gtplab0

udp flood test
2025-11-02 13:03:35 +00:00 · 2024-09-21 07:13:08 +02:00 · 2024-09-16 23:42:15 +02:00 · 2024-09-16 23:37:50 +02:00 · 2024-09-14 06:20:48 +02:00 · 2024-09-14 06:20:21 +02:00
44 changed files with 3542 additions and 65 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ config.h
 config.h.in
 *.pc
 *~
+*.png

 *.*~
 *.sw?
--- a/1
+++ b/1
@@ -7,3 +7,4 @@
 # If any interfaces have been added since the last public release: c:r:a + 1.
 # If any interfaces have been removed or changed since the last public release: c:r:0.
 #library	what		description / commit summary line
+osmo-pfcp-tool	liburing	new dependency to support GTP flooding
--- a/configure.ac
+++ b/configure.ac
@@ -43,6 +43,20 @@ PKG_CHECK_MODULES(LIBOSMOPFCP, libosmo-pfcp >= 0.1.0)
 PKG_CHECK_MODULES(LIBGTPNL, libgtpnl >= 1.2.0)
 PKG_CHECK_MODULES(LIBNFTABLES, libnftables >= 1.0.2)

+AC_ARG_ENABLE([uring], [AS_HELP_STRING([--disable-uring], [Build without io_uring support])],
+    [
+        ENABLE_URING=$enableval
+    ],
+    [
+        ENABLE_URING="yes"
+    ])
+AS_IF([test "x$ENABLE_URING" = "xyes"], [
+	PKG_CHECK_MODULES(LIBURING, [liburing >= 0.7])
+	AC_DEFINE([HAVE_URING],[1],[Build with io_uring support for GTP flood commands])
+])
+AM_CONDITIONAL(ENABLE_URING, test "x$ENABLE_URING" = "xyes")
+AC_SUBST(ENABLE_URING)
+
 dnl checks for header files
 AC_HEADER_STDC

