(go) Stress testing the Web using the Microsoft Web application Stress Tool

Http://www.blogjava.net/crespochen/archive/2009/06/02/279538.html

Web stress test is a popular topic at present, it is very good to test the endurance of Web server by using Web stress test to test the running status and response time of some Web servers effectively . Web Stress testing is often the use of tools such as Microsoft's Web application Stress, Linux siege, full-featured web-ct, and so on, which are excellent Web Stress test Tool.

While these tools are convenient for us to test server affordability, they are even more damaging, even using a single, more comprehensive test tool to launch a catastrophic denial-of-service attack on a small Web server. I'll take you on a Web stress test using Microsoft's Web application Stress , which is designed to make you see the big harm.

First, the tool simple introduction

Microsoft Web Application Stress tool is a set of tools developed by Microsoft's Web site testers dedicated to the actual site stress tests. With this powerful stress testing tool, you can use a small number of client computers to simulate the impact of a large number of users online on the site services, before the site actually line to the site of your design as a real-world test, to identify potential problems of the system, the system to further adjust, set up work. It is because of these characteristics that it has the function of D.O.s bombing.

Tip: D.O.s (Denial of service attack) prevents you from providing services by crashing your service computer or pressing it across. Simply put, your computer may be able to provide a number of services that can cause your computer to fall into the edge of a crash or crash.

Second, the tool simple setup

Open The Web application Stress tool , a very concise page (1), above the toolbar, the bottom left is the function options, the bottom right is the detailed settings options. Before you stress test the target Web server, make some necessary settings for it.

Figure 1

1. In the "Settings" function settings (2), one is Stress level (threads) Here is the number of the specified program in the background with how many threads to request, that is, the equivalent of simulating how many client connections, more image is said to set how many bombing threads. Generally fill in 500~1000, because this number of threads is based on the endurance of the machine set, if you have enough confidence in your own machine configuration, then the higher the setting, the better the bombing effect.
To change the number of concurrent users, click the Settings icon. If you have fewer than 100 users, you can set the stress level directly, and to simulate more than 100 users, you must also set stress Multiplier. The basic formula is: Number of users (number of threads) = Stress level * Stress Multiplier. If you want to simulate 1,000 users, you can set the Stress level to 100 and Stress Multiplier to 10.

Figure 2

2. In "Test Run time" to specify the duration of the stress test, divided into days, hours, minutes, seconds several units level, you set according to the actual situation!

3. The rest of the options are less important, and there is no longer a waste of ink, so friends can try their own settings.

Three, pressure test

The tool is finished, the following to prepare conditions: here and a friend to discuss the test, he is a stand-alone Internet, machine configuration is Cpu:athlon xp2500+, memory 512MB, hard disk 80GB, machine configuration is also good. He installed IIS on the machine, set up an external Web server, andthe program in the Web service was the dynamic Network 7.0. I tested this server with a stress test tool.

Step 1: Right-click in the tool and select the Add command to add a new test project: The script, set it, and in the main option, in the server, fill in the IP address of the server you want to test. Select the test Web connection method below, here the way verb Select Get,path Select the Web page path to test, here fill in/index.asp, that is, the homepage file of the dynamic Network (3).

Figure 3

Step 2: set the Stress level (threads) thread number to 1000 in the "Settings" feature setting. Once finished, the gray triangle button in the Point tool can be tested (4). Test finished, waiting for a friend to the Task manager and the connection to view the sent over!

Figure 4

After the attack, friends from Task Manager can see that the CPU usage has reached 100% and the loss rate has reached maximum (5). Using command Netstat-an in the cmd window, you can see that my IP address has a very many connections (6) on the 80 port on the friend server. and its web site has been opened, prompting too many users to connect, to achieve the same purpose as the D.O.s attack.

Figure 5

Figure 6

If you use more than one broiler to make a single serverWeb stress test, then it will be disastrous for this server, so friends must think carefully before using it.


Analyze test results
You can see the resulting report by the reports icon on the tool bar. This will result in a new tab that is adjacent to the Script tab. The report is stored in an outline view. First, at the bottom of your report, click Result Codes, which will give you a quick impression of what's wrong with this test. If you see a status code other than 200, you might want to investigate what's going on, and the usual problems include attribution and the incorrect URL path.

Point overview, you will see a brief and quick analysis of this test activity. From the technical point of view of ASP, Request per Second is a key value that needs to be analyzed in depth. The higher the value, the better. Typically, if you cannot determine a specific goal from the usage report and budget, you can make the ASP's requests per second value higher than 30, and of course the ASP is not connected to the database or using other components. Because it is foreseeable that connecting to the database increases the burden on the program.

