--- title: "NGFW Testing: Fast Paths, Fake AppMix, and PCAP Replay Traps" description: Discover the hidden pitfalls in NGFW testing, from fast paths to AppMix issues, and learn how to conduct effective evaluations for better security outcomes. image: https://test4net.com/hubfs/AI-Generated%20Media/Images/Hardware%20Firewall%20with%20Shadow%20Overlay%20and%20Abstract%20Flow%20Lines.png --- [Skip to content](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap#main-content) [![TEST4NET](https://test4net.com/hubfs/test4net-logo-fixed-2.svg)](https://test4net.com/?hsLang=en) - CLOUDLAB - SERVICES - SOLUTIONS - VENDORS - RESOURCES - COMPANY - [English](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap) - [Русский](https://test4net.com/ru/blog/ngfw-testing-fast-path-appmix-pcap) - [Հայերեն](https://test4net.com/hy/blog/ngfw-testing-fast-path-appmix-pcap) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) - [English](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap) - [Русский](https://test4net.com/ru/blog/ngfw-testing-fast-path-appmix-pcap) - [Հայերեն](https://test4net.com/hy/blog/ngfw-testing-fast-path-appmix-pcap) How It Works Remote access to a live test lab: pick a scenario, run it, get the report Equipment & Capabilities Traffic generators, emulators and DUT racks available in the lab Access Plans Hourly sessions, subscriptions and dedicated racks [Log in to CloudLAB POPULAR Your sessions, reservations and reports](https://lab.test4net.com) [Open the CloudLAB portal](https://lab.test4net.com) Network Test & Validation Load & Performance Testing Functional Testing Conformance Testing Interoperability Testing Security & Resilience Testing All testing services Automation & Expertise Test Automation & CI/CD Test Plan & Methodology Design Training Programs Lab & Equipment Lab Rental Hosted DUT Testing Equipment Repair Not sure where to start? Get a test plan for your setup Tell us what you run and what worries you. We propose the tests, tools and timeline. [Request a test plan](https://test4net.com/contacts?hsLang=en) By Technology By Industry By Task Routing & Switching Firewalls & NGFW SD-WAN & WAN Cloud & NFV 5G & Mobile Core Wi-Fi Storage & Infrastructure AI / Switching Fabric (RoCEv2) All technologies Telecom Operators Network & Security Vendors Banks & Financial Services System Integrators Enterprise IT Teams Managed Service Providers Media, Broadcast & Streaming Government & Public Sector All industries Pre-deployment Validation Vendor Selection Cloud Migration Readiness AI/GPU Cluster & RoCEv2 Readiness New Technology Rollout Troubleshooting & Benchmarking Disaster Recovery & Failover Testing SLA Validation & Vendor Accountability All tasks Testing Tools & Lab Ixia / Keysight POPULAR Emblasoft NEW Apposite Technologies T-Plan Cubro Candela Technologies Netitest How we integrate the tools IT Infrastructure HPE Vinchin Yeastar Become a partner Read Technologies / Protocols Methodologies [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) FAQ How the lab, sessions and reports work BGP Route exchange, policy and convergence OSPF & IS-IS IGP adjacency, flooding and SPF timing MPLS & Segment Routing LDP, RSVP-TE and SR-MPLS label paths EVPN / VXLAN Overlay fabrics, MAC/IP routes, multi-homing IPsec & IKEv2 Tunnel setup, rekeying and throughput TLS / HTTPS Handshakes, cipher suites and inspection RoCEv2 Lossless Ethernet, PFC and ECN for AI fabrics Wi-Fi 6 / 6E / 7 802.11ax/be, OFDMA, MLO and roaming All protocols [RFC 2544 Throughput, latency, frame loss and back-to-back](https://test4net.com/methodologies/rfc-2544?hsLang=en) RFC 2889 LAN switch benchmarking: forwarding, MAC learning, congestion [RFC 9411 / RFC 3511 Firewall and NGFW performance benchmarking](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 TCP throughput and buffer delay testing RFC 5180 IPv6 benchmarking methodology ITU-T Y.1564 Ethernet service activation: CIR, EIR, KPIs per service ITU-T Y.1731 Ethernet OAM: delay, jitter, loss and SLA monitoring TR-398 Wi-Fi in-premises performance test plan All methodologies From the blog [![Wi-Fi testing](https://test4net.com/hubfs/blog-covers/menu/menu-wifi-640.webp) Wi-Fi Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) [![Security validation](https://test4net.com/hubfs/blog-covers/menu/menu-security-640.webp) Security One Test Is Not Enough: Why Security Infrastructure Needs Continuous Validation](https://test4net.com/blog/security-platform-continuous-validation-updates?hsLang=en) [![Security product testing](https://test4net.com/hubfs/blog-covers/menu/menu-lab-640.webp) Methodology How to Run a Security Product Test You Can Actually Trust](https://test4net.com/blog/how-to-run-a-security-product-test-you-can-actually-trust?hsLang=en) [About