@@ -198,6 +212,7 @@ AC_OUTPUT(
    include/Makefile
    include/osmocom/Makefile
    include/osmocom/upf/Makefile
+    include/osmocom/pfcptool/Makefile
    src/Makefile
    src/osmo-upf/Makefile
    src/osmo-pfcp-tool/Makefile
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -1 +1,38 @@
 SUBDIRS = systemd
+
+AM_CPPFLAGS = \
+	$(all_includes) \
+	-I$(top_srcdir)/include \
+	-I$(top_builddir)/include \
+	-I$(top_builddir) \
+	$(NULL)
+
+AM_CFLAGS = \
+	-Wall \
+	$(LIBOSMOCORE_CFLAGS) \
+	$(LIBURING_CFLAGS) \
+	$(COVERAGE_CFLAGS) \
+	$(NULL)
+
+AM_LDFLAGS = \
+	$(LIBOSMOCORE_LIBS) \
+	$(LIBURING_LIBS) \
+	$(COVERAGE_LDFLAGS) \
+	$(NULL)
+
+bin_PROGRAMS = \
+	osmo-udp-responder \
+	udp_flood_test \
+	udp_rx_test \
+	$(NULL)
+
+osmo_udp_responder_SOURCES = \
+	udp_responder.c \
+	$(NULL)
+
+udp_flood_test_SOURCES = \
+	udp_flood_test.c \
+	$(NULL)
+udp_rx_test_SOURCES = \
+	udp_rx_test.c \
+	$(NULL)
--- a/contrib/gtpflood/overview_only_tunend.dot
+++ b/contrib/gtpflood/overview_only_tunend.dot
@@ -0,0 +1,35 @@
+digraph G {
+	rankdir=TB;
+	labelloc=t;
+	label="gtplab @ sysmocom";
+
+	subgraph cluster_gtplab0 {
+		label="gtplab0";
+		rankdir=TB;
+		gtplab0_172_31  [label="172.16.31.1/24"];
+		tool [label="osmo-pfcp-tool",shape=box3d];
+	}
+	subgraph cluster_gtplab1 {
+		label="gtplab1";
+		gtplab1_172_31  [label="172.16.31.2/24"];
+		gtplab1_172_32  [label="172.16.32.1/24"];
+
+		upf_tunend [label="UPF\ntunend",shape=box3d];
+	}
+	subgraph cluster_gtplab2 {
+		label="gtplab2";
+		gtplab2_172_32  [label="172.16.32.2/24"];
+
+		responder [label="osmo-udp-responder",shape=box3d];
+	}
+
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunend [label="PFCP", dir=both];
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunend [label="GTP tun",style=bold];
+	upf_tunend -> gtplab1_172_32 -> gtplab2_172_32 -> responder [label="UDP/IP",style=bold];
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunend [style=dotted,dir=back];
+	upf_tunend -> gtplab1_172_32 -> gtplab2_172_32 -> responder [style=dotted,dir=back];
+
+}
--- a/contrib/gtpflood/overview_only_tunmap.dot
+++ b/contrib/gtpflood/overview_only_tunmap.dot
@@ -0,0 +1,37 @@
+digraph G {
+	rankdir=TB;
+	labelloc=t;
+	label="gtplab @ sysmocom";
+
+	subgraph cluster_gtplab0 {
+		label="gtplab0";
+		rankdir=TB;
+		gtplab0_172_31  [label="172.16.31.1/24"];
+		tool [label="osmo-pfcp-tool",shape=box3d];
+		insert_teid [label="insert return TEID\nin UDP payload",shape=note];
+	}
+	subgraph cluster_gtplab1 {
+		label="gtplab1";
+		gtplab1_172_31  [label="172.16.31.2/24"];
+		gtplab1_172_32  [label="172.16.32.1/24"];
+
+		upf_tunmap [label="UPF\ntunmap",shape=box3d];
+	}
+	subgraph cluster_gtplab2 {
+		label="gtplab2";
+		gtplab2_172_32  [label="172.16.32.2/24"];
+
+		responder [label="osmo-udp-responder",shape=box3d];
+		send_to_teid [label="use TEID from\nUDP payload",shape=note];
+	}
+
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunmap [label="PFCP", dir=both];
+
+	tool -> insert_teid -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunmap [label="GTP tun",style=bold];
+	upf_tunmap -> gtplab1_172_32 -> gtplab2_172_32 -> responder [label="GTP tun",style=bold];
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf_tunmap [style=dotted,dir=back];
+	upf_tunmap -> gtplab1_172_32 -> gtplab2_172_32 -> send_to_teid -> responder [style=dotted,dir=back];
+
+}
--- a/contrib/gtpflood/overview_tunmap_and_tunend.dot
+++ b/contrib/gtpflood/overview_tunmap_and_tunend.dot
@@ -0,0 +1,43 @@
+digraph G {
+	rankdir=TB;
+	labelloc=t;
+	label="gtplab @ sysmocom";
+
+	subgraph cluster_gtplab0 {
+		label="gtplab0";
+		rankdir=TB;
+		gtplab0_10   [label="10.9.25.20/24"];
+		gtplab0_172_31  [label="172.16.31.1/24"];
+		tool [label="osmo-pfcp-tool",shape=box3d];
+	}
+	subgraph cluster_gtplab1 {
+		label="gtplab1";
+		gtplab1_10   [label="10.9.25.21/24"];
+		gtplab1_172_31  [label="172.16.31.2/24"];
+		gtplab1_172_32  [label="172.16.32.1/24"];
+
+		upf1 [label="UPF\ntunmap",shape=box3d];
+	}
+	subgraph cluster_gtplab2 {
+		label="gtplab2";
+		gtplab2_10   [label="10.9.25.22/24"];
+		gtplab2_172_32  [label="172.16.32.2/24"];
+
+		upf2 [label="UPF\ntunend",shape=box3d];
+
+		responder [label="osmo-udp-responder",shape=box3d];
+	}
+
+
+	tool -> gtplab0_10 -> gtplab1_10 -> upf1 [label="PFCP", dir=both];
+	gtplab0_10 -> gtplab2_10 -> upf2 [label="PFCP", dir=both];
+
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf1 [label="GTP tun",style=bold];
+	upf1 -> gtplab1_172_32 -> gtplab2_172_32 -> upf2 [label="GTP tun",style=bold];
+	upf2 -> responder [label="UDP/IP",style=bold];
+
+	upf2 -> responder [style=dotted,dir=back];
+	upf1 -> gtplab1_172_32 -> gtplab2_172_32 -> upf2 [style=dotted,dir=back];
+	tool -> gtplab0_172_31 -> gtplab1_172_31 -> upf1 [style=dotted,dir=back];
+
+}
--- a/contrib/gtpflood/tunend/0.gtp_flood.vty
+++ b/contrib/gtpflood/tunend/0.gtp_flood.vty
@@ -0,0 +1,55 @@
+# Establish N PFCP sessions for tunend, and emit massive GTP traffic to the UPF
+# to each established tunnel.
+#
+# osmo-pfcp-tool                 UPF                          "internet host"
+#  |GTP-ep -------GTP-----> GTP-ep|UE-IP-addr -------IP------> arbitrary-IP|
+#  |10.0.1.1              10.0.2.1|192.168.10.23              123.234.42.23|
+#  |10.0.1.2
+#                          ^                 ^                   ^
+#    ^                     |                 |                   |
+#    |                     |                configure by      configure by
+#   configure by        from UPF            'ue ip'           'payload target ip',
+#   'gtp ip'            ("F-TEID=choose")                     'payload target port'
+
+# Configure one or more local GTP endpoints to emit GTP packets from.
+# Established sessions will use these round-robin.
+# These need to be local IP addresses for 'gtp flood' to work.
+gtp local 172.16.31.1
+
+# use UE IP addresses from this range, +1 for each new UE:
+# 192.168.0.1, 192.168.0.2, ...
+ue ip range 192.168.1.2 192.168.254.254
+
+# now associate with UPF and start N sessions.
+pfcp-peer 172.16.31.2
+ tx assoc-setup-req
+ sleep 1
+ date
+
+ n 2000 session create tunend
+ wait responses
+ # All sessions established
+ date
+
+# For each established PFCP session, emit GTP packets
+gtp flood
+ workers 8
+ io-uring queue-size 16000
+ flows-per-session 16
+ packets-per-flow 1000
+
+ # configure the generated GTP payload: send UDP packets from the UE address
+ # and these source UDP ports to these target addresses and target UDP ports.
+ # They are used round-robin.
+ # Source IP is the UE IP address.
+ payload source port udp range 10000 10010
+ payload target ip range 172.16.32.2 172.16.32.2
+ payload target port udp range 23000 23000
+
+date
+# All GTP is flowing.
+# osmo-pfcp-tool will keep this up for as long as there still are active GTP flows,
+# or until receiving a signal interrupt (ctrl-C).
+
+# give some time to gather counters before the tunnel is removed
+sleep 1
--- a/contrib/gtpflood/tunend/0.run_gtp_flood.sh
+++ b/contrib/gtpflood/tunend/0.run_gtp_flood.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -x
+#sudo chrt -r 50 osmo-pfcp-tool 0.gtp_flood.vty -c osmo-pfcp-tool.cfg
+sudo ionice -c 1 -n 0 osmo-pfcp-tool 0.gtp_flood.vty -c osmo-pfcp-tool.cfg
+#sudo osmo-pfcp-tool 0.gtp_flood.vty -c osmo-pfcp-tool.cfg
--- a/contrib/gtpflood/tunend/1.enable_ip_forwarding.sh
+++ b/contrib/gtpflood/tunend/1.enable_ip_forwarding.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+sudo sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'
--- a/contrib/gtpflood/tunend/1.eupf.yaml
+++ b/contrib/gtpflood/tunend/1.eupf.yaml
@@ -0,0 +1,13 @@
+interface_name: [enp2s0f0np0]
+xdp_attach_mode: generic
+api_address: :8080
+pfcp_address: 172.16.31.2:8805
+pfcp_node_id: 172.16.31.2
+metrics_address: :9090
+n3_address: 172.16.31.2
+qer_map_size: 1000000
+far_map_size: 1000000
+pdr_map_size: 1000000
+feature_ueip: true
+feature_ftup: true
+teid_pool: 1000000
--- a/contrib/gtpflood/tunend/1.osmo-upf.cfg
+++ b/contrib/gtpflood/tunend/1.osmo-upf.cfg
@@ -0,0 +1,26 @@
+log stderr
+ logging filter all 1
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+ logging level set-all notice
+ logging level set-all info
+ logging level session debug
+ logging level nft debug
+ logging level gtp debug
+ logging level set-all error
+#logging level set-all debug
+
+line vty
+ bind 127.0.0.1
+ctrl
+ bind 127.0.0.1
+
+timer pfcp x24 5000
+pfcp
+ local-addr 172.16.31.2
+tunend
+ dev create apn-flood 172.16.31.2
--- a/contrib/gtpflood/tunend/1.run_eupf.sh
+++ b/contrib/gtpflood/tunend/1.run_eupf.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+sudo eupf --config 1.eupf.yaml
--- a/contrib/gtpflood/tunend/1.run_osmo-upf.sh
+++ b/contrib/gtpflood/tunend/1.run_osmo-upf.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+osmo-upf -c 1.osmo-upf.cfg
--- a/contrib/gtpflood/tunend/1.ue_ip_route.sh
+++ b/contrib/gtpflood/tunend/1.ue_ip_route.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+sudo ip addr add 192.168.1.1/16 dev apn-flood
--- a/contrib/gtpflood/tunend/2.udp-responder.sh
+++ b/contrib/gtpflood/tunend/2.udp-responder.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+osmo-udp-responder -l 172.16.32.2 -p 23000
--- a/contrib/gtpflood/tunend/2.ue_ip_route.sh
+++ b/contrib/gtpflood/tunend/2.ue_ip_route.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+sudo ip route add 192.168.0.0/16 via 172.16.32.1
--- a/contrib/gtpflood/tunend/osmo-pfcp-tool.cfg
+++ b/contrib/gtpflood/tunend/osmo-pfcp-tool.cfg
@@ -0,0 +1,12 @@
+log stderr
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+ logging level set-all info
+ logging level lpfcp error
+
+local-addr 0.0.0.0
+listen
--- a/contrib/gtpflood/tunmap/0.gtp_flood.vty
+++ b/contrib/gtpflood/tunmap/0.gtp_flood.vty
@@ -0,0 +1,54 @@
+# Establish N PFCP sessions for tunmap, and emit massive GTP traffic to the UPF
+# to each established tunnel.
+#
+# osmo-pfcp-tool                 UPF                          "core"
+#  |GTP-ep -------GTP-----> GTP-ep|GTP-ep ----------IP------> GTP-ep
+#  |10.0.1.1              10.0.2.1|10.0.3.1                   10.0.3.2
+#  |10.0.1.2
+#                          ^        ^                         ^
+#    ^                     |        |                         |
+#    |                     |        /                         configure by
+#   configure by        from UPF                              'gtp core'
+#   'gtp ip'            ("F-TEID=choose")
+
+# Configure one or more local GTP endpoints to emit GTP packets from.
+# Established sessions will use these round-robin.
+# These need to be local IP addresses for 'gtp flood' to work.
+gtp local 172.16.31.1
+
+gtp core 172.16.32.2
+
+ue ip range 192.168.1.2 192.168.254.254
+
+# now associate with UPF and start N sessions.
+pfcp-peer 172.16.31.2
+ tx assoc-setup-req
+ sleep 1
+ date
+
+ n 1 session create tunmap
+ wait responses
+ # All sessions established
+ date
+
+# For each established PFCP session, emit GTP packets
+gtp flood
+ workers 4
+ io-uring queue-size 1024
+ flows-per-session 1
+ packets-per-flow 100000
+
+ # configure the generated GTP payload: include in the payload each tunnel's
+ # GTP TEID needed to correctly echo the GTP payload back with
+ # osmo-udp-responder.
+ payload append-info
+
+ slew 10000
+
+date
+# All GTP is flowing.
+# osmo-pfcp-tool will keep this up for as long as there still are active GTP flows,
+# or until receiving a signal interrupt (ctrl-C).
+
+# give some time to gather counters before the tunnel is removed
+sleep 1
--- a/contrib/gtpflood/tunmap/0.run_gtp_flood.sh
+++ b/contrib/gtpflood/tunmap/0.run_gtp_flood.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+osmo-pfcp-tool 0.gtp_flood.vty -c osmo-pfcp-tool.cfg
--- a/contrib/gtpflood/tunmap/1.eupf.yaml
+++ b/contrib/gtpflood/tunmap/1.eupf.yaml
@@ -0,0 +1,13 @@
+interface_name: [enp2s0f0np0,enp2s0f1np1]
+xdp_attach_mode: generic
+api_address: :8080
+pfcp_address: 172.16.31.2:8805
+pfcp_node_id: 172.16.31.2
+metrics_address: :9090
+n3_address: 172.16.31.2
+qer_map_size: 1000000
+far_map_size: 1000000
+pdr_map_size: 1000000
+feature_ueip: true
+feature_ftup: true
+teid_pool: 1000000
--- a/contrib/gtpflood/tunmap/1.osmo-upf.cfg
+++ b/contrib/gtpflood/tunmap/1.osmo-upf.cfg
@@ -0,0 +1,26 @@
+log stderr
+ logging filter all 1
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+ logging level set-all notice
+ logging level set-all info
+ logging level session debug
+ logging level nft debug
+ logging level gtp debug
+ logging level set-all error
+#logging level set-all debug
+
+line vty
+ bind 127.0.0.1
+ctrl
+ bind 127.0.0.1
+
+timer pfcp x24 5000
+pfcp
+ local-addr 172.16.31.2
+tunend
+ dev create gtp-echo
--- a/contrib/gtpflood/tunmap/1.run_eupf.sh
+++ b/contrib/gtpflood/tunmap/1.run_eupf.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+sudo eupf --config 1.eupf.yaml
--- a/contrib/gtpflood/tunmap/1.run_osmo-upf.sh
+++ b/contrib/gtpflood/tunmap/1.run_osmo-upf.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+osmo-upf -c 1.osmo-upf.cfg
--- a/contrib/gtpflood/tunmap/2.udp-responder.sh
+++ b/contrib/gtpflood/tunmap/2.udp-responder.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -x
+osmo-udp-responder -l 172.16.32.2 -p 2152
--- a/contrib/gtpflood/tunmap/osmo-pfcp-tool.cfg
+++ b/contrib/gtpflood/tunmap/osmo-pfcp-tool.cfg
@@ -0,0 +1,12 @@
+log stderr
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+ logging level set-all info
+ logging level lpfcp error
+
+local-addr 0.0.0.0
+listen
--- a/contrib/osmo-pfcp-tool-scripts/gtp_flood.vty
+++ b/contrib/osmo-pfcp-tool-scripts/gtp_flood.vty
@@ -0,0 +1,51 @@
+# Establish N PFCP sessions for tunend, and emit massive GTP traffic to the UPF
+# to each established tunnel.
+#
+# osmo-pfcp-tool                 UPF                          "internet host"
+#  |GTP-ep -------GTP-----> GTP-ep|UE-IP-addr -------IP------> arbitrary-IP|
