled flow modules. If both TCP Flow and UDP Flow are enabled, the value is split equally; for an odd value, the first flow module receives the remainder. If only one flow module is enabled, it receives the entire session and opening-rate budget.
For stable flow-session testing, ensure that the packet budget is sufficient for the selected number of active sessions. A low packet-per-second rate combined with a high session count can result in infrequent traffic on each session.
Usage recommendations
- To test malformed packet handling, begin with one module, a short duration, and a low rate, then gradually increase both the module set and load.
- To test session stability, enable TCP Flow or UDP Flow alongside regular application traffic such as HTTP. This confirms that valid sessions remain operational while Fuzzing traffic is present.
- Capture task traffic to a PCAP file and compare packet fields with the selected ranges to verify packet composition.
- Use the separate WAF and CVE Replay plugins for WAF payload and CVE testing; they provide application-level HTTP/CVE scenarios and dedicated result dashboards.