Us Independent lab in Armenia, team and history](https://test4net.com/about?hsLang=en) [Why TEST4NET What you get that vendor slides never show](https://test4net.com/why-test4net?hsLang=en) Our Lab & Certifications Equipment, methods and the standards we test against Partner Program Resell, integrate and co-test with us [Contacts Talk to an engineer, not a sales bot](https://test4net.com/contacts?hsLang=en) [Support portal](https://test4net.com/support?hsLang=en) - CLOUDLAB How It Works Equipment & Capabilities Access Plans [Log in to CloudLAB POPULAR](https://lab.test4net.com) - SERVICES Network Test & Validation Load & Performance Testing Functional Testing Conformance Testing Interoperability Testing Security & Resilience Testing All testing services Automation & Expertise Test Automation & CI/CD Test Plan & Methodology Design Training Programs Lab & Equipment Lab Rental Hosted DUT Testing Equipment Repair [Not sure where to start? Get a test plan for your setup](https://test4net.com/contacts?hsLang=en) - SOLUTIONS By Technology Routing & Switching Firewalls & NGFW SD-WAN & WAN Cloud & NFV 5G & Mobile Core Wi-Fi Storage & Infrastructure AI / Switching Fabric (RoCEv2) All technologies By Industry Telecom Operators Network & Security Vendors Banks & Financial Services System Integrators Enterprise IT Teams Managed Service Providers Media, Broadcast & Streaming Government & Public Sector All industries By Task Pre-deployment Validation Vendor Selection Cloud Migration Readiness AI/GPU Cluster & RoCEv2 Readiness New Technology Rollout Troubleshooting & Benchmarking Disaster Recovery & Failover Testing SLA Validation & Vendor Accountability All tasks - VENDORS Testing Tools & Lab Ixia / Keysight POPULAR Emblasoft NEW Apposite Technologies T-Plan Cubro Candela Technologies Netitest How we integrate the tools IT Infrastructure HPE Vinchin Yeastar Become a partner - RESOURCES Read [Blog](https://test4net.com/blog?hsLang=en) [Industry News](https://test4net.com/news?hsLang=en) FAQ Technologies / Protocols BGP OSPF & IS-IS MPLS & Segment Routing EVPN / VXLAN IPsec & IKEv2 TLS / HTTPS RoCEv2 Wi-Fi 6 / 6E / 7 All protocols Methodologies [RFC 2544](https://test4net.com/methodologies/rfc-2544?hsLang=en) RFC 2889 [RFC 9411 / RFC 3511](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 RFC 5180 ITU-T Y.1564 ITU-T Y.1731 TR-398 All methodologies From the blog [Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test Wi-Fi](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) [One Test Is Not Enough: Why Security Infrastructure Needs Continuous Validation Security](https://test4net.com/blog/security-platform-continuous-validation-updates?hsLang=en) [How to Run a Security Product Test You Can Actually Trust Methodology](https://test4net.com/blog/how-to-run-a-security-product-test-you-can-actually-trust?hsLang=en) - COMPANY [About Us](https://test4net.com/about?hsLang=en) [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) Our Lab & Certifications Partner Program [Contacts](https://test4net.com/contacts?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) [All articles](https://test4net.com/blog) # NGFW Testing: Fast Paths, Fake AppMix, and PCAP Replay Traps ![](https://test4net.com/hubfs/IMG_0070.jpg) [Alexander Zemskov](https://test4net.com/blog/author/az) July 10, 2026 7 min read ![](https://test4net.com/hs-fs/hubfs/AI-Generated%20Media/Images/Hardware%20Firewall%20with%20Shadow%20Overlay%20and%20Abstract%20Flow%20Lines.png?width=1672&height=941&name=Hardware%20Firewall%20with%20Shadow%20Overlay%20and%20Abstract%20Flow%20Lines.png) In this article *This is part two of a six-part series on evaluating network security products.* *[Part 1](https://test4net.com/blog/security-product-datasheet-gap?hsLang=en)covered the structural datasheet gap that applies across the entire security industry.*   Next-generation firewalls are the most purchased, most frequently benchmarked, and most poorly evaluated category in enterprise security. The testing traps here are well-known inside the industry — and consistently unknown to the buyers making procurement decisions. ## The Fast Path: A Feature That Becomes a Testing Trap Most enterprise NGFW platforms include custom ASICs or dedicated security processors. These chips can offload specific traffic categories to a hardware fast path that bypasses the software stack entirely. This is a legitimate and valuable architectural feature — under the right conditions, it delivers real performance gains with genuine security inspection.   ##### The problem is the phrase "under the right conditions." Hardware fast paths activate most effectively when traffic is uniform, predictable, and simple: long-lived sessions with large payloads, steady connection rates, cleartext or easily classified protocols. Under those conditions, the ASIC handles most of the work and the software stack is largely idle. Throughput approaches the theoretical hardware maximum.   Real enterprise traffic is structurally different: short sessions, many small objects, TLS 1.3 with encrypted SNI and ESNI, non-standard ports, proprietary application protocols, bursts of new connection establishment. Under real traffic, fast path coverage drops substantially and the software stack carries most of the load.   A poorly designed test — or a test designed to produce favorable results — generates traffic that looks like the first scenario. The device performs excellently. That performance does not survive contact with the production environment.   ## Vendor-Specific Test Modes: The Optimization That Nobody Announces Beyond legitimate fast path behavior, there is a more deliberate category of optimization worth understanding.   Vendors know which traffic generators are commonly used for security product testing. They know the profiles, the patterns, the typical PCAP files used in evaluations. Some platforms implement optimizations specifically triggered by these known profiles: DPI result caching for sessions that are byte-for-byte identical to previously seen flows, parser shortcuts for exact payload patterns that appear in common test sets, fast-path rules keyed to characteristics of specific test traffic generators.   These optimizations produce impressive benchmark numbers. They provide little or no benefit against real diverse traffic — and in some cases introduce behavioral differences that only appear under realistic load.   The practical implication: a device that scores well against a familiar test tool may not score comparably well against a methodology it has not been prepared for. Independent testing with a tool the vendor cannot profile in advance is the only way to see past this.   ## The AppMix Problem: The Traffic Distribution You Configured Is Not the One That Transited Your Device This is the most technically subtle problem in NGFW testing, and the most consistently overlooked.   When you configure a test with **a target application mix** — say 25% HTTPS, 20% HTTP, 15% DNS, 15% SMTP, 10% video, 10% database, 5% custom — you expect that distribution to actually move through the device under test. It does not.   **Free and open-source traffic generators** schedule new sessions according to configured weights. They do not account for how long each protocol type takes to process on the DUT. This matters because security processing is not uniform across protocol types.   **Heavy protocols** — TLS with mutual authentication, SMTP with large attachments, protocols requiring extended DPI classification — consume more processing time per session on the DUT. They queue. They slow down. The generator, unaware of this, keeps launching new sessions at the configured rate. Light protocols — plain HTTP, DNS queries, small UDP — process quickly and move through the device at full speed.   **The result**: over the course of the test, the actual traffic mix transiting the DUT shifts toward the lightest, fastest-processing protocols. Your device appears to handle 10 Gbps with full inspection. It genuinely is handling 10 Gbps — but 60% of it is plain HTTP and DNS, because the SMTP and TLS sessions you configured are stalled in queues or being dropped.   The throughput number is real. The traffic profile it was measured against is not what you intended.   **Why this makes cross-vendor comparison meaningless without AppMix control.** Device A handles heavy protocols efficiently — it processes TLS and complex DPI at moderate overhead. Under your test, Device A's actual AppMix at the DUT is close to what you configured: roughly the intended distribution. Device B drops heavy-protocol sessions faster — the overhead is too high and connections time out. Device B's actual AppMix is dominated by light traffic. Device B shows higher throughput.   You conclude Device B outperforms Device A. You are measuring them with different rulers and do not know it.   ## PCAP Replay: The Tool That Tells Vendors Exactly What Is Coming TRex and many testing tools from China using pcap replay mode to reproduce pre-recorded traffic captures. Every session at L7 is byte-for-byte identical to every other session of the same type. Same headers. Same payloads. Same sequence numbers, same SNI, same URI patterns — repeated indefinitely.   The vendor testing your product knows which tools buyers use. They know the PCAP files. They know the payload patterns. It costs nothing to optimize for them.   