+#  |10.0.1.1              10.0.2.1|192.168.10.23              123.234.42.23|
+#  |10.0.1.2
+#                          ^                 ^                   ^
+#    ^                     |                 |                   |
+#    |                     |                configure by      configure by
+#   configure by        from UPF            'ue ip'           'target ip',
+#   'gtp ip'            ("F-TEID=choose")                     'target port'
+
+# Configure one or more local GTP endpoints to emit GTP packets from.
+# Established sessions will use these round-robin.
+# These need to be local IP addresses for 'gtp flood' to work.
+gtp local 127.0.1.1 10001
+gtp local 127.0.1.2 10002
+
+# use UE IP addresses from this range, +1 for each new UE:
+# 192.168.0.1, 192.168.0.2, ...
+ue ip range 192.168.23.1 192.168.23.254
+
+# now associate with UPF and start N sessions.
+pfcp-peer 127.0.0.11
+ tx assoc-setup-req
+ sleep 1
+ date
+
+ n 30 session create tunend
+ wait responses
+ # All sessions established
+ date
+
+# For each established PFCP session, emit GTP packets
+gtp flood
+ workers 2
+ flows-per-session 1
+ packets-per-flow 1000
+
+ # configure the generated GTP payload: send UDP packets from the UE address
+ # and these source UDP ports to these target addresses and target UDP ports.
+ # They are used round-robin.
+ # Source IP is the UE IP address.
+ payload source port udp range 10000 10010
+ payload target ip range 123.234.42.1 123.234.42.254
+ payload target port udp range 10000 10010
+
+# All GTP is flowing.
+# osmo-pfcp-tool will keep this up for as long as there still are active GTP flows,
+# or until receiving a signal interrupt (ctrl-C).
--- a/contrib/udp_flood_test.c
+++ b/contrib/udp_flood_test.c
@@ -0,0 +1,144 @@
+#include <liburing.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/sockaddr_str.h>
+
+#define SEND_SLOTS 1024
+#define BUF_SIZE 2048
+
+struct io_uring ring = {};
+int num_packets = 1000000;
+int num_packets_prepped = 0;
+int num_packets_completed = 0;
+
+int src_fd;
+struct osmo_sockaddr remote_osa;
+
+struct send_slot {
+	struct iovec iov;
+	uint8_t buf[BUF_SIZE];
+	struct msghdr msgh;
+};
+
+struct send_slot send_slots[SEND_SLOTS];
+
+bool submit_tx(struct send_slot *s)
+{
+	struct io_uring_sqe *sqe;
+
+	if (num_packets_prepped >= num_packets)
+		return false;
+	num_packets_prepped++;
+
+	s->iov.iov_base = s->buf;
+	s->iov.iov_len = sizeof(s->buf);
+
+	s->msgh = (struct msghdr){
+		.msg_name = &remote_osa,
+		.msg_namelen = sizeof(remote_osa),
+		.msg_iov = &s->iov,
+		.msg_iovlen = 1,
+	};
+
+	sqe = io_uring_get_sqe(&ring);
+	OSMO_ASSERT(sqe);
+	io_uring_prep_sendmsg(sqe, src_fd, &s->msgh, 0);
+	io_uring_sqe_set_data(sqe, s);
+	return true;
+}
+
+void handle_completion(struct io_uring_cqe *cqe)
+{
+	struct send_slot *s;
+	s = io_uring_cqe_get_data(cqe);
+
+	if (cqe->res < 0) {
+		printf("rc = %d\n", cqe->res);
+		return;
+	}
+
+	io_uring_cqe_seen(&ring, cqe);
+	num_packets_completed++;
+
+	/* submit more */
+	submit_tx(s);
+}
+
+int main(int argc, const char **argv)
+{
+	int i;
+	int rc;
+	const char *local_addr_str = "0.0.0.0";
+	uint16_t local_port = 42000;
+	const char *remote_addr_str = "127.0.0.2";
+	uint16_t remote_port = 23000;
+
+	struct osmo_sockaddr_str local_addr = {};
+	struct osmo_sockaddr local_osa = {};
+
+	struct osmo_sockaddr_str remote_addr = {};
+
+	struct __kernel_timespec ts_zero = {};
+	struct __kernel_timespec ts_1s = { .tv_sec = 1 };
+
+	if (argc >= 2)
+		remote_addr_str = argv[1];
+	if (argc >= 3)
+		remote_port = atoi(argv[2]);
+	if (argc >= 4)
+		num_packets = atoi(argv[3]);
+
+	if (osmo_sockaddr_str_from_str(&local_addr, local_addr_str, local_port)
+	    || osmo_sockaddr_str_to_osa(&local_addr, &local_osa)) {
+		printf("ERROR: invalid address or port number: %s:%d\n", local_addr_str, local_port);
+		return -1;
+	}
+
+	if (osmo_sockaddr_str_from_str(&remote_addr, remote_addr_str, remote_port)
+	    || osmo_sockaddr_str_to_osa(&remote_addr, &remote_osa)) {
+		printf("ERROR: invalid address or port number: %s:%d\n", remote_addr_str, remote_port);
+		return -1;
+	}
+
+	/* create and bind socket */
+	rc = osmo_sock_init_osa(SOCK_DGRAM, IPPROTO_UDP, &local_osa, NULL, OSMO_SOCK_F_BIND);
+	if (rc < 0)
+		return -1;
+	src_fd = rc;
+	printf("bound UDP %s fd=%d\n", osmo_sock_get_name2(src_fd), src_fd);
+	printf("sending %d UDP packets to %s\n", num_packets, osmo_sockaddr_to_str(&remote_osa));
+
+	rc = io_uring_queue_init(ARRAY_SIZE(send_slots), &ring, 0);
+
+	/* fill up tx queue */
+	for (i = 0; i < ARRAY_SIZE(send_slots); i++) {
+		submit_tx(&send_slots[i]);
+	}
+
+	while (num_packets_completed < num_packets) {
+		uint32_t new_submissions;
+		uint32_t new_completions = 0;
+		struct io_uring_cqe *cqe;
+
+		/* submit any requests from previous loop */
+		new_submissions = io_uring_submit(&ring);
+
+		/* process all pending completions */
+		while (io_uring_wait_cqe_timeout(&ring, &cqe, &ts_zero) == 0) {
+			handle_completion(cqe);
+			new_completions++;
+
+		}
+
+		/* Nothing happened in this loop iteration, so wait a bit longer */
+		if (!new_submissions && !new_completions) {
+			if (io_uring_wait_cqe_timeout(&ring, &cqe, &ts_1s) == 0) {
+				handle_completion(cqe);
+			}
+		}
+	}
+
+	printf("done\n");
+	return 0;
+}
--- a/contrib/udp_responder.c
+++ b/contrib/udp_responder.c
@@ -0,0 +1,641 @@
+/* UDP responder: listen on a UDP port, and respond to each received UDP packet back to the sender. */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "config.h"
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+
+#if HAVE_URING
+
+#define _GNU_SOURCE
+#include <getopt.h>
+#include <limits.h>
+#include <unistd.h>
+
+#include <liburing.h>
+#include <pthread.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/sockaddr_str.h>
+
+#include <osmocom/pfcptool/gtp_flood.h>
+
+struct cmdline_cmd {
+	const char *short_option;
+	const char *long_option;
+	const char *arg_name;
+	const char *doc;
+
+	const char *value;
+};
+
+#define cmdline_foreach(ITER, CMDS) \
+	for (const struct cmdline_cmd *ITER = (CMDS); \
+	     ITER->short_option || ITER->long_option || ITER->arg_name; \
+	     ITER++)
+
+int cmdline_doc_str_buf(char *buf, size_t buflen, const struct cmdline_cmd *cmds)
+{
+	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
+	/* First find the longest options part */
+	int w = 0;
+	cmdline_foreach (cmd, cmds) {
+		int cmd_w = 0;
+		if (cmd->short_option)
+			cmd_w += 2 + strlen(cmd->short_option);
+		if (cmd->long_option)
+			cmd_w += 3 + strlen(cmd->long_option);
+		if (cmd->arg_name)
+			cmd_w += 1 + strlen(cmd->arg_name);
+		w = OSMO_MAX(w, cmd_w);
+	}
+	/* vertical gap */
+	w += 2;
+
+	OSMO_STRBUF_PRINTF(sb, "Options:\n");
+	cmdline_foreach (cmd, cmds) {
+		char *line_start = sb.pos;
+		if (cmd->short_option)
+			OSMO_STRBUF_PRINTF(sb, " -%s", cmd->short_option);
+		if (cmd->long_option)
+			OSMO_STRBUF_PRINTF(sb, " --%s", cmd->long_option);
+		if (cmd->arg_name)
+			OSMO_STRBUF_PRINTF(sb, " %s", cmd->arg_name);
+		if (cmd->doc) {
+			int have = sb.pos - line_start;
+			int spaces = OSMO_MAX(1, w - have);
+			OSMO_STRBUF_PRINTF(sb, "%*s", spaces, "");
+			OSMO_STRBUF_PRINTF(sb, "%s", cmd->doc);
+		}
+		OSMO_STRBUF_PRINTF(sb, "\n");
+	}
+	return sb.chars_needed;
+}
+
+void cmdline_print_help(const struct cmdline_cmd *cmds)
+{
+	char buf[8192];
+	cmdline_doc_str_buf(buf, sizeof(buf), cmds);
+	printf("%s", buf);
+}
+
+void cmdline_cmd_store_optarg(struct cmdline_cmd *cmd)
+{
+	if (cmd->arg_name)
+		cmd->value = optarg;
+	else
+		cmd->value = (cmd->short_option ? : cmd->long_option);
+}
+
+int cmdline_read(struct cmdline_cmd *cmds, int argc, char **argv)
+{
+	char short_options[256] = {};
+	struct option long_options[128] = {};
+	int long_options_i = 0;
+	int long_option_val = 0;
+	struct osmo_strbuf short_sb = { .buf = short_options, .len = sizeof(short_options) };
+
+	cmdline_foreach (cmd, cmds) {
+		if (cmd->short_option) {
+			OSMO_STRBUF_PRINTF(short_sb, "%s", cmd->short_option);
+			if (cmd->arg_name)
+				OSMO_STRBUF_PRINTF(short_sb, ":");
+		}
+		if (cmd->long_option) {
+			long_options[long_options_i] = (struct option){
+				cmd->long_option,
+				cmd->arg_name ? 1 : 0,
+				&long_option_val,
+				long_options_i,
+			};
+			long_options_i++;
+		}
+	}
+
+	while (1) {
+		int option_index = 0;
+		char c = getopt_long(argc, argv, short_options, long_options, &option_index);
+		if (c == -1)
+			break;
+		if (c == 0) {
+			struct cmdline_cmd *long_cmd = &cmds[long_option_val];
+			cmdline_cmd_store_optarg(long_cmd);
+		} else {
+			bool found = false;
+			cmdline_foreach (cc, cmds) {
+				if (strchr(cc->short_option, c)) {
+					cmdline_cmd_store_optarg((struct cmdline_cmd *)cc);
+					found = true;
+					break;
+				}
+			}
+			if (!found) {
+				fprintf(stderr, "%s: Error in command line options. Exiting.\n", argv[0]);
+				return -1;
+			}
+		}
+	}
+
+	/* positional args */
+	cmdline_foreach (cmd, cmds) {
+		if (optind >= argc)
+			break;
+		if (cmd->short_option || cmd->long_option)
+			continue;
+		if (!cmd->arg_name)
+			continue;
+		((struct cmdline_cmd *)cmd)->value = argv[optind];
+		optind++;
+	}
+
+	if (optind < argc) {
+		cmdline_print_help(cmds);
+		fprintf(stderr, "%s: Unsupported positional argument on command line\n", argv[optind]);
+		return -1;
+	}
+	return 0;
+}
+
+const char *cmdline_get(const struct cmdline_cmd *cmds, const char *option_name, const char *default_val)
+{
+	cmdline_foreach (cmd, cmds) {
+		if (cmd->long_option && !strcmp(cmd->long_option, option_name))
+			return cmd->value;
+		if (cmd->short_option && !strcmp(cmd->short_option, option_name))
+			return cmd->value;
+		if (cmd->arg_name && !strcmp(cmd->arg_name, option_name))
+			return cmd->value;
+	}
+	return default_val;
+}
+
+bool cmdline_get_int(int *dst, int minval, int maxval, int default_val,
+		     const struct cmdline_cmd *cmds, const char *option_name)
+{
+	const char *str = cmdline_get(cmds, option_name, NULL);
+	if (!str) {
+		*dst = default_val;
+		return true;
+	}
+	if (osmo_str_to_int(dst, str, 10, minval, maxval)) {
+		cmdline_print_help(cmds);
+		printf("ERROR: invalid integer number: %s\n", str);
+		return false;
+	}
+	if (*dst < minval || *dst > maxval) {
+		cmdline_print_help(cmds);
+		printf("ERROR: number out of range: %d <= %d <= %d\n", minval, *dst, maxval);
+		return false;
+	}
+	return true;
+}
+
+struct udp_port {
+	struct llist_head entry;
+
+	/* IP address and UDP port from user input */
+	struct osmo_sockaddr osa;
+
+	/* locally bound socket */
+	int fd;
+};
+
+enum data_io_type {
+	IO_UNUSED = 0,
+	IO_RECV,
+	IO_SEND,
+};
+
+struct data_io {
+	enum data_io_type type;
+	struct osmo_sockaddr osa;
+	struct iovec iov;
+	struct msghdr msgh;
+	uint8_t *data;
+	size_t data_size;
+	int n;
+};
+
+struct io_queue {
+	size_t d_size;
+	struct data_io d[0];
+};
+
+static void data_io_prep_recv(struct io_uring *ring, struct udp_port *port, struct data_io *d)
+{
+	struct io_uring_sqe *sqe;
+	*d = (struct data_io){
+		.type = IO_RECV,
+		.iov = {
+			.iov_base = d->data,
+			.iov_len = d->data_size,
+		},
+		.msgh = {
+			.msg_name = &d->osa,
+			.msg_namelen = sizeof(d->osa),
+			.msg_iov = &d->iov,
+			.msg_iovlen = 1,
+		},
+		.data_size = d->data_size,
+		.data = d->data,
+	};
+
+	sqe = io_uring_get_sqe(ring);
+	OSMO_ASSERT(sqe);
+	io_uring_prep_recvmsg(sqe, port->fd, &d->msgh, 0);
+	io_uring_sqe_set_data(sqe, d);
+}
+
+static void data_io_prep_send(struct io_uring *ring, struct udp_port *port, struct data_io *d)
+{
+	struct io_uring_sqe *sqe;
+	d->type = IO_SEND;
+	sqe = io_uring_get_sqe(ring);
+	OSMO_ASSERT(sqe);
+	io_uring_prep_sendmsg(sqe, port->fd, &d->msgh, 0);
+	io_uring_sqe_set_data(sqe, d);
+}
+
+static bool get_payload_info(struct gtp_flood_payload_info *dst, struct data_io *d)
+{
+	uint8_t *pi;
+	uint8_t *len;
+	size_t copy_len;
+
+	len = d->iov.iov_base + d->iov.iov_len - 1;
+	if ((*len) > d->iov.iov_len)
+		return false;
+	pi = len - (*len);
+	if (strncmp((void *)pi, "info", 4))
+		return false;
+	copy_len = OSMO_MIN(sizeof(*dst), *len);
+	*dst = (struct gtp_flood_payload_info){};
+	memcpy((void *)dst, pi, copy_len);
+	return true;
+}
+
+struct counter {
+	uint64_t count;
+	uint64_t last;
+};
+
+struct traffic_counter {
+	struct counter packets;
+	struct counter bytes;
+};
+
+uint64_t counter_get(struct counter *c)
+{
+	uint64_t val = c->count - c->last;
+	c->last = c->count;
+	return val;
+}
+
+struct traffic_counter g_rx = {};
+struct traffic_counter g_tx = {};
+
+static void data_io_handle_completion(struct io_uring *ring, struct udp_port *port, struct io_uring_cqe *cqe,
+				      int response_size, int response_n)
+{
+	struct data_io *d;
+	struct osmo_sockaddr *osa = NULL;
+	int rc;
+	struct gtp_flood_payload_info pi;
+
+	d = io_uring_cqe_get_data(cqe);
+
+	osa = &d->osa;
+	rc = cqe->res;
+	if (rc < 0) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "%s -> rx error rc=%d flags=0x%x\n",
+		     osa ? osmo_sockaddr_to_str(osa) : "NULL",
+		     rc, cqe->flags);
+		return;
+	}
+
+	switch (d->type) {
+	case IO_RECV:
+		/* done reading */
+		d->iov.iov_len = rc;
+		LOGP(DLGLOBAL, LOGL_DEBUG, "%s -> rx rc=%d flags=0x%x: %s\n",
+		     osa ? osmo_sockaddr_to_str(osa) : "NULL",
+		     rc, cqe->flags,
+		     osmo_quote_str(d->iov.iov_base, d->iov.iov_len));
+		io_uring_cqe_seen(ring, cqe);
+		g_rx.packets.count++;
+		g_rx.bytes.count += d->iov.iov_len;
+
+		if (response_n < 1)
+			break;
+
+		if (get_payload_info(&pi, d)) {
+			/* set the return TEID */
+			struct gtp1u_hdr *gtp_hdr = (void *)d->iov.iov_base;
+			gtp_hdr->tei = pi.return_teid;
+		}
+
+		/* resubmit back to sender */
+
+		/* adjust size? */
+		if (response_size > 0)
+			d->iov.iov_len = response_size;
+
+		data_io_prep_send(ring, port, d);
+		break;
+
+	case IO_SEND:
+		/* done writing. */
+		LOGP(DLGLOBAL, LOGL_DEBUG, "%s <- tx rc=%d flags=0x%x: %s\n",