Although there is a request per second This counter is included by default in was, you may want to add additional counters. You can add additional counters by adding counter after you click on the Perf counters icon. A particularly useful counter is the ASP requests Queued, which is often the key to identifying a blocked or long-lived page or component. Resources for analyzing ASP performance are:

· Tuning Internet Information Server performance

· Navigating the Maze of Settings for Web Server performance optimization

· IIS 4 Resource Kit

Factors that affect performance and measurable properties
Server composition, database access, and other factors will greatly reduce the ASP's request per second value. Different configuration options will also play a different role, here I would like to point out a few frequently occurring factors:

· If you are accessing a database, do you have a connection pool? For more information about connection pooling, see pooling in the Microsoft Data Access components.

· Are you using the ASP Session variable to store the state? Session variables can quickly affect testability. They require server resources, and if you want to add machines to scale performance, they can be a hindrance because the session is associated with a particular machine. Stateless is the way to maximize scalability. For an alternative to the session, please refer to this article: Howto:persisting Values without session.

· Do you have Visual Basic components stored in the session state? Get rid of them now. Visual Basic objects in the session can cause thread affinity and interfere with the thread pool that is attacking IIS. This is a complex subject, but the experience of satisfying it is: do not store single-threaded Apartment (STA) objects in the session. If you need to keep objects in session, they should be labeled "Both", and you need to aggregate these free threads yourself into a collection. The Active Template Library (ATL) can create monsters like this.

· Is your network program limited to running in its own memory space? In fact we recommend process protection. However, if you need to squeeze out some extra performance, running your network program in the process will save some of the overhead of cross-process collections.

· When it comes to Microsoft Transaction Server (MTS) components, there will be a noticeable performance difference if the component is running as a server package rather than a library package. A common recommendation is to set up a network program to run in its own memory space and then run the MTS component in the library package.

Simulating multi-user scenarios
I'll briefly show you how to simulate a multiuser request in was. You need to do two things:

1. Change the concurrent Connections in the Settings panel.

2. Create a user at the users, at least to create more than the number of users you specified in concurrent connections.

To change the number of concurrent users, click the Settings icon. If you have fewer than 100 users, you can set the stress level directly, and to simulate more than 100 users, you must also set stress Multiplier. The basic formula is: Number of users (number of threads) = Stress level * Stress Multiplier. If you want to simulate 1,000 users, you can set the Stress level to 100 and Stress Multiplier to 10.

If you try to run the script before you set enough users, you will get a warning. You can modify the number of users by using the Click Users icon, and you will see a default group in the right window. Double-click the default group to expand your list of users, and if you are allowed anonymous access, simply fill in the new user's code and click Create.

Run a test that requires a signature login
If you want to run a page that requires a signed login, you need to create an appropriate user name and password so that was can be used at run time. This is also set in the users. You can get rid of the current list of users by removing all from the beginning, then add the users you need, or you can choose to import the user name and password from the text file.

However, you need to make sure that these users have valid accounts and that they have access to the IIS server. If you are using Basic Authentication user account, you can test this account by submitting a certificate in your browser, it will be helpful to write the value of Request.ServerVariables ("Auth_User") in the text file. Our modified ASP code will look like this:

Ots.writeline ("Session Id:" & Session.SessionID & CHR) & _
"Time:" & Cstr (Now ()) & "AUTH USER:" & Chr & Request.ServerVariables ("Auth_User")
Tips and hints for using was
To conclude, I will provide some tips and hints, as well as some experience to summarize:

· Adjust the storage of log files for your site as this file will grow quickly (see IIS documentation)

· By setting the DWORD of Hkey_local_machinesoftwaremicrosoftwassessiontrace in the registry to 1, you can trace the activity of was in a debug manner

· If your was report shows an error, be sure to check the event log, browse your page in the tool's external browser, and then check the server's log: Winntsystem32logfilesw3svci

· If your test client machine has more processor usage than%85, you may need to add more test clients

· Some of the more interesting topics will appear in the documents of was: page Groups, Query Strings, Cookies, WEB application Stress Object model and active Server Page Client (this will give you the ability to test the client via web Remote control)

Please note that this is not a technical support tool, send your question to [email protected]. You can search for some common problems with Web application Stress tool. You can also program this tool and have a reference to the object model on the same website.

(go) Stress testing the Web using the Microsoft Web application Stress Tool