Specific optimizations that work against deterministic PCAP replay traffic:   - DPI result caching: If two TCP sessions have identical payloads, classify the second one instantly from cache rather than running full DPI. This produces dramatically higher throughput against replay traffic and near-zero benefit against real diverse sessions. - Fast-path rules for known-good patterns: A session that matches a known exact pattern from a test PCAP can be fast-pathed after minimal inspection. This does not apply to sessions where payload varies. - Parser shortcuts: Some DPI engines implement shortcuts for payload patterns that appear frequently in test traffic. These shortcuts do not generalize to novel application data. The argument for using free tools is cost. The true cost accounting should include: engineering time to build the test bench, time spent resolving scaling limitations, time spent designing the methodology — and then the cost of making a multi-year procurement decision based on results the vendor prepared for. That is not a cheap test.   ## What Good NGFW Testing Looks Like The gap between a well-designed test and a poorly designed one comes down to three controllable variables.   **Dynamic traffic generation.** Every session must be generated dynamically during the test — unique headers, unique tokens, unique payloads at L7. No two sessions of the same type should be byte-for-byte identical. This prevents caching optimizations and ensures the device is classifying every flow from scratch, which is what it will do in production.   **Closed-loop AppMix control.** The traffic generator must measure the actual application mix transiting the DUT and feed that back into session scheduling. If the measured mix drifts from the target, scheduling weights are adjusted dynamically. Without this, the AppMix you report is the AppMix you configured, not the AppMix you measured — and those are not the same number.   **Security effectiveness under load.** Attack injection must occur within the background traffic stream, at realistic load levels — not in isolation with the device at idle. A device that blocks 99% of attacks at 5% utilization and 70% of attacks at 80% utilization is a fundamentally different security outcome than a headline detection rate suggests.   These are not exotic requirements. They are standard practice for infrastructure qualification at major carriers and financial institutions. They are achievable with the right tooling and methodology.   *Next in this series — Post 3: WAF, IPS, and DLP — why content inspection testing is harder than it looks, and how evasion coverage separates products that protect you from products that protect you in demos.*   *TEST4NET LLC is an independent network and security testing laboratory operating with no commercial relationships to any security vendor. Contact us to discuss your NGFW evaluation.*   Share Pass it on to someone who runs a network Independent lab data is most useful in the hands of the people who make the call. Send this piece to a colleague. [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fngfw-testing-fast-path-appmix-pcap) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fngfw-testing-fast-path-appmix-pcap&text=NGFW+Testing%3A+Fast+Paths%2C+Fake+AppMix%2C+and+PCAP+Replay+Traps) [Telegram](https://t.me/share/url?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fngfw-testing-fast-path-appmix-pcap&text=NGFW+Testing%3A+Fast+Paths%2C+Fake+AppMix%2C+and+PCAP+Replay+Traps) [WhatsApp](https://wa.me/?text=NGFW+Testing%3A+Fast+Paths%2C+Fake+AppMix%2C+and+PCAP+Replay+Traps%20https%3A%2F%2Ftest4net.com%2Fblog%2Fngfw-testing-fast-path-appmix-pcap) Copy link More apps ![](https://test4net.com/hubfs/IMG_0070.jpg) Written by ### [Alexander Zemskov](https://test4net.com/blog/author/az) Alexander Zemskov leads network and security testing at TEST4NET, an independent, vendor-neutral testing lab in Yerevan, Armenia. With 19+ years in performance and load testing on IXIA, Spirent, Keysight, Xena and Xinertel platforms, he runs NGFW, WAF, IPS, DLP and SASE evaluations for telecom operators, banks and system integrators. [LinkedIn](https://www.linkedin.com/in/azemskov/) [Website](https://test4net.com/?hsLang=en) [Previous article The Security Datasheet Lie — And Why It Is Structural](https://test4net.com/blog/the-security-datasheet-lie-and-why-it-is-structural?hsLang=en) [Next article WAF, IPS, and DLP: Why Content Inspection Testing Is Harder Than It Looks](https://test4net.com/blog/waf-ips-dlp-content-inspection-testing?hsLang=en) ### Comments In this article Put it to the test ### Have a device to put through this? Send us the shortlist and the KPIs that decide it. We will come back with a