+		     osa ? osmo_sockaddr_to_str(osa) : "NULL",
+		     rc, cqe->flags,
+		     osmo_quote_str(d->iov.iov_base, rc));
+		io_uring_cqe_seen(ring, cqe);
+		g_tx.packets.count++;
+		g_tx.bytes.count += rc;
+
+		d->n++;
+
+		/* Send again? If not, re-submit open slot for reading. */
+		if (d->n < response_n)
+			data_io_prep_send(ring, port, d);
+		else
+			data_io_prep_recv(ring, port, d);
+		break;
+
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+struct cmdline_cmd cmds[] = {
+	{
+		.short_option = "h",
+		.long_option = "help",
+		.doc = "Show this help",
+	},
+	{
+		.short_option = "l",
+		.long_option = "local-addr",
+		.arg_name = "IP-ADDR",
+		.doc = "Listen on local IP address (default is 0.0.0.0).",
+	},
+	{
+		.short_option = "p",
+		.long_option = "port",
+		.arg_name = "UDP-PORT",
+		.doc = "Listen on local UDP port.",
+	},
+	/*
+	{
+		.short_option = "P",
+		.long_option = "port-range-to",
+		.arg_name = "UDP-PORT-TO",
+		.doc = "Listen on a range of ports, from --port to --port-range-to, inclusive.",
+	},
+	*/
+	{
+		.short_option = "s",
+		.long_option = "response-size",
+		.arg_name = "BYTES",
+		.doc = "When responding, enlarge or shorten the payload to this size.",
+	},
+	{
+		.short_option = "n",
+		.long_option = "response-repeat",
+		.arg_name = "N",
+		.doc = "Respond N times, i.e. multiply the returned traffic.",
+	},
+	{
+		.long_option = "io-uring-queue",
+		.arg_name = "SIZE",
+		.doc = "I/O tuning: queue size to use for io_uring, default is 4000.",
+	},
+	{
+		.long_option = "io-uring-buf",
+		.arg_name = "SIZE",
+		.doc = "I/O tuning: maximum payload size, default is 2048.",
+	},
+	{
+		.long_option = "workers",
+		.arg_name = "N",
+		.doc = "Number of rx threads to run",
+	},
+	{}
+};
+
+static const struct log_info_cat categories[] = {
+};
+
+const struct log_info udp_responder_log_info = {
+	.cat = categories,
+	.num_cat = ARRAY_SIZE(categories),
+};
+
+struct worker {
+	int id;
+	struct io_queue *q;
+	struct io_uring ring;
+	pthread_t worker;
+};
+
+struct {
+	int port_nr;
+	const char *local_addr;
+	int queue_size;
+	int buf_size;
+	int response_size;
+	int response_n;
+	int workers_n;
+	struct udp_port port;
+} cfg = {};
+
+static void start_rx_worker(struct worker *w);
+
+int main(int argc, char **argv)
+{
+	struct osmo_sockaddr_str addr = {};
+	struct osmo_sockaddr osa = {};
+
+	osmo_init_logging2(OTC_GLOBAL, &udp_responder_log_info);
+	log_set_log_level(osmo_stderr_target, LOGL_ERROR);
+
+	if (cmdline_read(cmds, argc, argv)
+	    || cmdline_get(cmds, "help", NULL)) {
+		cmdline_print_help(cmds);
+		return -1;
+	}
+
+	if (!cmdline_get_int(&cfg.port_nr, 1, 65535, 23000, cmds, "port"))
+		return -1;
+
+	cfg.local_addr = cmdline_get(cmds, "local-addr", "0.0.0.0");
+	if (osmo_sockaddr_str_from_str(&addr, cfg.local_addr, cfg.port_nr)
+	    || osmo_sockaddr_str_to_osa(&addr, &osa)) {
+		printf("ERROR: invalid interface or port number: %s:%d\n", cfg.local_addr, cfg.port_nr);
+		return -1;
+	}
+
+	if (!cmdline_get_int(&cfg.queue_size, 1, 65535, 4000, cmds, "io-uring-queue"))
+		return -1;
+	if (!cmdline_get_int(&cfg.buf_size, 1, 65535, 2048, cmds, "io-uring-buf"))
+		return -1;
+
+	if (!cmdline_get_int(&cfg.response_size, 0, cfg.buf_size, 0, cmds, "response-size"))
+		return -1;
+
+	if (!cmdline_get_int(&cfg.response_n, 0, INT_MAX, 1, cmds, "response-repeat"))
+		return -1;
+
+	if (!cmdline_get_int(&cfg.workers_n, 1, INT_MAX, 4, cmds, "workers"))
+		return -1;
+
+	cfg.port.osa = osa;
+
+	/* create and bind socket */
+	int rc;
+	rc = osmo_sock_init_osa(SOCK_DGRAM, IPPROTO_UDP, &cfg.port.osa, NULL, OSMO_SOCK_F_BIND);
+	/* (logging of errors already happens in osmo_sock_init_osa() */
+	if (rc < 0)
+		return -1;
+	cfg.port.fd = rc;
+	LOGP(DLGLOBAL, LOGL_NOTICE, "bound UDP %s fd=%d\n", osmo_sock_get_name2(cfg.port.fd), cfg.port.fd);
+
+	struct worker *workers = talloc_zero_array(OTC_GLOBAL, struct worker, cfg.workers_n);
+	for (int i = 0; i < cfg.workers_n; i++) {
+		workers[i].id = i + 1;
+		start_rx_worker(&workers[i]);
+	}
+
+	/* periodically log rx stats */
+	while (1) {
+		static time_t last_info_log = 0;
+		time_t now;
+		time_t diff_time;
+		now = time(NULL);
+		if (!last_info_log)
+			diff_time = 1;
+		else
+			diff_time = now - last_info_log;
+		/* the resolution is in seconds, output stats once per second. */
+		if (diff_time > 0) {
+			uint64_t diff_rx_packets;
+			uint64_t diff_rx_bytes;
+			uint64_t diff_tx_packets;
+			uint64_t diff_tx_bytes;
+			last_info_log = now;
+
+			/* hoping that the counter increments are atomic */
+			diff_rx_packets = counter_get(&g_rx.packets);
+			diff_rx_bytes = counter_get(&g_rx.bytes);
+			diff_tx_packets = counter_get(&g_tx.packets);
+			diff_tx_bytes = counter_get(&g_tx.bytes);
+
+			if (diff_rx_packets || diff_tx_packets) {
+				printf("%ld RX:%7"PRIu64" packets (%4"PRIu64"Mb/s)   TX:%7"PRIu64" packets (%4"PRIu64"Mb/s)\n",
+				       now,
+				       g_rx.packets.count,
+				       diff_rx_bytes / (1024*1024),
+				       g_tx.packets.count,
+				       diff_tx_bytes / (1024*1024));
+				fflush(stdout);
+			}
+		}
+		usleep(1000);
+	}
+}
+
+static void *rx_worker_func(void *_worker);
+
+static void start_rx_worker(struct worker *w)
+{
+	w->q = talloc_zero_size(OTC_GLOBAL, sizeof(struct io_queue) + cfg.queue_size * sizeof(struct data_io));
+	OSMO_ASSERT(w->q);
+	*w->q = (struct io_queue){
+		.d_size = cfg.queue_size,
+	};
+	for (int i = 0; i < w->q->d_size; i++) {
+		struct data_io *d = &w->q->d[i];
+		*d = (struct data_io){
+			.data = talloc_size(w->q, cfg.buf_size),
+			.data_size = cfg.buf_size,
+		};
+	}
+	int rc = pthread_create(&w->worker, NULL, rx_worker_func, w);
+	OSMO_ASSERT(rc >= 0);
+}
+
+static void *rx_worker_func(void *_worker)
+{
+	struct worker *w = _worker;
+	struct io_queue *q = w->q;
+
+	int rc = io_uring_queue_init(q->d_size, &w->ring, 0);
+	OSMO_ASSERT(rc >= 0);
+
+	for (int i = 0; i < q->d_size; i++) {
+		struct data_io *d = &q->d[i];
+		/* fill once with random printable data */
+		for (int j = 0; j < d->data_size; j++)
+			d->data[j] = 32 + random() % (126 - 32 + 1);
+	}
+
+	/* fill the queue to start receiving */
+	for (int i = 0; i < q->d_size; i++) {
+		data_io_prep_recv(&w->ring, &cfg.port, &q->d[i]);
+	}
+
+	struct __kernel_timespec ts_zero = {};
+	struct __kernel_timespec ts_1s = { .tv_sec = 1 };
+
+	while (1) {
+		uint32_t submitted;
+		uint32_t completed = 0;
+		struct io_uring_cqe *cqe;
+
+		/* submit any requests from previous loop */
+		submitted = io_uring_submit(&w->ring);
+
+		/* process all pending completions */
+		while (io_uring_wait_cqe_timeout(&w->ring, &cqe, &ts_zero) == 0) {
+			data_io_handle_completion(&w->ring, &cfg.port, cqe, cfg.response_size, cfg.response_n);
+			completed++;
+		}
+
+		/* Wait a bit longer */
+		if (!submitted && !completed) {
+			if (io_uring_wait_cqe_timeout(&w->ring, &cqe, &ts_1s) == 0) {
+				data_io_handle_completion(&w->ring, &cfg.port, cqe, cfg.response_size, cfg.response_n);
+				completed++;
+			}
+		}
+	}
+
+	talloc_free(q);
+	return 0;
+}
+
+#endif /* HAVE_URING */
+
--- a/contrib/udp_rx_test.c
+++ b/contrib/udp_rx_test.c
@@ -0,0 +1,137 @@
+#include <liburing.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/sockaddr_str.h>
+
+#define RECV_SLOTS 1024
+#define BUF_SIZE 2048
+
+struct io_uring ring = {};
+int num_packets_prepped = 0;
+int num_packets_received = 0;
+
+int rx_fd;
+
+struct recv_slot {
+	struct iovec iov;
+	uint8_t buf[BUF_SIZE];
+	struct msghdr msgh;
+};
+
+struct recv_slot recv_slots[RECV_SLOTS];
+
+bool submit_rx(struct recv_slot *s)
+{
+	struct io_uring_sqe *sqe;
+	num_packets_prepped++;
+
+	s->iov.iov_base = s->buf;
+	s->iov.iov_len = sizeof(s->buf);
+
+	s->msgh = (struct msghdr){
+		.msg_iov = &s->iov,
+		.msg_iovlen = 1,
+	};
+
+	sqe = io_uring_get_sqe(&ring);
+	OSMO_ASSERT(sqe);
+	io_uring_prep_recvmsg(sqe, rx_fd, &s->msgh, 0);
+	io_uring_sqe_set_data(sqe, s);
+	return true;
+}
+
+void handle_completion(struct io_uring_cqe *cqe)
+{
+	struct recv_slot *s;
+	s = io_uring_cqe_get_data(cqe);
+
+	if (cqe->res <= 0) {
+		printf("rc = %d\n", cqe->res);
+		return;
+	}
+
+	io_uring_cqe_seen(&ring, cqe);
+	num_packets_received++;
+
+	/* submit more */
+	submit_rx(s);
+}
+
+int main(int argc, const char **argv)
+{
+	int i;
+	int rc;
+	const char *local_addr_str = "0.0.0.0";
+	uint16_t local_port = 23000;
+
+	struct osmo_sockaddr_str local_addr = {};
+	struct osmo_sockaddr local_osa = {};
+
+	struct __kernel_timespec ts_zero = {};
+	struct __kernel_timespec ts_1s = { .tv_sec = 1 };
+
+	if (argc >= 2)
+		local_addr_str = argv[1];
+	if (argc >= 3)
+		local_port = atoi(argv[2]);
+
+	if (osmo_sockaddr_str_from_str(&local_addr, local_addr_str, local_port)
+	    || osmo_sockaddr_str_to_osa(&local_addr, &local_osa)) {
+		printf("ERROR: invalid address or port number: %s:%d\n", local_addr_str, local_port);
+		return -1;
+	}
+
+	/* create and bind socket */
+	rc = osmo_sock_init_osa(SOCK_DGRAM, IPPROTO_UDP, &local_osa, NULL, OSMO_SOCK_F_BIND);
+	if (rc < 0)
+		return -1;
+	rx_fd = rc;
+	printf("bound UDP %s fd=%d\n", osmo_sock_get_name2(rx_fd), rx_fd);
+
+	rc = io_uring_queue_init(ARRAY_SIZE(recv_slots), &ring, 0);
+
+	/* fill up tx queue */
+	for (i = 0; i < ARRAY_SIZE(recv_slots); i++) {
+		submit_rx(&recv_slots[i]);
+	}
+
+	while (1) {
+		uint32_t new_submissions;
+		uint32_t new_completions = 0;
+		struct io_uring_cqe *cqe;
+
+		/* submit any requests from previous loop */
+		new_submissions = io_uring_submit(&ring);
+
+		/* process all pending completions */
+		while (io_uring_wait_cqe_timeout(&ring, &cqe, &ts_zero) == 0) {
+			handle_completion(cqe);
+			new_completions++;
+
+		}
+
+		/* Nothing happened in this loop iteration, so wait a bit longer */
+		if (!new_submissions && !new_completions) {
+			if (io_uring_wait_cqe_timeout(&ring, &cqe, &ts_1s) == 0) {
+				handle_completion(cqe);
+				new_completions++;
+			}
+		}
+
+		/* log rx */
+		if (1) {
+			static time_t last_info_log = 0;
+			time_t now;
+			now = time(NULL);
+			if (now != last_info_log) {
+				last_info_log = now;
+				printf("%ld RX: %7d packets\n", now, num_packets_received);
+				fflush(stdout);
+			}
+		}
+	}
+
+	printf("done\n");
+	return 0;
+}
--- a/debian/control
+++ b/debian/control
@@ -2,6 +2,7 @@ Source: osmo-upf
 Section: net
 Priority: extra
 Maintainer: Osmocom team <openbsc@lists.osmocom.org>
+# liburing-dev: don't try to install it on debian 10 and ubuntu 20.04
 Build-Depends: debhelper (>= 10),
               dh-autoreconf,
               autotools-dev,
@@ -16,7 +17,8 @@ Build-Depends: debhelper (>= 10),
               libnftables-dev (>= 1.0.2),
               libosmocore-dev (>= 1.6.0),
               libosmo-pfcp-dev (>= 0.1.0),
-               osmo-gsm-manuals-dev (>= 1.2.0)
+               osmo-gsm-manuals-dev (>= 1.2.0),
+               liburing-dev | base-files (<< 11) | ubuntu-keyring (<< 2021),
 Standards-Version: 3.9.8
 Vcs-Git: https://gitea.osmocom.org/cellular-infrastructure/osmo-upf
 Vcs-Browser: https://gitea.osmocom.org/cellular-infrastructure/osmo-upf
--- a/include/osmocom/Makefile.am
+++ b/include/osmocom/Makefile.am
@@ -1,3 +1,4 @@
 SUBDIRS = \
 	upf \
+	pfcptool \
 	$(NULL)
--- a/include/osmocom/pfcptool/Makefile.am
+++ b/include/osmocom/pfcptool/Makefile.am
@@ -0,0 +1,6 @@
+noinst_HEADERS = \
+	checksum.h \
+	gtp_flood.h \
+	pfcp_tool.h \
+	range.h \
+	$(NULL)
--- a/include/osmocom/pfcptool/checksum.h
+++ b/include/osmocom/pfcptool/checksum.h
@@ -0,0 +1,13 @@
+#pragma once
+#include <stdint.h>
+#include <netinet/in.h>
+
+uint16_t ip_fast_csum(const void *iph, unsigned int ihl);
+uint32_t csum_partial(const void *buff, int len, uint32_t wsum);
+uint16_t ip_compute_csum(const void *buff, int len);
+
+uint16_t csum_ipv6_magic(const struct in6_addr *saddr,
+			const struct in6_addr *daddr,
+			uint32_t len, uint8_t proto, uint32_t csum);
+
+uint16_t csum_fold(uint32_t csum);
--- a/include/osmocom/pfcptool/gtp_flood.h
+++ b/include/osmocom/pfcptool/gtp_flood.h
@@ -0,0 +1,58 @@
+#pragma once
+
+#include <osmocom/core/socket.h>
+
+/* According to 3GPP TS 29.060. */
+struct gtp1u_hdr {
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+	uint8_t pn:1, s:1, e:1, spare:1, pt:1, version:3;
+#else
+	uint8_t version:3, pt:1, spare:1, e:1, s:1, pn:1;
+#endif
+	uint8_t type;
+	uint16_t length;
+	uint32_t tei;
+};
+
+struct gtp_flood;
+struct udp_port;
+
+struct gtp_flood_cfg {
+	unsigned int workers;
+	unsigned int queue_size;
+	unsigned int slew_us;
+};
+struct gtp_flood *gtp_flood_alloc(void *ctx, const struct gtp_flood_cfg *cfg);
+
+/* information passed on within generated GTP payload. Main purpose is to allow echoing payloads back into a GTP tunnel
+ * by osmo-udp-responder, which requires knowledge of the counterpart TEID.
+ * (future: add in-band instructions for the responder to shape traffic in certain ways: multiple echos or modified
+ * packet size...)
+ */
+struct gtp_flood_payload_info {
+	char mark[4];
+	/* ordered exactly as it should be returned in a GTP header (network byte order) */
+	uint32_t return_teid;
+} __attribute__((packed));
+
+struct gtp_flood_flow_cfg {
+	bool rx;
+
+	struct udp_port *gtp_local;
+
+	/* below used only for rx == false */
+	struct osmo_sockaddr gtp_remote;
+	uint32_t gtp_remote_teid;
+	struct osmo_sockaddr payload_src;
+	struct osmo_sockaddr payload_dst;
+	unsigned int num_packets;
+
+	bool append_payload_info;
+	struct gtp_flood_payload_info payload_info;
+};
+
+void gtp_flood_add_flow(struct gtp_flood *gtp_flood,
+			const struct gtp_flood_flow_cfg *flow_cfg);
+
+void gtp_flood_start(struct gtp_flood *gtp_flood);
+bool gtp_flood_is_busy(struct gtp_flood *gtp_flood);
--- a/include/osmocom/pfcptool/pfcp_tool.h
+++ b/include/osmocom/pfcptool/pfcp_tool.h
@@ -28,14 +28,23 @@
 #include <osmocom/core/tdef.h>
 #include <osmocom/core/socket.h>
 #include <osmocom/core/sockaddr_str.h>
+#include <osmocom/vty/command.h>

