FTester

The Firewall Tester (FTester) is designed for testing firewall filtering policies and IDS capabilities. It supports features like firewall testing, IDS testing, simulation of real TCP connections for stateful inspection firewalls and IDS, TCP connection spoofing, IP fragmentation, TCP segmentation, and IDS evasion techniques.

Use cases include evaluating the effectiveness of firewall rules and IDS detection rules against sophisticated attacks. It helps security professionals identify weaknesses in network defenses by attempting to bypass filters through fragmentation, spoofing, and other evasion methods.

FTester operates as a client-server tool with ftest and ftestd components, generating detailed logs for analysis via freport.

FTester simulates real TCP connections to test stateful inspection in firewalls and IDS. It supports TCP connection spoofing, IP fragmentation/TCP segmentation, and IDS evasion techniques such as custom TTL values, checksum manipulation, and markers. The tool uses Perl libraries like libnet-pcap-perl, libnet-rawip-perl, and libnetpacket-perl to craft and send packets, with ftest as the client configuring tests via options and ftestd handling server-side operations. Logs are generated for reporting with freport.