Network testing terms in plain words

An ordered list of rules on a router, switch or firewall that lets packets through or drops them by address, port and protocol. Long lists and IPv6 extension headers can push a device off its hardware path, so we test with your real rule set.

After a fault at its own level, a MEP sends AIS up to the client level, and the MEPs there hold back their own alarms. Without it one cut fibre raises alarms at every level at once.

The 5G core function that registers devices, has them authenticated and tracks them as they move between cells. Its limit shows in a registration storm, when a whole region comes back after an outage.

Finds the MAC address behind an IPv4 address on the local segment and keeps it in a cache. Before each trial the generator fills that cache, otherwise the first seconds lose packets to address resolution.

A burst of frames at line rate with minimum gaps. The test finds the longest burst the device absorbs without loss.

Link speed times RTT, the amount of data in flight on a path. A TCP window smaller than the BDP caps throughput.

A fast hello that notices a dead link or neighbour within tens of milliseconds and tells routing to switch over

Routing protocol between networks and providers. A full IPv4 internet table is close to a million routes.

Port memory that holds frames while the output is busy. A deeper buffer absorbs longer bursts but adds latency, and once it is full, frames are dropped.

How many bytes a service may send in one go above its rate: CBS for committed traffic, EBS for excess. Set too small, the policer drops short bursts that the average rate never shows.

The heartbeat MEPs exchange in Ethernet OAM. When several in a row go missing, a fault is raised.

The bandwidth a provider guarantees for a service. Traffic within it must pass with the agreed delay and loss.

How many open TCP sessions a firewall or load balancer holds at once without dropping any. Each one takes memory in the state table, so the limit is set by memory more than by port speed.

The time a network needs to find and use a new path after a link or node fails. Traffic lost in that time is what users notice.

How many new sessions a firewall or load balancer sets up each second

A 4-byte checksum at the end of every Ethernet frame. The receiver recomputes it and drops a frame that does not match, and a growing CRC error counter usually points to a cable, optic or port fault.

Congestion control for RoCEv2: switches mark packets with ECN, the receiver sends a notification back, and the sender's NIC cuts its rate, then raises it step by step. Its settings decide how often PFC pauses fire.

The Y.1731 frame that measures two-way delay between MEPs

Libraries that let an application take packets straight from the network card in user space, bypassing the operating system kernel. A virtual router or firewall on DPDK forwards several times more packets per CPU core than through the kernel network stack.

Looking past the headers into the payload to tell which application a flow belongs to. DPI throughput depends on the application mix, so numbers taken on a flat packet stream do not hold in a real network.

A 6-bit field in the IP header that marks the traffic class of a packet, for example 46 (EF) for voice. Each hop maps it to a queue, and a test checks that the mark survives the whole path and lands in the right queue.

The unit whose behaviour the test measures. Everything else on the bench is the measuring side.

Traffic spread over several paths of the same cost by a hash of packet headers. A poor hash loads one path and leaves the others idle.

A switch marks packets instead of dropping them, and the sender slows down

Bandwidth above the CIR that the network carries when it has room, with no delay or loss guarantee

The Ethernet service a provider sells between two or more UNIs, point-to-point or multipoint, with its own CIR, EIR and SLA. Y.1564 checks each EVC on its own, then loads them all together.

A BGP control plane for layer 2 and layer 3 VPNs. In data centers it usually runs with VXLAN.

Extra bits that let the receiver rebuild lost or damaged data without asking for it again

The RIB is the routing table the control plane builds from all protocols, the FIB holds the best routes from it in the forwarding chips. A test checks how many routes really fit in the FIB and how fast changes reach it.

The share of frames the generator sent that never came out of the device

Length of an Ethernet frame from the destination MAC to the FCS. RFC 2544 uses 7 sizes from 64 to 1518 bytes, jumbo frames reach 9000 bytes and more. Small frames load packet processing, large ones the bandwidth.

The 5G base station. It handles signalling with the AMF and sends subscriber traffic to the UPF over GTP-U, and on the bench we emulate it together with thousands of subscribers.

Application data delivered per second, after headers, retransmissions and duplicates are taken out. On a lossy path goodput drops well below the raw throughput.

While the control plane of a router restarts, neighbours keep its routes and the forwarding chips (NSF) keep sending on the old table. A test restarts the process with traffic running and counts the loss.