 #include <osmocom/pfcp/pfcp_msg.h>

 #include <osmocom/upf/up_gtp_action.h>
+#include <osmocom/pfcptool/range.h>
+#include <osmocom/pfcptool/gtp_flood.h>

 struct osmo_tdef;
 struct ctrl_handle;

+enum pfcp_tool_vty_node {
+	PEER_NODE = _LAST_OSMOVTY_NODE + 1,
+	SESSION_NODE,
+	GTP_FLOOD_NODE,
+};
+
 extern struct osmo_tdef g_pfcp_tool_tdefs[];
 extern struct osmo_tdef_group g_pfcp_tool_tdef_groups[];

@@ -90,6 +99,16 @@ struct pfcp_tool_session {
 	};
 };

+struct udp_port {
+	struct llist_head entry;
+
+	/* IP address and UDP port from user input */
+	struct osmo_sockaddr osa;
+
+	/* In case this is a locally bound port, this is the fd for the socket. */
+	struct osmo_fd ofd;
+};
+
 struct g_pfcp_tool {
 	struct ctrl_handle *ctrl;

@@ -100,6 +119,43 @@ struct g_pfcp_tool {

 	struct osmo_pfcp_endpoint *ep;
 	struct llist_head peers;
+
+	uint32_t next_teid_state;
+
+	struct {
+		struct range ip_range;
+	} ue;
+
+	struct {
+		/* list of struct udp_port */
+		struct llist_head gtp_local_addrs;
+		struct udp_port *gtp_local_addrs_next;
+
+		/* list of struct udp_port */
+		struct llist_head gtp_core_addrs;
+		struct udp_port *gtp_core_addrs_next;
+
+		struct {
+			struct {
+				/* source address is always the UE IP address */
+				struct range udp_port_range;
+			} source;
+			struct {
+				struct range ip_range;
+				struct range udp_port_range;
+			} target;
+			bool append_info;
+		} payload;
+
+		struct {
+			struct gtp_flood_cfg cfg;
+
+			unsigned int flows_per_session;
+			unsigned int packets_per_flow;
+
+			struct gtp_flood *state;
+		} flood;
+	} gtp;
 };

 extern struct g_pfcp_tool *g_pfcp_tool;
@@ -108,7 +164,7 @@ void g_pfcp_tool_alloc(void *ctx);
 void pfcp_tool_vty_init_cfg();
 void pfcp_tool_vty_init_cmds();

-int pfcp_tool_mainloop();
+int pfcp_tool_mainloop(int poll);

 struct pfcp_tool_peer *pfcp_tool_peer_find_or_create(const struct osmo_sockaddr *remote_addr);
 struct pfcp_tool_session *pfcp_tool_session_find_or_create(struct pfcp_tool_peer *peer, uint64_t cp_seid,
@@ -117,3 +173,13 @@ void pfcp_tool_rx_msg(struct osmo_pfcp_endpoint *ep, struct osmo_pfcp_msg *m, st

 int peer_tx(struct pfcp_tool_peer *peer, struct osmo_pfcp_msg *m);
 uint64_t peer_new_seid(struct pfcp_tool_peer *peer);
+
+uint32_t pfcp_tool_new_teid(void);
+int pfcp_tool_next_ue_addr(struct osmo_sockaddr *dst);
+
+struct udp_port *pfcp_tool_have_local_udp_port_by_str(const struct osmo_sockaddr_str *addr, uint16_t fallback_port);
+struct udp_port *pfcp_tool_have_core_udp_port_by_str(const struct osmo_sockaddr_str *addr, uint16_t fallback_port);
+
+void pfcp_tool_gtp_flood_start(void);
+
+int pfcp_tool_vty_go_parent(struct vty *vty);
--- a/include/osmocom/pfcptool/range.h
+++ b/include/osmocom/pfcptool/range.h
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+struct osmo_sockaddr;
+
+/* A value large enough for an IPv6 address (128bit) */
+struct range_val {
+	uint64_t buf[2];
+	size_t size;
+};
+
+/* Manage stepping through a defined range of values large enough to handle IPv6 addresses. */
+struct range {
+	struct range_val first;
+	struct range_val last;
+	struct range_val next;
+	bool wrapped;
+};
+
+/* struct range r = {};
+ * range_val_set_int(&r.first, 23);
+ * range_val_set_int(&r.last, 42);
+ * while (1) {
+ *     range_next();
+ *     unsigned int val = range_val_get_int(&r.next);
+ *     printf("%u\n", val);
+ * }
+ */
+void range_next(struct range *r);
+void range_val_set_int(struct range_val *rv, uint32_t val);
+uint32_t range_val_get_int(const struct range_val *rv);
+void range_val_set_addr(struct range_val *rv, const struct osmo_sockaddr *val);
+void range_val_get_addr(struct osmo_sockaddr *dst, const struct range_val *rv);
+void range_val_inc(struct range_val *rv);
+int range_val_cmp(const struct range_val *a, const struct range_val *b);
--- a/src/osmo-pfcp-tool/Makefile.am
+++ b/src/osmo-pfcp-tool/Makefile.am
@@ -11,6 +11,7 @@ AM_CFLAGS = \
 	$(LIBOSMOVTY_CFLAGS) \
 	$(LIBOSMOCTRL_CFLAGS) \
 	$(LIBOSMOPFCP_CFLAGS) \
+	$(LIBURING_CFLAGS) \
 	$(COVERAGE_CFLAGS) \
 	$(NULL)

@@ -19,19 +20,19 @@ AM_LDFLAGS = \
 	$(LIBOSMOVTY_LIBS) \
 	$(LIBOSMOCTRL_LIBS) \
 	$(LIBOSMOPFCP_LIBS) \
+	$(LIBURING_LIBS) \
 	$(COVERAGE_LDFLAGS) \
 	$(NULL)

-noinst_HEADERS = \
-	pfcp_tool.h \
-	$(NULL)
-
 bin_PROGRAMS = \
 	osmo-pfcp-tool \
 	$(NULL)

