System Requirements

The following operating system platforms are officially supported:

Microsoft Windows 11
Ubuntu 20.04 LTS
Ubuntu 22.04 LTS
Ubuntu 24.04 LTS

Only 64-bit versions on Intel and AMD x64 architectures are supported. ARM based processors, including ARM64 architecture, are not supported.

If you plan on running Defensics 802.11 WLAN test suites, check the special requirements from the WLAN chapter.

Defensics has also been used in other operating systems or distributions, for example Fedora, Red Hat, CentOS, and macOS. However, it is officially tested and verified to work by on the standard Windows and Linux platforms listed above. Especially Defensics on macOS is not able to use licenses from FlexNet¹ license server.

Some test suites (such as OSPF, ARP, IPv4, IPv6, TCP, ICMP, IGMP, PIM, RSVP, GRE, DVMRP, IS-IS, IPsec, Ethernet test suites) use low level native code for raw IP and Ethernet packet injection, which is supported only in Windows and Linux platforms.

Defensics Bluetooth Test Suites can be used in Linux, or with FuzzBox setup in both Linux and Windows. See Bluetooth chapter for further information on using Bluetooth test suites.

Defensics WLAN test suites have additional system requirements. See WLAN chapters for further information on using WLAN test suites.

Note that on Linux platforms, FlexNet² license server depends on certain Linux Standards Base (LSB) libraries to be present.

The required Java Runtime Environment (JRE) is bundled together in the installation package.

NPCAP

If you are running Defensics in Windows, you must install the Npcap packet capture library. This library is needed to run test suites that generate and receive raw IP or Ethernet packets (e.g., OSPF, ARP, IPv4, IPv6, TCP, ICMP, IGMP, PIM, RSVP, GRE, DVMRP, IS-IS, IPsec, Ethernet test suites). The Npcap library is also required for using the built-in PCAP packet capture functionality in all Defensics test suites, as well as for using the Defensics Traffic Capture test suite.

If you are installing Defensics on Windows platforms, the recommended way of installing Npcap is via Defensics Windows installer. Defensics Windows Installer can install a suitable version of Npcap for you as part of the installation procedure.

If you are installing Npcap from an external source, you should enable the WinPcap API- compatible Mode during Npcap installation process. The minimum version for Npcap is 1.72.

For Linux, raw socket and packet capture functionality are supplied by a built-in static libpcap library that is installed as part of the Defensics installation, so no separate library installations are needed.

Hardware Requirements

The following hardware and software configuration is recommended for running Defensics. Although Defensics will run also on platforms with smaller specifications, the below configuration should provide a smooth user experience and good overall test run performance:

Intel Core i5 or faster processor (or equivalent). Faster CPU improves overall performance.
4GB of system memory allows running the platform and 1-5 average test suites parallel. More memory improves overall performance.
1GB of Java heap memory for each test suite instance. A minority of test suites require up to 3072MB and it is mentioned in test suite documentation.
300GB of disk space for installation and log file storage. Unlimited test runs with unlimited test cases will generate infinite log files.
One or more properly configured Gigabit Ethernet network interface cards for executing tests.
A graphics display adapter when using Defensics GUI. Recommended minimum resolution is 1400x900.

Parallel Suite Operation

If parallel execution of multiple suites is needed, for optimal performance we recommend executing the tests using CLI or HTTP API v2. Defensics GUI running in graphical mode results in considerable memory consumption.

As a minimum baseline for parallel execution, we recommend executing no more than 5 test suites in parallel at any given time. This should still yield good performance even on hardware platforms with limited resources.

The memory consumption of a test suite is the main limiting factor for parallel execution. The memory consumption varies in the range of 384-3072MB for each test suite instance. For parallel execution of 5 suites, 5-10GB of memory is recommended.

Multiple suites operating even in same processor core is not usually a significant performance factor. Having one processor core per 1-2 running test suite instances gives maximum performance for each test suite, and is therefore recommended if you can run Defensics in a system with multiple CPU cores. This means that if you have 4 CPUs with 4 cores each, you should be able to run easily 20 test suites or even more in parallel with reasonable performance, as long as there is enough memory for all of the test suites.

Some Defensics test suites optimize their network communication timeouts with response times measured against the test target. Running a large number of test suites on same NIC can therefore cause unwanted timeouts and timeout value recalculations. However, with Gigabit Ethernet speeds, at least 5 suites can safely be executed on a given NIC at the same time. Defensics test suite performance as measured by raw packet throughput is defined mainly by network communication delays.