The tunnel that carries subscriber packets between the base station and the UPF, each packet wrapped in UDP with a tunnel ID. The UPF removes or adds that header and finds the tunnel for every packet at 10G to 100G.

Two units in a cluster, one takes over when the other fails. The test measures how much traffic is lost during the switch.

Frames for a free port wait in the queue behind a frame for a congested port. RFC 2889 checks it with 4 ports: if traffic to the uncongested port loses frames, the switch has HOLB.

The protocol of the web. HTTP/1.1 sends one request at a time per TCP connection, HTTP/2 runs many streams over one connection, and HTTP/3 does the same over QUIC.

The minimum pause between Ethernet frames, 96 bits or 12 bytes. With the 8-byte preamble it adds 20 bytes to every frame on the wire, and RFC 2889 sends with 88 bits to catch switches that shorten the gap.

The protocol that sets up IPsec tunnels: the two ends authenticate each other, agree on ciphers and keys, and renew the keys on a timer. Devices from different vendors often fail to work together right here, at setup or at rekey.

A blend of small, medium and large frames sent instead of one fixed size. The classic simple IMIX mixes 64, 570 and 1518 bytes in a 7:4:1 ratio.

Many senders answer one receiver at the same moment, so their traffic meets on one switch port and overflows its buffer. AI training and storage work this way, and the test adds senders step by step and counts drops and pauses on the port.

How many read or write operations a storage system completes each second. The figure means little without the block size, queue depth and latency it was measured at.

Checks traffic inline against signatures and blocks what matches

A protocol suite that encrypts IP packets and checks their origin, in tunnels between sites or from remote users. Encryption costs throughput, so a gateway is measured with your tunnel count, ciphers and packet sizes.

Link-state routing protocol common in operator cores. Close to OSPF in idea, it runs directly over layer 2.

Variation in delay from one packet to the next. Voice and video suffer from it long before the average delay looks bad.

A number agreed before the test that decides pass or fail, for example zero loss at 40 Gbit/s or failover under 50 ms

Remote keyboard, screen and mouse of a bench device, opened in the browser. Your engineer sees the console from power-on and can reinstall or recover the unit without anyone at the rack.

Bundles several physical links between two devices into one logical link and keeps both ends in agreement on its members. The test measures how evenly traffic spreads and how much is lost when one member goes down.

The time a frame takes to cross a device or a path in one direction. RFC 2544 measures it at the throughput rate for each frame size, and the maximum often says more than the average.

Hands out MPLS labels to neighbours, one per prefix, along the paths OSPF or IS-IS already chose. If routing moves to a new path before LDP has labels for it, traffic is dropped in between.

The full speed of a port. At 10GbE that is about 14.88 million 64-byte frames per second.

Each device tells its direct neighbours its name, port and capabilities in a short frame every 30 s. Monitoring and automation build the topology map from it, and switch benchmarks filter these frames out of the counts.

Y.1731 loss measurement on live traffic: MEPs swap their frame counters in LMM and LMR and compute near-end and far-end loss. It relies on exact service counters, so we check the result against the generator count.

A switch reads the source MAC of each frame and records the port it came in on, so later frames to that address go to one port without flooding. RFC 2889 measures how fast the table fills and how many addresses it holds.

Encryption of Ethernet frames on each hop between two directly connected ports, usually done in the port hardware at line rate. The test checks that throughput and latency stay the same with it switched on.

The MEPs that watch one Ethernet service together. Each MEG has a level from 0 to 7, so customer, provider and operator run their own OAM on the same link without mixing frames.

The edge of an Ethernet OAM domain that sends and answers checks and measurements

A burst at line rate that lasts microseconds or milliseconds. Per-second counters average it away, while the port buffer overflows and drops frames.

The highest frame rate a traffic source can send to the device under test. RFC 2889 measures the forwarding rate at this load to show how a switch behaves when overloaded.

Voice or video quality on a scale from 1 to 5, estimated from loss, delay and jitter

Packets are forwarded by short labels instead of full IP lookups. Operators run VPNs and traffic engineering on it.

The largest TCP payload in one packet, announced in the handshake. With a 1500-byte MTU it is 1460 bytes over IPv4 and 1440 over IPv6.

The largest packet a link carries without fragmentation. A mismatch along the path often shows up as slow or stuck sessions.

An AP sends separate streams to several clients at the same moment and uses its antennas to aim each stream. The test compares the total throughput with serving the same clients one after another.