 osmo_pfcp_tool_SOURCES = \
+	checksum.c \
+	gtp_flood.c \
 	osmo_pfcp_tool_main.c \
 	pfcp_tool.c \
 	pfcp_tool_vty.c \
+	range.c \
 	$(NULL)
--- a/src/osmo-pfcp-tool/checksum.c
+++ b/src/osmo-pfcp-tool/checksum.c
@@ -0,0 +1,211 @@
+/*
+ *
+ * INET		An implementation of the TCP/IP protocol suite for the LINUX
+ *		operating system.  INET is implemented using the  BSD Socket
+ *		interface as the means of communication with the user level.
+ *
+ *		IP/TCP/UDP checksumming routines
+ *
+ * Authors:	Jorge Cwik, <jorge@laser.satlink.net>
+ *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
+ *		Tom May, <ftom@netcom.com>
+ *		Andreas Schwab, <schwab@issan.informatik.uni-dortmund.de>
+ *		Lots of code moved from tcp.c and ip.c; see those files
+ *		for more names.
+ *
+ * 03/02/96	Jes Sorensen, Andreas Schwab, Roman Hodek:
+ *		Fixed some nasty bugs, causing some horrible crashes.
+ *		A: At some points, the sum (%0) was used as
+ *		length-counter instead of the length counter
+ *		(%1). Thanks to Roman Hodek for pointing this out.
+ *		B: GCC seems to mess up if one uses too many
+ *		data-registers to hold input values and one tries to
+ *		specify d0 and d1 as scratch registers. Letting gcc
+ *		choose these registers itself solves the problem.
+ *
+ *		This program is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ */
+
+/* Revised by Kenneth Albanowski for m68knommu. Basic problem: unaligned access
+ kills, so most of the assembly has to go. */
+
+#if defined(__FreeBSD__)
+#define _KERNEL	/* needed on FreeBSD 10.x for s6_addr32 */
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <sys/endian.h>
+#endif
+
+#include <osmocom/pfcptool/checksum.h>
+#include <arpa/inet.h>
+
+static inline unsigned short from32to16(unsigned int x)
+{
+	/* add up 16-bit and 16-bit for 16+c bit */
+	x = (x & 0xffff) + (x >> 16);
+	/* add up carry.. */
+	x = (x & 0xffff) + (x >> 16);
+	return x;
+}
+
+static unsigned int do_csum(const unsigned char *buff, int len)
+{
+	int odd;
+	unsigned int result = 0;
+
+	if (len <= 0)
+		goto out;
+	odd = 1 & (unsigned long) buff;
+	if (odd) {
+#if BYTE_ORDER == LITTLE_ENDIAN
+		result += (*buff << 8);
+#else
+		result = *buff;
+#endif
+		len--;
+		buff++;
+	}
+	if (len >= 2) {
+		if (2 & (unsigned long) buff) {
+			result += *(unsigned short *) buff;
+			len -= 2;
+			buff += 2;
+		}
+		if (len >= 4) {
+			const unsigned char *end = buff + ((unsigned)len & ~3);
+			unsigned int carry = 0;
+			do {
+				unsigned int w = *(unsigned int *) buff;
+				buff += 4;
+				result += carry;
+				result += w;
+				carry = (w > result);
+			} while (buff < end);
+			result += carry;
+			result = (result & 0xffff) + (result >> 16);
+		}
+		if (len & 2) {
+			result += *(unsigned short *) buff;
+			buff += 2;
+		}
+	}
+	if (len & 1)
+#if BYTE_ORDER == LITTLE_ENDIAN
+		result += *buff;
+#else
+		result += (*buff << 8);
+#endif
+	result = from32to16(result);
+	if (odd)
+		result = ((result >> 8) & 0xff) | ((result & 0xff) << 8);
+out:
+	return result;
+}
+
+/*
+ *	This is a version of ip_compute_csum() optimized for IP headers,
+ *	which always checksum on 4 octet boundaries.
+ */
+uint16_t ip_fast_csum(const void *iph, unsigned int ihl)
+{
+	return (uint16_t)~do_csum(iph, ihl*4);
+}
+
+/*
+ * computes the checksum of a memory block at buff, length len,
+ * and adds in "sum" (32-bit)
+ *
+ * returns a 32-bit number suitable for feeding into itself
+ * or csum_tcpudp_magic
+ *
+ * this function must be called with even lengths, except
+ * for the last fragment, which may be odd
+ *
+ * it's best to have buff aligned on a 32-bit boundary
+ */
+uint32_t csum_partial(const void *buff, int len, uint32_t wsum)
+{
+	unsigned int sum = (unsigned int)wsum;
+	unsigned int result = do_csum(buff, len);
+
+	/* add in old sum, and carry.. */
+	result += sum;
+	if (sum > result)
+		result += 1;
+	return (uint32_t)result;
+}
+
+/*
+ * this routine is used for miscellaneous IP-like checksums, mainly
+ * in icmp.c
+ */
+uint16_t ip_compute_csum(const void *buff, int len)
+{
+	return (uint16_t)~do_csum(buff, len);
+}
+
+uint16_t csum_ipv6_magic(const struct in6_addr *saddr,
+			const struct in6_addr *daddr,
+			uint32_t len, uint8_t proto, uint32_t csum)
+{
+	int carry;
+	uint32_t ulen;
+	uint32_t uproto;
+	uint32_t sum = (uint32_t)csum;
+
+	sum += (uint32_t)saddr->s6_addr32[0];
+	carry = (sum < (uint32_t)saddr->s6_addr32[0]);
+	sum += carry;
+
+	sum += (uint32_t)saddr->s6_addr32[1];
+	carry = (sum < (uint32_t)saddr->s6_addr32[1]);
+	sum += carry;
+
+	sum += (uint32_t)saddr->s6_addr32[2];
+	carry = (sum < (uint32_t)saddr->s6_addr32[2]);
+	sum += carry;
+
+	sum += (uint32_t)saddr->s6_addr32[3];
+	carry = (sum < (uint32_t)saddr->s6_addr32[3]);
+	sum += carry;
+
+	sum += (uint32_t)daddr->s6_addr32[0];
+	carry = (sum < (uint32_t)daddr->s6_addr32[0]);
+	sum += carry;
+
+	sum += (uint32_t)daddr->s6_addr32[1];
+	carry = (sum < (uint32_t)daddr->s6_addr32[1]);
+	sum += carry;
+
+	sum += (uint32_t)daddr->s6_addr32[2];
+	carry = (sum < (uint32_t)daddr->s6_addr32[2]);
+	sum += carry;
+
+	sum += (uint32_t)daddr->s6_addr32[3];
+	carry = (sum < (uint32_t)daddr->s6_addr32[3]);
+	sum += carry;
+
+	ulen = (uint32_t)htonl((uint32_t) len);
+	sum += ulen;
+	carry = (sum < ulen);
+	sum += carry;
+
+	uproto = (uint32_t)htonl(proto);
+	sum += uproto;
+	carry = (sum < uproto);
+	sum += carry;
+
+	return csum_fold((uint32_t)sum);
+}
+
+/* fold a partial checksum */
+uint16_t csum_fold(uint32_t csum)
+{
+	uint32_t sum = (uint32_t)csum;
+	sum = (sum & 0xffff) + (sum >> 16);
+	sum = (sum & 0xffff) + (sum >> 16);
+	return (uint16_t)~sum;
+}
--- a/src/osmo-pfcp-tool/gtp_flood.c
+++ b/src/osmo-pfcp-tool/gtp_flood.c
@@ -0,0 +1,689 @@
+/* GTP-U traffic/load generator.  Generates a configurable amount of UDP/IP flows using io_uring.
+ *
+ * Based on gtp-load-gen.c from https://gitea.osmocom.org/cellular-infrastructure/gtp-load-gen
+ * which is marked (C) 2021 by Harald Welte <laforge@osmocom.org>
+ */
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "config.h"
+
+#include <osmocom/pfcptool/gtp_flood.h>
+#include <osmocom/core/logging.h>
+
+#if HAVE_URING
+
+#include <unistd.h>
+#include <liburing.h>
+#include <pthread.h>
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/udp.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/pfcptool/pfcp_tool.h>
+#include <osmocom/pfcptool/checksum.h>
+
+#define PKT_BUF_SIZE 2048
+
+struct gtp_flood_worker;
+
+struct gtp_flood {
+	struct gtp_flood_cfg cfg;
+
+	/* list of struct gtp_flood_worker */
+	struct llist_head tx_workers;
+	/* state for round robin */
+	void *next_tx_worker;
+	int tx_workers_started;
+	int tx_workers_running;
+
+	/* list of struct gtp_flood_worker */
+	struct llist_head rx_workers;
+	void *next_rx_worker;
+	int rx_workers_started;
+	int rx_workers_running;
+};
+
+struct counter {
+	uint64_t count;
+	uint64_t last;
+};
+
+struct traffic_counter {
+	struct counter packets;
+	struct counter bytes;
+};
+
+uint64_t counter_get(struct counter *c)
+{
+	uint64_t val = c->count - c->last;
+	c->last = c->count;
+	return val;
+}
+
+struct gtp_flood_worker {
+	struct llist_head entry;
+
+	/* backpointer */
+	struct gtp_flood *gtp_flood;
+
+	/* list of struct gtp_flood_flow */
+	struct llist_head flows;
+
+	struct io_uring ring;
+	pthread_t worker;
+
+	struct counter submitted_packets;
+	struct counter submitted_packets2;
+	struct traffic_counter tx;
+	struct traffic_counter rx;
+};
+
+struct gtp_flood_flow {
+	struct llist_head entry;
+
+	/* backpointer */
+	struct gtp_flood_worker *worker;
+
+	struct gtp_flood_flow_cfg cfg;
+
+	/* for logging and included in generated payloads */
+	unsigned int id;
+
+	/* must live until completion */
+	struct iovec iov[1];
+	struct msghdr msgh;
+
+	/* flow-private packet buffer */
+	uint8_t *pkt_buf;
+
+	unsigned int submitted_gtp_packets;
+	unsigned int sent_gtp_packets;
+
+	unsigned int received_udp_packets;
+	unsigned int received_udp_bytes;
+
+	bool stop;
+};
+
+static void gtp_flood_worker_init(struct gtp_flood *gtp_flood, struct gtp_flood_worker *worker)
+{
+	worker->gtp_flood = gtp_flood;
+	INIT_LLIST_HEAD(&worker->flows);
+}
+
+struct gtp_flood *gtp_flood_alloc(void *ctx, const struct gtp_flood_cfg *cfg)
+{
+	struct gtp_flood *gtp_flood;
+	struct gtp_flood_cfg *c;
+	int i;
+
+	gtp_flood = talloc_zero(ctx, struct gtp_flood);
+	*gtp_flood = (struct gtp_flood){
+		.cfg = *cfg,
+	};
+	INIT_LLIST_HEAD(&gtp_flood->tx_workers);
+	INIT_LLIST_HEAD(&gtp_flood->rx_workers);
+	c = &gtp_flood->cfg;
+
+	c->workers = OSMO_MAX(1, c->workers);
+	for (i = 0; i < c->workers; i++) {
+		struct gtp_flood_worker *w = talloc_zero(gtp_flood, struct gtp_flood_worker);
+		gtp_flood_worker_init(gtp_flood, w);
+		llist_add(&w->entry, &gtp_flood->tx_workers);
+	}
+	LOGP(DLGLOBAL, LOGL_NOTICE, "tx workers: %u\n", llist_count(&gtp_flood->tx_workers));
+
+	for (i = 0; i < 1; i++) {
+		struct gtp_flood_worker *w = talloc_zero(gtp_flood, struct gtp_flood_worker);
+		gtp_flood_worker_init(gtp_flood, w);
+		llist_add(&w->entry, &gtp_flood->rx_workers);
+	}
+	LOGP(DLGLOBAL, LOGL_NOTICE, "rx workers: %u\n", llist_count(&gtp_flood->rx_workers));
+	return gtp_flood;
+}
+
+static void gtp_flood_flow_init_payload(struct gtp_flood_flow *flow)
+{
+	struct gtp1u_hdr *gtp_hdr = (void *)flow->pkt_buf;
+
+	*gtp_hdr = (struct gtp1u_hdr) {
+		.pn = 0,
+		.s = 0,
+		.e = 0,
+		.spare = 0,
+		.pt = 1,
+		.version = 1,
+		.type = 0xff,	/* G-PDU */
+		.length = 0,	/* filled in later */
+		.tei = htonl(flow->cfg.gtp_remote_teid),
+	};
+
+	uint8_t *cur = flow->pkt_buf + sizeof(*gtp_hdr);
+
+	/* FIXME: randomize this */
+	unsigned int udp_len = 1024;
+
+	struct iphdr *iph;
+	struct ip6_hdr *ip6h;
+	struct udphdr *uh;
+	struct osmo_sockaddr *src = &flow->cfg.payload_src;
+	struct osmo_sockaddr *dst = &flow->cfg.payload_dst;
+
+	if (src->u.sa.sa_family == AF_INET) {
+		iph = (struct iphdr *) cur;
+		cur += sizeof(*iph);
+
+		iph->ihl = 5;
+		iph->version = 4;
+		iph->tos = 0;
+		iph->tot_len = htons(udp_len + sizeof(struct udphdr) + sizeof(*iph));
+		iph->id = 0;
+		iph->frag_off = 0;
+		iph->ttl = 32;
+		iph->protocol = IPPROTO_UDP;
+		iph->saddr = src->u.sin.sin_addr.s_addr;
+		iph->daddr = dst->u.sin.sin_addr.s_addr;
+		iph->check = ip_fast_csum(iph, iph->ihl);
+	} else {
+		ip6h = (struct ip6_hdr *) cur;
+		cur += sizeof(*ip6h);
+
+		ip6h->ip6_flow = htonl((6 << 28));
+		ip6h->ip6_plen = htons(udp_len + sizeof(struct udphdr));
+		ip6h->ip6_nxt = IPPROTO_UDP;
+		ip6h->ip6_hlim = 32;
+		ip6h->ip6_src = src->u.sin6.sin6_addr;
+		ip6h->ip6_dst = dst->u.sin6.sin6_addr;
+	}
+
+	uh = (struct udphdr *) cur;
+	cur += sizeof(*uh);
+
+	uh->source = htons(osmo_sockaddr_port(&src->u.sa));
+	uh->dest = htons(osmo_sockaddr_port(&dst->u.sa));
+	uh->len = htons(udp_len);
+	uh->check = 0; // TODO
+
+	gtp_hdr->length = htons(udp_len + (cur - flow->pkt_buf) - sizeof(*gtp_hdr));
+
+	/* initialize this once, so we have it ready for each transmit */
+	flow->msgh.msg_name = &flow->cfg.gtp_remote.u.sa;
+	flow->msgh.msg_namelen = sizeof(flow->cfg.gtp_remote.u.sa);
+	flow->msgh.msg_iov = flow->iov;
+	flow->msgh.msg_iovlen = ARRAY_SIZE(flow->iov);
+	flow->msgh.msg_control = NULL;
+	flow->msgh.msg_controllen = 0;
+	flow->msgh.msg_flags = 0;
+
+	struct iovec *iov = &flow->iov[0];
+	iov->iov_base = flow->pkt_buf;
+	iov->iov_len = udp_len + (cur - flow->pkt_buf);
+	OSMO_ASSERT(iov->iov_len <= PKT_BUF_SIZE);
+
+	/* write some payload */
+	struct osmo_strbuf sb = { .buf = (void *)cur, .len = udp_len };
+	OSMO_STRBUF_PRINTF(sb, "osmo-pfcp-tool gtp flood, emitted from %s to %s teid 0x%08x flow %u\n",
+			   osmo_sockaddr_to_str_c(OTC_SELECT, &flow->cfg.gtp_local->osa),
+			   osmo_sockaddr_to_str_c(OTC_SELECT, &flow->cfg.gtp_remote),
+			   flow->cfg.gtp_remote_teid,
+			   flow->id);
+
+	if (flow->cfg.append_payload_info) {
+		if (iov->iov_len < (sizeof(flow->cfg.payload_info) + 1)) {
+			OSMO_ASSERT(PKT_BUF_SIZE > sizeof(flow->cfg.payload_info));
+			iov->iov_len = sizeof(flow->cfg.payload_info) + 1;
+		}
+		uint8_t *len = ((uint8_t *)iov->iov_base) + iov->iov_len - 1;
+		struct gtp_flood_payload_info *info = (void *)(len - sizeof(flow->cfg.payload_info));
+		*len = sizeof(flow->cfg.payload_info);
+		*info = flow->cfg.payload_info;
+		memcpy(info->mark, "info", 4);
+	}
+}
+
+static void gtp_flood_flow_init_rxbuf(struct gtp_flood_flow *flow)