Virtualization

Defensics test suites have been successfully executed in virtualized environments both at Black Duck lab environments and at our customers. Most experience is on running the test suites in VMware virtualization environments, but good results have been gained also from Xen, KVM and VirtualBox virtualization platforms.

The generic rule of thumb is that suites running on the application layer don't usually suffer any ill effects from virtualization. For fuzzing the lower network layers, or using test suites which require hardware, see Special considerations below.

Note that currently Black Duck cannot test all of its releases on all possible virtualization platforms, and due to this some virtualization platforms and configurations may not be supported. We recommend that if you plan to deploy Defensics on a virtualized environment, contact Black Duck support first.

Black Duck is studying different virtualization platforms in order to provide full recommendations on preferred platforms and suggested configurations.

Special Considerations

When attempting to run test suites in virtualized environments, it should be noted that test suites that perform raw packet injection (for example OSPF, ARP, IPv4, IPv6, TCP, ICMP, IGMP, PIM, RSVP, GRE, DVMRP, IS-IS, IPsec, Ethernet test suites) use virtual MAC and IP addresses during execution. The virtual MAC and IP are, in practice, forged addresses and should always be configured to be different from the VM's own network interfaces' addresses. For this reason, for best results you should run your virtual network interfaces in bridged mode, so that your guest OS will be able to see all the responses and traffic from the SUT. NAT and host-only networking modes do not typically work properly for sending and receiving test traffic.

The following, or similar settings based on the virtualization platform, are needed:

Enable/allow promiscuous mode for the virtual network interface and virtual switch. This will allow the DefensicsVM to receive all frames passed on the virtual switch, including the packets addressed to the used virtual IP and MAC.
- For VMware, see Promiscuous Mode Operation and Configuring promiscuous mode on a virtual switch or portgroup (1004099) for details.
Enable/allow forged transmits. Similarly to promiscuous mode, allowing forged transmits will allow the VM to send packets using virtual MAC address which does not match the VM's configured MAC address.
- For VMware, see Forged Transmits for details.
Firewalls, packets inspectors, and such should be disabled. More information on these can be found from System Configuration Details.

It should be noted that with virtualization platforms, especially when running suites using raw packet injection, any (virtual) device along the route to the SUT that inspects the test suite traffic may become an inadvertent target for the testing.

Some virtualization platforms and virtualized network setups may not correctly receive raw network traffic destined to virtual MAC and IP addresses from the host OS. For successful execution, raw Ethernet access must be allowed for the guest VMs. The exact procedure and possibilities for doing this varies between virtualization platforms.

It should also be possible to use PCI passthrough to fully pass through a networking device to the VM and connect that directly to the SUT bypassing any limitations set by the virtualization platform networking settings. The availability for this feature is highly dependent on the used hardware and virtualization platform. As an example for VMware, you can check the requirements here. Note that this configuration is not tested by Black Duck.

System Configuration Details

Since Defensics test suites are highly complex protocol simulators that require unfettered access to the network interfaces on the test PC and to your test network, you should set up your test environment according to the following simple guidelines:

Run Defensics GUI with Administrator (Windows) or root (Linux) privileges.
Although TCP and UDP-based Defensics test suites such as HTTP or SIP can theoretically be run as a normal user, capturing the test traffic using the built-in packet capture feature is not supported unless you are running the suites with superuser privileges. Low-level IP and Ethernet test suites (OSPF, ARP, IPv4, IPv6, TCP, ICMP, IGMP, PIM, RSVP, GRE, DVMRP, IS-IS, IPsec, Ethernet) require raw socket access, so they cannot send or receive any traffic if they are executed as a normal user.
Disable any firewalls on your test PC, or configure your firewall so that it allows traffic to be received from and sent to the IP addresses, ports, and protocols used in your testing.
We recommend removing all firewalls from your test environment, if possible. Incorrectly configured personal or corporate firewalls in your test network may prevent test traffic from leaving your test PC or reaching the SUT. The one exception to this rule is if you are testing a firewall – then the tested firewall must of course be present in your test network.
Disable antivirus and anti-spam solutions from your test PC when running the tests.
Some AV programs can cause significant slowdowns or even system crashes if they start analyzing Defensics test traffic. They may also prevent test traffic from reaching your SUT.
Disable TCP segment offloading and other "intelligent" in-line features from your network card driver.
These features may slow down Defensics test case throughput considerably. They may also cause crashes on the operating system level when Defensics test traffic is processed by the network card or its driver.