Testing DDoS mitigation can be surprisingly difficult. You may want to see how your monitoring system reacts to a 10 or 15 Gbps attack, but generating that much real traffic requires suitable hardware and network capacity — and is not always practical or desirable in a test environment.
To make this kind of testing easier, FastNetMon has released sflowgen, a lightweight, open-source tool for DDoS testing.
Instead of generating gigabits of real network traffic, sflowgen generates the sFlow telemetry that represents it. You can create normal background traffic, introduce a simulated DDoS attack, and send the resulting sFlow v5 data directly to FastNetMon.
For example, you can configure a network carrying a few gigabits of everyday traffic, add a UDP flood targeting a particular host, and watch how FastNetMon responds as the attack gradually increases to 15 Gbps. The generator itself does not need to put 15 Gbps of traffic onto the network.
This gives network engineers a lightweight and controlled way to test DDoS detection, tune thresholds, validate monitoring configurations and demonstrate FastNetMon without setting up a full-scale traffic-generation environment.
FastNetMon has released sflowgen as an open-source Go tool for exactly these kinds of testing, demonstration, dashboard and attack-detection validation scenarios.
Key Features
- Two Operating Modes:
- Ambient Mode: Continuously generates background traffic across one or more IPv4 and IPv6 networks. Zipf-distributed base weights create stable but non-uniform top talkers, while correlated AR(1) noise allows individual host rates to move smoothly over time without causing large swings in the overall network rate.
- Attack Mode: Generates synthetic telemetry representing targeted DDoS traffic associated with a single victim address. It can represent TCP, UDP, ICMP and ICMPv6 floods, with configurable smooth ramp-up, peak hold and ramp-down phases.
- Configurable Traffic Profiles: Define protocol ratios, packet sizes using a bounded normal distribution, incoming and outgoing traffic proportions, and TCP SYN, ACK or SYN-ACK flags for attack profiles.
- Deterministic Test Runs: Configurable random seeds make it possible to create deterministic, reproducible traffic-generation runs.
- IPv4 and IPv6 Support: Both ambient and attack scenarios can generate synthetic headers representing IPv4 or IPv6 traffic.
- Concurrent Ambient and Attack Traffic: Ambient traffic and an attack simulation can run as separate processes against the same sFlow collector. Different sub_agent_id values distinguish the two streams.
- Runtime Statistics: sflowgen reports both the traffic rate requested by its model and the traffic volume represented by the emitted sFlow samples, making it easier to verify that a test is behaving as expected.
How It Works
Because sFlow represents network traffic through statistical sampling, sflowgen does not need to generate true line-rate application bandwidth to test high-volume detection scenarios.
Instead, it generates sFlow FlowSample records containing RawPacketFlow data with synthetic Ethernet, IP and transport-layer headers. Each sample also carries an original frame length and is associated with a configurable sampling rate.
FastNetMon can use this information to estimate the amount of network traffic represented by the samples. For the generator, the approximate represented traffic per sample is:
frame length × sampling rate × 8
This means a relatively small stream of sFlow telemetry can represent a much larger volume of network traffic.
For example, an engineer can configure an attack profile with a 15 Gbps peak rate and specify the victim address, protocol, packet-size distribution and attack duration. FastNetMon then receives telemetry representing that traffic pattern without sflowgen having to transmit 15 Gbps of real application traffic.
This separation between generated telemetry and represented traffic is what makes sflowgen useful for lightweight DDoS testing.
Simulating Background Traffic
DDoS detection is often easier to test when an attack does not appear against an otherwise empty network.
The ambient mode is designed to create a changing baseline of background traffic. Each configured network receives an average traffic rate that can be divided between incoming and outgoing traffic.
Individual hosts receive stable base weights, optional Zipf-based rank bias and smoothly changing AR(1) noise. This produces non-uniform top talkers whose rates vary over time while keeping the total network rate comparatively stable.
Incoming and outgoing traffic for the same internal host also use the same changing host weight. This creates correlated, request/response-like behaviour without attempting to model actual application sessions.
An attack process can then run alongside this baseline, allowing teams to observe how detection behaves as synthetic attack traffic ramps up above normal background activity.
What sflowgen Is — and Isn't
sflowgen is a telemetry generator, not a packet or application traffic generator.
It does not generate application payloads, maintain stateful TCP or UDP sessions, or reproduce complete request/response conversations. Incoming and outgoing ambient traffic can be correlated by host, but individual flows are not matched by five-tuple.
It also does not currently model features such as VLAN tagging, fragmentation, tunnelled traffic, counter samples, PCAP replay or BGP metadata.
Instead, the tool is deliberately focused on generating controlled sampled-header telemetry that a collector such as FastNetMon can use for traffic estimation and attack-detection testing.
That makes it particularly useful when the goal is to test DDoS detection logic and traffic visibility, rather than the forwarding capacity of routers, switches, NICs or mitigation appliances.
Because the telemetry is synthetic, it is still important to check that a test profile produces the behaviour you expect. Review the configuration and validate the resulting telemetry before using sflowgen in shared or production-like environments.
License & Availability
sflowgen is open source and released under the Apache License 2.0.
The project requires Go 1.22 or newer and a reachable sFlow collector.
To get started and explore more, visit the sflowgen GitHub repository.