+{
+	flow->msgh.msg_iov = flow->iov;
+	flow->msgh.msg_iovlen = ARRAY_SIZE(flow->iov);
+	flow->msgh.msg_control = NULL;
+	flow->msgh.msg_controllen = 0;
+	flow->msgh.msg_flags = 0;
+
+	flow->iov[0].iov_base = flow->pkt_buf;
+	flow->iov[0].iov_len = PKT_BUF_SIZE;
+}
+
+#define llist_round_robin(LIST, STATE, STRUCT, ENTRY_NAME) \
+	llist_entry(_llist_round_robin(LIST, STATE), STRUCT, ENTRY_NAME)
+struct llist_head *_llist_round_robin(struct llist_head *list, void **state)
+{
+	struct llist_head *e = *state;
+	if (!e || e->next == list)
+		e = list;
+	e = e->next;
+	if (e == list)
+		e = NULL;
+	*state = e;
+	return e;
+}
+
+struct gtp_flood_worker *gtp_flood_next_tx_worker(struct gtp_flood *gtp_flood)
+{
+	return llist_round_robin(&gtp_flood->tx_workers, &gtp_flood->next_tx_worker,
+				 struct gtp_flood_worker, entry);
+}
+
+struct gtp_flood_worker *gtp_flood_next_rx_worker(struct gtp_flood *gtp_flood)
+{
+	return llist_round_robin(&gtp_flood->rx_workers, &gtp_flood->next_rx_worker,
+				 struct gtp_flood_worker, entry);
+}
+
+void gtp_flood_worker_add_flow(struct gtp_flood *gtp_flood,
+			       struct gtp_flood_worker *worker,
+			       const struct gtp_flood_flow_cfg *flow_cfg)
+{
+	static unsigned int next_flow_id = 0;
+
+	struct gtp_flood_flow *flow = talloc_zero(gtp_flood, struct gtp_flood_flow);
+	flow->cfg = *flow_cfg;
+	flow->id = next_flow_id++;
+
+	flow->pkt_buf = talloc_zero_size(flow, PKT_BUF_SIZE);
+	OSMO_ASSERT(flow->pkt_buf);
+
+	flow->worker = worker;
+	if (flow->cfg.rx == false)
+		gtp_flood_flow_init_payload(flow);
+	else
+		gtp_flood_flow_init_rxbuf(flow);
+	llist_add_tail(&flow->entry, &worker->flows);
+}
+
+void gtp_flood_add_flow(struct gtp_flood *gtp_flood,
+			const struct gtp_flood_flow_cfg *flow_cfg)
+{
+	struct gtp_flood_worker *w;
+	if (flow_cfg->rx == false)
+		w = gtp_flood_next_tx_worker(gtp_flood);
+	else
+		w = gtp_flood_next_rx_worker(gtp_flood);
+	gtp_flood_worker_add_flow(gtp_flood, w, flow_cfg);
+}
+
+/* transmit one packet for a given flow */
+static bool gtp_flow_tx_one(struct gtp_flood_flow *flow)
+{
+	struct gtp_flood_worker *worker = flow->worker;
+	struct io_uring_sqe *sqe;
+
+	sqe = io_uring_get_sqe(&worker->ring);
+	if (!sqe)
+		return false;
+	io_uring_prep_sendmsg(sqe, flow->cfg.gtp_local->ofd.fd, &flow->msgh, 0);
+	io_uring_sqe_set_data(sqe, flow);
+	return true;
+}
+
+static void tx_completion(struct gtp_flood_worker *worker, struct io_uring_cqe *cqe, int *tx_flows_ended)
+{
+	struct gtp_flood_flow *flow;
+	flow = io_uring_cqe_get_data(cqe);
+
+	if (cqe->res >= 0) {
+		flow->sent_gtp_packets++;
+
+		worker->tx.packets.count++;
+		worker->tx.bytes.count += cqe->res;
+
+		if (flow->cfg.num_packets
+		    && flow->sent_gtp_packets >= flow->cfg.num_packets) {
+			flow->stop = true;
+			(*tx_flows_ended)++;
+		}
+	} else {
+		flow->submitted_gtp_packets--;
+	}
+	io_uring_cqe_seen(&worker->ring, cqe);
+}
+
+static void *gtp_flood_tx_worker_thread(void *_worker)
+{
+	struct gtp_flood_worker *worker = (struct gtp_flood_worker *)_worker;
+	struct gtp_flood *gtp_flood = worker->gtp_flood;
+
+	osmo_ctx_init(__func__);
+
+	int worker_id = gtp_flood->tx_workers_started++;
+	gtp_flood->tx_workers_running++;
+
+	LOGP(DLGLOBAL, LOGL_INFO, "gtp flood tx worker %d starting (%u started, %u running)\n",
+	     worker_id,
+	     gtp_flood->tx_workers_started,
+	     gtp_flood->tx_workers_running);
+
+	int tx_flows_count = llist_count(&worker->flows);
+	int tx_flows_ended = 0;
+
+	int num_submitted_total = 0;
+	int num_submitted2_total = 0;
+
+	struct __kernel_timespec ts_zero = {};
+	struct __kernel_timespec ts_timeout = { .tv_nsec = 0.5e9 };
+
+	while (tx_flows_ended < tx_flows_count) {
+		uint32_t num_submitted = 0;
+		int num_submitted2;
+		if (gtp_flood->cfg.slew_us)
+			usleep(gtp_flood->cfg.slew_us);
+
+		/* fill up sqe with transmit submissions */
+		bool keep_submitting = true;
+		while (keep_submitting) {
+			int submitted_was = num_submitted;
+
+			struct gtp_flood_flow *flow;
+			llist_for_each_entry (flow, &worker->flows, entry) {
+				if (flow->stop)
+					continue;
+
+				if (flow->cfg.num_packets
+				    && flow->submitted_gtp_packets >= flow->cfg.num_packets)
+					continue;
+
+				if (gtp_flow_tx_one(flow)) {
+					flow->submitted_gtp_packets++;
+					num_submitted++;
+
+					worker->submitted_packets.count++;
+				} else {
+					/* out of sqe. */
+					keep_submitting = false;
+					break;
+				}
+			}
+
+			/* No change in number of submitted PDUs, all flows are done submitting for this round. */
+			if (submitted_was == num_submitted)
+				keep_submitting = false;
+		}
+
+		/* actually submit */
+		num_submitted2 = io_uring_submit(&worker->ring);
+		worker->submitted_packets2.count += num_submitted2;
+
+		/* process all pending completions */
+		int completed = 0;
+		struct io_uring_cqe *cqe;
+		while (io_uring_wait_cqe_timeout(&worker->ring, &cqe, &ts_zero) == 0) {
+			tx_completion(worker, cqe, &tx_flows_ended);
+			completed++;
+		}
+
+		/* periodically log tx stats */
+		if (0) {
+			static time_t last_info_log = 0;
+			time_t now;
+			time_t diff_time;
+			now = time(NULL);
+			if (!last_info_log)
+				diff_time = 1;
+			else
+				diff_time = now - last_info_log;
+			/* the resolution is in seconds, output stats once per second. */
+			if (diff_time > 0) {
+				last_info_log = now;
+
+				uint64_t diff_tx_packets;
+				uint64_t diff_tx_bytes;
+				diff_tx_packets = counter_get(&worker->tx.packets);
+				diff_tx_bytes = counter_get(&worker->tx.bytes);
+
+				if (diff_tx_packets) {
+					LOGP(DLGLOBAL, LOGL_INFO,
+					     "%d: tx %"PRIu64" packets %"PRIu64"Mbyte (%"PRIu64"Mbyte/s)"
+					     " (pending %"PRIu64", %"PRIu64")\n",
+					     worker_id,
+					     worker->tx.packets.count, worker->tx.bytes.count / (1024*1024),
+					     (diff_tx_bytes / diff_time) / (1024*1024),
+					     worker->submitted_packets.count - worker->submitted_packets2.count,
+					     worker->submitted_packets2.count - worker->tx.packets.count
+					    );
+
+					/* mark that something happened to not enter the wait below */
+					completed++;
+				}
+			}
+		}
+
+		if (!num_submitted2 && !completed) {
+			/* There are currently no slots available for submitting more packets, wait until the next slot
+			 * becomes available. After a timeout, re-check whether the worker should exit. */
+			if (io_uring_wait_cqe_timeout(&worker->ring, &cqe, &ts_timeout) == 0) {
+				tx_completion(worker, cqe, &tx_flows_ended);
+				completed++;
+			}
+		}
+
+		num_submitted_total += num_submitted;
+		if (num_submitted2 > 0)
+			num_submitted2_total += num_submitted2;
+	}
+
+	gtp_flood->tx_workers_running--;
+	LOGP(DLGLOBAL, LOGL_INFO, "gtp flood tx worker %d done (%u started, %u running) (%"PRIu64" packets not submitted)\n",
+	     worker_id,
+	     gtp_flood->tx_workers_started,
+	     gtp_flood->tx_workers_running,
+	     worker->submitted_packets.count - worker->tx.packets.count);
+	return NULL;
+}
+
+/* receive one packet for a given flow */
+static bool gtp_flow_rx_one(struct gtp_flood_flow *flow)
+{
+	struct gtp_flood_worker *worker = flow->worker;
+	struct io_uring_sqe *sqe;
+
+	sqe = io_uring_get_sqe(&worker->ring);
+	if (!sqe)
+		return false;
+	io_uring_prep_recvmsg(sqe, flow->cfg.gtp_local->ofd.fd, &flow->msgh, 0);
+	io_uring_sqe_set_data(sqe, flow);
+	return true;
+}
+
+void rx_completion(struct gtp_flood_worker *worker, struct io_uring_cqe *cqe)
+{
+	int len = cqe->res;
+	struct gtp_flood_flow *flow;
+
+	flow = io_uring_cqe_get_data(cqe);
+	if (len > 0) {
+		flow->received_udp_packets++;
+		flow->received_udp_bytes += len;
+		worker->rx.packets.count++;
+		worker->rx.bytes.count += len;
+	}
+	io_uring_cqe_seen(&worker->ring, cqe);
+
+	/* reschedule */
+	gtp_flow_rx_one(flow);
+}
+
+static void *gtp_flood_rx_worker_thread(void *_worker)
+{
+	struct gtp_flood_worker *worker = (struct gtp_flood_worker *)_worker;
+	struct gtp_flood *gtp_flood = worker->gtp_flood;
+
+	osmo_ctx_init(__func__);
+
+	int worker_id = gtp_flood->rx_workers_started++;
+	gtp_flood->rx_workers_running++;
+
+	LOGP(DLGLOBAL, LOGL_INFO, "gtp rx worker starting (%u started, %u running)\n",
+	     gtp_flood->rx_workers_started,
+	     gtp_flood->rx_workers_running);
+
+	struct gtp_flood_flow *flow;
+	void *next_flow = NULL;
+
+	struct __kernel_timespec ts_zero = {};
+	struct __kernel_timespec ts_1s = { .tv_sec = 1 };
+
+	/* submit all rx flows N times until the queue is full */
+	do {
+		flow = llist_round_robin(&worker->flows, &next_flow, struct gtp_flood_flow, entry);
+	} while (gtp_flow_rx_one(flow));
+
+	/* service completions and resubmit sqe */
+	while (1) {
+		struct io_uring_cqe *cqe;
+		int submitted;
+		int completed = 0;
+
+		//usleep(1000);
+
+		/* submit batch of pending reads */
+		submitted = io_uring_submit(&worker->ring);
+
+		/* process all pending completions */
+		while (io_uring_wait_cqe_timeout(&worker->ring, &cqe, &ts_zero) == 0) {
+			rx_completion(worker, cqe);
+			completed++;
+		}
+
+		/* periodically log rx stats */
+		if (1) {
+			static time_t last_info_log = 0;
+			time_t now;
+			time_t diff_time;
+			now = time(NULL);
+			if (!last_info_log)
+				diff_time = 1;
+			else
+				diff_time = now - last_info_log;
+			/* the resolution is in seconds, output stats once per second. */
+			if (diff_time > 0) {
+				last_info_log = now;
+
+				uint64_t diff_rx_packets;
+				uint64_t diff_rx_bytes;
+				diff_rx_packets = counter_get(&worker->rx.packets);
+				diff_rx_bytes = counter_get(&worker->rx.bytes);
+
+				uint64_t count_tx_packets = 0;
+				uint64_t count_tx_bytes = 0;
+				uint64_t diff_tx_packets = 0;
+				uint64_t diff_tx_bytes = 0;
+				struct gtp_flood_worker *tx_w;
+				llist_for_each_entry (tx_w, &gtp_flood->tx_workers, entry) {
+					count_tx_packets += tx_w->tx.packets.count;
+					count_tx_bytes += tx_w->tx.bytes.count;
+					diff_tx_packets += counter_get(&tx_w->tx.packets);
+					diff_tx_bytes += counter_get(&tx_w->tx.bytes);
+				}
+
+				if (diff_rx_packets) {
+					LOGP(DLGLOBAL, LOGL_INFO,
+					     "%d: tx %"PRIu64" packets %"PRIu64"Mbyte (%"PRIu64"Mbyte/s)"
+					     "  pending %"PRIu64
+					     " rx %"PRIu64" packets %"PRIu64"Mbyte (%"PRIu64"Mbyte/s)\n",
+					     worker_id,
+					     count_tx_packets, count_tx_bytes / (1024*1024),
+					     (diff_tx_bytes / diff_time) / (1024*1024),
+					     count_tx_packets - worker->rx.packets.count,
+					     worker->rx.packets.count, worker->rx.bytes.count / (1024*1024),
+					     (diff_rx_bytes / diff_time) / (1024*1024));
+
+					/* mark that something happened to not enter the wait below */
+					completed++;
+				}
+			}
+		}
+
+		/* Nothing happened in this loop, wait for the next event */
+		if (!submitted && !completed) {
+			if (io_uring_wait_cqe_timeout(&worker->ring, &cqe, &ts_1s) == 0) {
+				rx_completion(worker, cqe);
+				completed++;
+			}
+		}
+	}
+
+	gtp_flood->rx_workers_running--;
+	return NULL;
+}
+
+static void gtp_flood_worker_start(struct gtp_flood_worker *worker,
+				   void *(*worker_func)(void *))
+{
+	int rc;
+	rc = io_uring_queue_init(worker->gtp_flood->cfg.queue_size, &worker->ring, 0);
+	OSMO_ASSERT(rc >= 0);
+	rc = pthread_create(&worker->worker, NULL, worker_func, worker);
+	OSMO_ASSERT(rc >= 0);
+}
+
+void gtp_flood_start(struct gtp_flood *gtp_flood)
+{
+	struct gtp_flood_worker *w;
+	llist_for_each_entry (w, &gtp_flood->tx_workers, entry)
+		gtp_flood_worker_start(w, gtp_flood_tx_worker_thread);
+	llist_for_each_entry (w, &gtp_flood->rx_workers, entry)
+		gtp_flood_worker_start(w, gtp_flood_rx_worker_thread);
+}
+
+bool gtp_flood_is_busy(struct gtp_flood *gtp_flood)
+{
+	if (!gtp_flood)
+		return false;
+	return gtp_flood->tx_workers_started && gtp_flood->tx_workers_running;
+}
+
+#else /* HAVE_URING */
+
+struct gtp_flood *gtp_flood_alloc(void *ctx, unsigned int workers)
+{
+	LOGP(DLGLOBAL, LOGL_ERROR, "Cannot start GTP flood: built without liburing support\n");
+	return NULL;
+}
+
+void gtp_flood_add_flow(struct gtp_flood *gtp_flood,
+			const struct gtp_flood_flow_cfg *flow_cfg)
+{
+}
+
+void gtp_flood_start(struct gtp_flood *gtp_flood)
+{
+}
+
+bool gtp_flood_is_busy(struct gtp_flood *gtp_flood)
+{
+	return false;
+}
+
+#endif /* HAVE_URING */
--- a/src/osmo-pfcp-tool/osmo_pfcp_tool_main.c
+++ b/src/osmo-pfcp-tool/osmo_pfcp_tool_main.c
@@ -42,7 +42,8 @@