Rewrites addresses and ports as packets cross a router or firewall, for example many private hosts behind one public address. The device keeps an entry for every session, and we measure how large that table grows and how fast new entries are created.

A gateway that lets IPv6-only clients reach IPv4 servers by translating each packet from one protocol to the other. It usually works together with DNS64, and we test it with the transition cases of RFC 8219.

Flow records exported by routers: addresses, ports, packet and byte counts per flow. IPFIX is the IETF standard based on NetFlow v9. We build traffic profiles from 7 days of such exports.

Several logical networks on one 5G infrastructure, each with its own QoS, capacity and isolation, for example one for phones and one for factory sensors. The test checks that load on one slice does not hurt the others.

Network functions move from dedicated boxes to software on standard servers, where an orchestrator starts, scales and moves them. Performance then depends on the hypervisor, the vSwitch or SR-IOV and how cores are pinned.

A firewall that sees applications and users and adds IPS, URL filtering and TLS inspection. Throughput falls as each feature is switched on.

The software of a switch or router, for example SONiC on white-box hardware

In a server with two or more CPU sockets, each socket has its own memory and PCIe slots. A VNF whose cores, memory and network card sit on different sockets loses throughput, so the NUMA node goes into the report.

Tools built into a protocol to check and measure a live link

Wi-Fi 6 and later split one channel into small resource units, so an AP serves several clients in the same transmission. The gain shows when there are many clients and small packets, so that is how the test loads the AP.

Link-state routing inside one network. Each router knows the whole topology and computes the shortest paths itself.

The standard file format for captured packets, opened by Wireshark and tcpdump. A capture taken around a failure lets anyone check a disputed result frame by frame.

A 3-bit priority field in the VLAN tag with values from 0 to 7, defined by IEEE 802.1p. Switches pick the queue by it, and it is lost wherever the tag is stripped from the frame.

The data connection a 5G device opens through the core: an IP address, a path through the UPF and QoS rules. The p95 setup time during a mass attach is one of the figures a core is accepted on.

Pauses one traffic class on a link so lossless traffic such as RoCEv2 is not dropped under load

The FIB keeps a backup next hop ready, so after a failure the router switches one pointer for all prefixes at once. In a typical core case with 1M BGP routes, tuning BFD and PIC cut the loss from 1.9 s to 180 ms.

A rate limit that drops or re-marks traffic above the limit at once, with no buffer. Y.1564 offers 25% above CIR + EIR and checks that the policer cuts the flow back to the limit without touching frames within the CIR.

Traffic is sorted into classes, each with its own queue, bandwidth share and drop rules, so voice and control traffic get through when a link is full. It only shows under congestion, so a test overloads the egress port from several inputs.

Transport over UDP with TLS 1.3 built in, the base of HTTP/3. A connection opens in 1 round trip or in 0 on resumption, and a lost packet holds up only its own stream.

The server that checks who a user or device is and tells the network what it may access, for example at a Wi-Fi login with 802.1X. When many clients join at once, its response time sets how long they wait.

A flag a MEP sets in its own CCMs when it stops receiving those of its peer. The far end learns that its frames no longer arrive, and the test times how long RDI takes to appear and to clear.

IETF methodology for benchmarking routers and switches: throughput without loss, latency, frame loss rate and back-to-back bursts, for each frame size

IETF methodology for benchmarking LAN switches: full-mesh forwarding, behaviour under congestion, MAC table size and address learning rate

The earlier IETF methodology for firewall performance: connection setup rate, concurrent connections and HTTP throughput. RFC 9411 replaced it for modern devices.

The RFC 2544 benchmarks redone for IPv6, with IPv6 frame sizes and extension headers

Framework for TCP throughput testing: shows what an application really gets over a path, given the RTT, the bottleneck and the TCP window

IETF methodology for benchmarking next-generation firewalls and other security devices with real application traffic and the security features switched on

A Wi-Fi client moves from one access point to the next without dropping its session. We time each handover from the last frame through the old AP to the first frame through the new one, with voice and video running.

Servers read and write each other's memory over UDP with microsecond latency. AI clusters and storage fabrics run on it.

How long a packet takes to reach the far end plus the time the reply takes to come back

The receiver reports which blocks arrived after a gap, so the sender resends only what is missing. Without SACK, several losses in one window are repaired one per round trip, which hurts most on long, fast paths.

