基于多类型数据包的IPv6防火墙防护能力评测方法

为测试IPv6防火墙对潜在IPv6网络威胁的防护能力,研究IPv6防火墙防护能力评测方法。通过对IPv6协议的研究,本文构造了针对ICMPv6、单一扩展报头、多扩展报头、分片、地址范围的五类存在安全隐患的测试数据包,构建了C/S架构的防火墙测试框架,并基于框架和测试数据包构建了用于各类测试的独立测试模块,搭建了可用于测试有状态防火墙的测试环境,并提供了相应的测试方法。利用本文所提出的方法,对思科ASA5505防火墙进行了测试,发现了它的一些优点与不足。

IPv6 firewall defensive capability testing method based on varied packets

In order to test the defensive capability of IPv6 firewall to against potential IPv6 network threats, this paper studied IPv6 firewall defensive capability testing technology. Through the research of IPv6 protocol, this paper constructed five kinds of test packets with security risks, such as ICMPv6, single extended header, multi-extension header, fragmentation and address scopes, proposed a firewall testing framework with C/S architecture, built independent test modules for every kind of testing based the framework and test packets, set up test environments that can be used to test stateful firewalls, and provided appropriate test methods. Using the method, this paper tested a Cisco ASA5505 firewall and found its advantages and disadvantages.