The Poor Man’s IOS Traffic Generator

CHARGEN

There is a fea­ture that is built-​​in to TCP known as CHARGEN, whci is short for CHARacter GENerator and it used to be a stand­ard fea­ture in most verions of *nix. Today this fea­ture is dis­abled for secur­ity reas­ons (detailed in rfc864).There are a few other ser­vices in the same fea­ture set of TCP, such as Echo, Discard and Daytime (RFC 862, 863, 867 respect­ively) and these are also use​ful​.In IOS, Cisco calls all of these ‘small-​​servers’ and from about Version 12.2 or so, they are dis­abled by default. So first thing is to enable the service.

Enabling TCP Small Server on IOS


r2#conf t
Enter configuration commands, one per line.
End with CNTL/Z.
r2(config)#service tcp-small-servers
r2(config)#^Z
r2#
000120: *Mar 1 00:28:35.183 UTC: %SYS-5-CONFIG_I: Configured from console by console

You have now enabled a ser­vice that is listen­ing for requests. Go to an adja­cent router that can reach an IP address on the first router, and tel­net to port 19 and a bunch of char­ac­ters will dis­play on the screen.


r1#telnet 198.18.0.2 19
Trying 198.18.0.2, 19 ...
Open
!"#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
!"#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
h"#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hi#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hij$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hijk%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hijkl&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hijklm'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijk
lmn()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmno
)*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnop*+,
-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopq+,-./0
123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqr,-./01234
56789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrs-./012345678
9:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst./0123456789:;?
@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstu/0123456789:;?@ABC
DEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuv0123456789:;?@ABCDEFG
HIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvw123456789:;?@ABCDEFGHIJK
LMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwx23456789:;?@ABCDEFGHIJKLMNO
PQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxy3456789:;?@ABCDEFGHIJKLMNOPQRS
TUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz456789:;?@ABCDEFGHIJKLMNOPQRSTUVW
XYZ[\]^_`abcdefghijklmnopqrstuvwxyz{56789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[
\]^_`abcdefghijklmnopqrstuvwxyz{|6789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_
`abcdefghijklmnopqrstuvwxyz{|}789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abc
defghijklmnopqrstuvwxyz{|}~89:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hijklmnopqrstuvwxyz{|}~9:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijkl
mnopqrstuvwxyz{|}~ !:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnop
qrstuvwxyz{|}~ !";?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst
uvwxyz{|}~ !"#?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwx
yz{|}~ !"#$=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuv
wxyz{|}~ !"#$%>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst
uvwxyz{|}~ !"#$%&?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopq
rstuvwxyz{|}~ !"#$%&'
--SNIP--


This will con­tinue as long as you keep the ses­sion open.

Warning

IOS must gen­er­ate the char­ac­ters, and this is done by the CPU and is very CPU intens­ive on a high speed link. You should take some care only do this in the dir­ec­tion that you can ter­min­ate the tel­net ses­sion. Thus do this on a router that is ‘nearest to you’. If you tel­net from the far side back to your­self you can flood the con­nec­tion and cause the router to reload (or worse).I strongly recom­mend that you prac­tice this in a test envir­on­ment before you do this in a live environment.

Stop the session

Enter Ctrl-​​Shift-​​6 and then x to return to the main con­sole. Then enter ‘disc 1′ to ter­min­ate the back­ground connection.


!"#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
h"#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hi#$%&'()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
hij$%&'()*+,!

Ctrl-​​Shift-​​6 and x was pressed here, you must use the ‘dis­con­nect’ com­mand to clear the ses­sion as it will still be run­ning in the background.


rs#disc 1
Closing connection to 198.18.0.1 [confirm]r2#

Some Considerations

While this will def­in­itely gen­er­ate some traffic, it will not gen­er­ate large volumes of traffic. Some per­form­ance con­sid­er­a­tions that should think about:

• the CPU of the remote router to gen­er­ate the char­ac­ter stream
• the abil­ity of the WAN link to send traffic
• the speed at which the router can send the char­ac­ters to a ter­minal session.

Specifically, a con­sole ses­sion with a 9600 bps rate will not gen­er­ate a lot of traffic, but a tel­net ses­sion dir­ectly con­nec­ted at 100Mbps will gen­er­ate a lot more because the trans­mis­sion rate between the router and the ter­minal win­dow is very fast. SSH will be slower since the encryp­tion adds some delay to the process.

Stupid Alert: Think before start

It cer­tainly pos­sible that if you do this on a pro­duc­tion net­work that you could cause a loss of ser­vice. You should take some time to think about the implic­a­tions to your band­width, and make sure you know how to stop the CHARGEN, BEFORE YOU START.

You are warned.

Please rate this post:

(1 votes, average: 10.00 out of 10)

 Loading ...