scoped test plan, a timeline and a fixed price. [Talk to a test engineer](https://test4net.com/contacts?hsLang=en) Blog ## Keep reading [News](https://test4net.com/blog/tag/news) ### [Calnex: the clock nobody checks, and the 5-hour outage that proves it](https://test4net.com/blog/calnex-the-clock-nobody-checks-and-the-5-hour-outage-that-proves-it?hsLang=en) Calnex published a piece on timing resilience by Stefano Ruffini, rapporteur of ITU-T SG15 Q13 (Calnex blog, 19 August 2026). The thesis is short: networks encrypt traffi… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 2 min read [News](https://test4net.com/blog/tag/news) ### [Keysight: flowlet balancing evens out AI fabric traffic where ECMP piles it up](https://test4net.com/blog/keysight-flowlet-ai-ecmp?hsLang=en) Keysight published a short lab study on load balancing in AI data-center fabrics (Eric Yu, Keysight blog, 27 May 2026). Short version: the traffic of a training job break… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 2 min read [![Wi-Fi testbed diagram: controller, access point under test on a turntable in an RF chamber, emulated client chamber and second AP chamber connected through programmable attenuators](https://test4net.com/hubfs/blog-covers/wifi-testing-cover-2.png)](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) ### [Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) Wi-Fi used to be the network you tolerated. Now it carries the video call with the customer, the telehealth session, the factory floor and the classroom. This post is abo… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 15 min read [![TEST4NET LLC](https://test4net.com/hubfs/test4net-logo-fixed.svg)](https://test4net.com?hsLang=en) Independent testing and validation for telecom, information security and cloud infrastructure — real insights, not assumptions. [mailto:sales@test4net.com](mailto:sales@test4net.com) #### Navigate - [Home](https://test4net.com/?hsLang=en) - [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) - [About us](https://test4net.com/about?hsLang=en) - [Contact](https://test4net.com/contacts?hsLang=en) - [Blog](https://test4net.com/blog?hsLang=en) - [Industry News](https://test4net.com/news?hsLang=en) #### Get in touch Sales [sales@test4net.com](mailto:sales@test4net.com) Support [support.test4net.com](https://support.test4net.com) © 2026 TEST4NET LLC. All rights reserved. [Privacy Policy](https://test4net.com/privacy-policy?hsLang=en) [Legal](https://test4net.com/legal?hsLang=en) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alexander Zemskov", "url" : "https://test4net.com/blog/author/az" }, "dateModified" : "2026-09-06T20:10:28.588Z", "datePublished" : "2026-07-10T16:32:09.000Z", "headline" : "NGFW Testing: Fast Paths, Fake AppMix, and PCAP Replay Traps", "image" : [ "https://test4net.com/hubfs/AI-Generated%20Media/Images/Hardware%20Firewall%20with%20Shadow%20Overlay%20and%20Abstract%20Flow%20Lines.png" ], "mainEntityOfPage" : { "@id" : "https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://test4net.com/hubfs/test4net-logo-fixed.svg" }, "name" : "TEST4NET LLC" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AM", "addressLocality" : "Yerevan", "postalCode" : "0033", "streetAddress" : "3 Hakob Hakobyan Street (Mergelyan Hub)" }, "alternateName" : "TEST4NET", "contactPoint" : { "@type" : "ContactPoint", "availableLanguage" : [ "en", "ru", "hy" ], "contactType" : "sales", "email" : "sales@test4net.com", "telephone" : "+374-60-88-88-99" }, "description" : "Independent, vendor-neutral lab for testing network and cybersecurity products — NGFW, WAF, IPS, DLP and SASE — and an authorized distributor of test, measurement and network infrastructure solutions.", "email" : "sales@test4net.com", "foundingDate" : "2024", "image" : "https://test4net.com/hubfs/og-t4n.png", "logo" : "https://test4net.com/hubfs/test4net-logo-fixed-2.svg", "name" : "TEST4NET LLC", "sameAs" : [ "https://www.linkedin.com/company/test4net/", "https://t.me/TEST4NET", "https://www.facebook.com/people/Test4net-LLC/61591470856077/" ], "telephone" : "+374-60-88-88-99", "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#website", "@type" : "WebSite", "inLanguage" : "en", "name" : "TEST4NET", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : { "@type" : "EntryPoint", "urlTemplate" : "https://test4net.com/hs-search-results?term={search_term_string}" } }, "publisher" : { "@id" : "https://test4net.com/#organization" }, "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://test4net.com/", "name" : "TEST4NET", "position" : 1 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap", "name" : "NGFW Testing: Fast Paths, Fake AppMix, and PCAP Replay Traps", "position" : 3 } ] } ```