Network and security functions such as SD-WAN, firewall, web proxy and access control, delivered from the provider's cloud points instead of boxes at each branch. We test it from the bench as the client side.

Branch WAN run by policy: the edge picks MPLS, internet or LTE for each application, based on the quality it measures on each link

The source writes the path into the packet as a list of segments, so core nodes keep no per-path state and need no LDP or RSVP-TE. SR-MPLS carries the list as MPLS labels, SRv6 as IPv6 addresses.

Traffic above a set rate waits in a buffer and leaves later, so bursts are smoothed at the cost of extra delay. A policer drops the same excess at once, and a test shows which of the two sits on the path.

The figures a provider commits to, such as availability, delay and loss, and what happens when they are missed

Y.1731 loss measurement on test frames: a MEP sends numbered SLM frames, the peer answers with SLR, and loss is counted on them alone. No service counters are needed and it works on multipoint services, but it samples a small share of traffic.

Splits one physical network card into several virtual ones, so virtual machines skip the software switch

Blocks redundant links in a switched network so frames cannot loop, and opens a backup link when the active path fails. Classic STP needs 30–50 s to switch over, RSTP usually under a second.

Transport that delivers a byte stream in order and resends what is lost. Its speed depends on RTT, window and loss, so a link that carries UDP at full rate can be slow for TCP.

How many bytes a TCP sender may have in flight before it waits for an acknowledgement. Throughput cannot exceed the window divided by RTT, whatever the link speed.

The highest rate at which a device forwards every frame it receives, with zero loss. RFC 2544 finds it by binary search for each frame size.

The encryption under HTTPS and most application traffic. Decrypting it for inspection is the heaviest job a firewall does.

Completed request and response pairs per second, such as HTTP GETs. RFC 9411 measures it for several object sizes with the security features switched on.

Broadband Forum test plan for Wi-Fi access points: throughput, range, many clients at once, roaming and coexistence with neighbouring networks

What the generator sends: the mix of applications, packet sizes and session rates. We build it from your network data where we can.

Time from sending a request to receiving the first byte of the response. In a firewall test it shows the delay added by TCP and TLS setup and by inspection.

Time from sending a request until the last byte of the response arrives. For large objects it follows throughput, for small ones it stays close to TTFB.

Transport without connection setup, ordering or resends: each datagram goes out on its own. Voice, video, DNS, QUIC and VXLAN run over UDP, and the application deals with loss itself.

The port where customer equipment meets the provider network, the line where responsibility changes hands. Service tests run UNI to UNI, so every hop and policer of the provider is inside the measurement.

The 5G core node that carries subscriber traffic between the radio network and the internet

Splits one physical network into isolated layer 2 segments by a 12-bit tag in each frame, up to 4094 of them. A test checks that no frame leaks from one VLAN into another under full load.

A network function such as a router, firewall or UPF that runs as software: a VNF in a virtual machine, a CNF in containers on Kubernetes. Its numbers depend on the host, so the vCPU, memory and NIC profile are part of every result.

A private network built over a shared one with tunnels: IPsec or SSL between sites and users, MPLS in an operator network. For a VPN gateway we measure the tunnel count, the tunnel setup rate and throughput inside the tunnels.

Carries layer 2 frames inside UDP across an IP network, so one segment can stretch over racks and sites

A filter in front of a web application that checks each HTTP request against a rule set and blocks the ones that break it. We measure requests per second and the latency it adds with the full rule set on.

A real link recreated on the bench: delay, jitter, loss and a bandwidth cap set for each direction. The device meets a long or poor link without leaving the lab.

The IEEE 802.11be generation: 320 MHz channels, 4096-QAM and multi-link operation, where one client uses several bands at once. Our Wi-Fi 7 bench is still being built, so for now such APs are tested with Wi-Fi 6 and 6E clients.

The current Wi-Fi security standard. In personal mode SAE replaces the WPA2 pre-shared key exchange, in enterprise mode clients log in with 802.1X through a RADIUS server, and we check how clients join and roam with it and how the controller copes at scale.

ITU-T test for turning up Ethernet services: each service is checked against its CIR, EIR, delay, jitter and loss, first step by step, then all together in a long run

ITU-T OAM for Ethernet: continuity checks plus delay, delay variation and frame loss measured between MEPs on a live link