urbenlegend/netimpair

An easy-to-use network impairment script for Linux written in Python

netimpair

An easy-to-use network impairment script for Linux written in Python

netimpair.py is a CLI tool that simulates bad network conditions on Linux machines. It essentially is a wrapper script around the Linux netem module and the tc command. Using tc and netem is sometimes difficult, unintuitive or tedious at best, especially if you only want to impair a specific subset of network traffic. netimpair.py automates all of this and provides a simpler CLI interface for basic network impairment needs.

NOTE: Fedora users may need to install kernel-modules-extra if they're getting the below error:

RTNETLINK answers: No such file or directory
Traceback (most recent call last):
  File "./netimpair.py", line 295, in main
    args.toggle)
  File "./netimpair.py", line 175, in netem
    self.nic))
  File "./netimpair.py", line 58, in _check_call
    subprocess.check_call(shlex.split(command))
  File "/usr/lib64/python2.7/subprocess.py", line 541, in check_call
    raise CalledProcessError(retcode, cmd)
CalledProcessError: Command '['tc', 'qdisc', 'add', 'dev', 'wlp3s0', 'parent', '1:3', 'handle', '30:', 'netem']' returned non-zero exit status 2

Features

netimpair.py can do the following things:

• Simulate packet loss, duplication, jitter, reordering, and rate limiting
• Selective impairment based on ip/port
• Inbound or outbound impairment
• Automatically cleans up any impairment on exit or Ctrl-C

netimpair.py supports both Python 2 and 3.

Jitter

# Add 200ms jitter
sudo ./netimpair.py -n eth0 netem --jitter 200

Delay

# Add 200ms delay
sudo ./netimpair.py -n eth0 netem --delay 200

Loss

# Add 5% loss
sudo ./netimpair.py -n eth0 netem --loss_ratio 5

Rate Control

# Limit rate to 1mbit
sudo ./netimpair.py -n eth0 rate --limit 1000

Impair inbound traffic

# Append --inbound flag before the impairment keyword to apply inbound impairment
# For example, this applies 5% loss on inbound eth0
sudo ./netimpair.py -n eth0 --inbound netem --loss_ratio 5

Selectively impair certain traffic

# Add 5% loss on packets with source IP of 10.194.247.50 and destination port 9001
# NOTE: Specifying include flag overrides the default include, which impairs everything
sudo ./netimpair.py -n eth0 --include src=10.194.247.50,dport=9001 netem --loss_ratio 5
# Exclude packets with destination IP 10.194.247.50 and source port 10000
sudo ./netimpair.py -n eth0 --exclude dst=10.194.247.50,sport=10000 netem --loss_ratio 5
# Exclude SSH 
sudo ./netimpair.py -n eth0 --exclude dport=22 netem --loss_ratio 5
# Exclude a certain source IP on all ports
sudo ./netimpair.py -n eth0 --exclude src=10.194.247.50 netem --loss_ratio 5

Additional parameters can be found with the help option

# Basic help
./netimpair.py -h
# Help for the netem subcommand
./netimpair.py netem -h
# Help for the rate subcommand
./netimpair.py rate -h

netimpair's Issues

Add Packet corruption

https://wiki.linuxfoundation.org/networking/netem
Random noise can be emulated (in 2.6.16 or later) with the corrupt option. This introduces a single bit error at a random offset in the packet.

tc qdisc change dev eth0 root netem corrupt 0.1%

Make an importable package?

Hey @urbenlegend,

I'm very interested in using this code as part of a remote control tool for shaping traffic between nodes in a cluster.

Would you be open to a PR which properly packages this as an importable module and also adds support for remote tc invocation over ssh and via rpyc?

Add unit tests

I think this should be pretty straight forward using mock to ensure the API and CLI correctly render tc commands.

If we wanted to get fancy down the road we could even do state checking on a minimal docker container that could be dynamically spun up for testing on travis.

Make code PEP8 compliant

Code is messy right now. Make it PEP 8 compliant

Remove use of sudo in code and instead check for root privileges

Remove use of sudo in code and instead check for root privileges

Remove ifb kernel module on teardown

I've noticed that netimpair neglects to delete the ifb0 and ifb1 interfaces added by modprobe ifb (i.e. never unloads the kernel module).

I think it would be sensible to detect if the module is loaded at start (modprobe --first-time ifb will error if it is) and then run modprobe -r ifb on tear down if the module wasn't active at start.

This preserves the system state on target machines after netimpair has done it's dirty work ;)

Error under ubuntu 18.04

Hi @urbenlegend , I would like to have some help from you. I'm trying to use your tool for a final project.
After running the following command:
sudo python netimpair.py -n ens33 netem --delay 200

Error: Cannot delete qdisc with handle of zero.
Including the following for network impairment:
tc filter add dev ens33 protocol ip parent 1:0 prio 3 u32 match ip src 0/0 flowid 1:3
tc filter add dev ens33 protocol ipv6 parent 1:0 prio 4 u32 match ip6 src ::/0 flowid 1:3

Excluding the following from network impairment:
tc filter add dev ens33 protocol ip parent 1:0 prio 1 u32 match ip dport 22 0xffff flowid 1:2
tc filter add dev ens33 protocol ip parent 1:0 prio 1 u32 match ip sport 22 0xffff flowid 1:2
tc filter add dev ens33 protocol ipv6 parent 1:0 prio 2 u32 match ip6 dport 22 0xffff flowid 1:2
tc filter add dev ens33 protocol ipv6 parent 1:0 prio 2 u32 match ip6 sport 22 0xffff flowid 1:2

Network impairment starting. Press Ctrl-C to restore normal behavior and quit.

Setting network impairment:
tc qdisc change dev ens33 parent 1:3 handle 30: netem loss 0% 0% duplicate 0% delay 200ms 0ms 0% reorder 0% 0%
Illegal "loss percent"
Traceback (most recent call last):
File "netimpair.py", line 295, in main
args.toggle)
File "netimpair.py", line 185, in netem
self._check_call(impair_cmd)
File "netimpair.py", line 58, in _check_call
subprocess.check_call(shlex.split(command))
File "/usr/lib/python2.7/subprocess.py", line 190, in check_call
raise CalledProcessError(retcode, cmd)
CalledProcessError: Command '['tc', 'qdisc', 'change', 'dev', 'ens33', 'parent', '1:3', 'handle', '30:', 'netem', 'loss', '0%', '0%', 'duplicate', '0%', 'delay', '200ms', '0ms', '0%', 'reorder', '0%', '0%']' returned non-zero exit status 1
Network impairment teardown complete.

Add ability to do both rate and netem impairments at the same time