 #include <osmocom/pfcp/pfcp_endpoint.h>

-#include "pfcp_tool.h"
+#include <osmocom/pfcptool/pfcp_tool.h>
+#include <osmocom/pfcptool/gtp_flood.h>

 #define _GNU_SOURCE
 #include <getopt.h>
@@ -206,7 +207,6 @@ static void signal_handler(int signum)
 	}
 }

-
 static struct vty_app_info pfcp_tool_vty_app_info = {
 	.name = "osmo-pfcp-tool",
 	.version = PACKAGE_VERSION,
@@ -216,6 +216,7 @@ static struct vty_app_info pfcp_tool_vty_app_info = {
 	"License AGPLv3+: GNU AGPL version 3 or later <http://gnu.org/licenses/agpl-3.0.html>\r\n"
 	"This is free software: you are free to change and redistribute it.\r\n"
 	"There is NO WARRANTY, to the extent permitted by law.\r\n",
+	.go_parent_cb = pfcp_tool_vty_go_parent,
 };

 static const struct log_info_cat pfcp_tool_default_categories[] = {
@@ -226,14 +227,15 @@ const struct log_info log_info = {
 	.num_cat = ARRAY_SIZE(pfcp_tool_default_categories),
 };

-int pfcp_tool_mainloop()
+int pfcp_tool_mainloop(int poll)
 {
+	int rc;
 	log_reset_context();
-	osmo_select_main_ctx(0);
+	rc = osmo_select_main_ctx(poll);

 	/* If the user hits Ctrl-C the third time, just terminate immediately. */
 	if (quit >= 3)
-		return 1;
+		return -1;

 	/* Has SIGTERM been received (and not yet been handled)? */
 	if (quit && !osmo_select_shutdown_requested()) {
@@ -243,7 +245,7 @@ int pfcp_tool_mainloop()
 		osmo_select_shutdown_request();
 		/* continue the main select loop until all write queues are serviced. */
 	}
-	return 0;
+	return rc;
 }

 int main(int argc, char **argv)
@@ -326,7 +328,7 @@ int main(int argc, char **argv)
 		}
 	}

-	pfcp_tool_mainloop();
+	pfcp_tool_mainloop(1);

 	pfcp_tool_vty_init_cmds();

@@ -338,17 +340,18 @@ int main(int argc, char **argv)
 			     pfcp_tool_cmdline_config.command_file);
 			return 1;
 		}
-		printf("Done reading '%s', waiting for retransmission queue...\n",
+		printf("Done reading '%s', waiting for tasks to conclude...\n",
 		       pfcp_tool_cmdline_config.command_file);
 		do {
-			if (pfcp_tool_mainloop())
+			if (pfcp_tool_mainloop(0) == -1)
 				break;
-		} while (osmo_pfcp_endpoint_retrans_queue_is_busy(g_pfcp_tool->ep));
-		printf("Done\n");
+		} while (osmo_pfcp_endpoint_retrans_queue_is_busy(g_pfcp_tool->ep)
+			 || gtp_flood_is_busy(g_pfcp_tool->gtp.flood.state));
+		LOGP(DLGLOBAL, LOGL_NOTICE, "Done\n");
 	} else {
 		printf("Listening for commands on VTY...\n");
 		do {
-			if (pfcp_tool_mainloop())
+			if (pfcp_tool_mainloop(0) == -1)
 				break;
 		} while (!osmo_select_shutdown_done());
 	}
--- a/src/osmo-pfcp-tool/pfcp_tool.c
+++ b/src/osmo-pfcp-tool/pfcp_tool.c
@@ -26,7 +26,8 @@

 #include <osmocom/pfcp/pfcp_endpoint.h>

-#include "pfcp_tool.h"
+#include <osmocom/pfcptool/pfcp_tool.h>
+#include <osmocom/pfcptool/gtp_flood.h>

 struct g_pfcp_tool *g_pfcp_tool = NULL;

@@ -45,9 +46,21 @@ void g_pfcp_tool_alloc(void *ctx)
 			.local_ip = talloc_strdup(g_pfcp_tool, "0.0.0.0"),
 			.local_port = OSMO_PFCP_PORT,
 		},
+		.next_teid_state = 23,
+		.gtp.flood = {
+			.cfg = {
+				.workers = 1,
+				.queue_size = 4096,
+				.slew_us = 0,
+			},
+			.flows_per_session = 1,
+			.packets_per_flow = 0,
+		},
 	};

 	INIT_LLIST_HEAD(&g_pfcp_tool->peers);
+	INIT_LLIST_HEAD(&g_pfcp_tool->gtp.gtp_local_addrs);
+	INIT_LLIST_HEAD(&g_pfcp_tool->gtp.gtp_core_addrs);
 }

 struct pfcp_tool_peer *pfcp_tool_peer_find(const struct osmo_sockaddr *remote_addr)
@@ -176,6 +189,8 @@ int peer_tx(struct pfcp_tool_peer *peer, struct osmo_pfcp_msg *m)
 	else
 		copy_msg(&peer->last_req, m);
 	rc = osmo_pfcp_endpoint_tx(g_pfcp_tool->ep, m);
+	if (rc)
+		LOGP(DLPFCP, LOGL_ERROR, "Failed to transmit PFCP: %s\n", strerror(-rc));
 	return rc;
 }

@@ -183,3 +198,217 @@ uint64_t peer_new_seid(struct pfcp_tool_peer *peer)
 {
 	return peer->next_seid_state++;
 }
+
+uint32_t pfcp_tool_new_teid(void)
+{
+	return g_pfcp_tool->next_teid_state++;
+}
+
+int pfcp_tool_next_ue_addr(struct osmo_sockaddr *dst)
+{
+	range_next(&g_pfcp_tool->ue.ip_range);
+	if (g_pfcp_tool->ue.ip_range.wrapped) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "insufficient UE IP addresses, wrapped back to first\n");
+		g_pfcp_tool->ue.ip_range.wrapped = false;
+	}
+	range_val_get_addr(dst, &g_pfcp_tool->ue.ip_range.next);
+	return 0;
+}
+
+struct udp_port *pfcp_tool_have_udp_port_by_osa(struct llist_head *list, const struct osmo_sockaddr *_osa,
+						uint16_t fallback_port)
+{
+	struct udp_port *port;
+	/* copy osa and have a non-const pointer */
+	struct osmo_sockaddr osa_mutable = *_osa;
+	struct osmo_sockaddr *osa = &osa_mutable;
+
+	if (!osmo_sockaddr_port(&osa->u.sa))
+		osmo_sockaddr_set_port(&osa->u.sa, fallback_port);
+	OSMO_ASSERT(osmo_sockaddr_port(&osa->u.sa));
+
+	llist_for_each_entry (port, list, entry) {
+		if (osmo_sockaddr_cmp(&port->osa, osa) == 0)
+			return port;
+	}
+
+	port = talloc_zero(g_pfcp_tool, struct udp_port);
+	port->osa = *osa;
+	port->ofd.fd = -1;
+
+	llist_add_tail(&port->entry, list);
+	return port;
+}
+
+struct udp_port *pfcp_tool_have_udp_port_by_str(struct llist_head *list, const struct osmo_sockaddr_str *addr,
+						uint16_t fallback_port)
+{
+	struct osmo_sockaddr osa;
+	if (osmo_sockaddr_str_to_osa(addr, &osa))
+		return NULL;
+	return pfcp_tool_have_udp_port_by_osa(list, &osa, fallback_port);
+}
+
+struct udp_port *pfcp_tool_have_local_udp_port_by_osa(const struct osmo_sockaddr *osa, uint16_t fallback_port)
+{
+	struct udp_port *port = pfcp_tool_have_udp_port_by_osa(&g_pfcp_tool->gtp.gtp_local_addrs, osa, fallback_port);
+
+	/* already bound? */
+	if (port->ofd.fd >= 0)
+		return port;
+
+	/* create and bind socket */
+	int rc;
+	rc = osmo_sock_init_osa(SOCK_DGRAM, IPPROTO_UDP, &port->osa, NULL, OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Failed to bind socket on UDP %s\n",
+		     osmo_sockaddr_to_str_c(OTC_SELECT, &port->osa));
+		exit(1);
+	}
+	port->ofd.fd = rc;
+
+#if 0
+	int a_lot;
+	a_lot = 1024 * (1024*1024);
+	rc = setsockopt(port->ofd.fd, SOL_SOCKET, SO_SNDBUF, &a_lot, sizeof(a_lot));
+	a_lot = 1024 * (1024*1024);
+	rc = setsockopt(port->ofd.fd, SOL_SOCKET, SO_RCVBUF, &a_lot, sizeof(a_lot));
+#endif
+
+	LOGP(DLGLOBAL, LOGL_NOTICE, "bound UDP %s fd=%d\n",
+	     osmo_sockaddr_to_str_c(OTC_SELECT, &port->osa), rc);
+	return port;
+}
+
+struct udp_port *pfcp_tool_have_local_udp_port_by_str(const struct osmo_sockaddr_str *addr, uint16_t fallback_port)
+{
+	struct osmo_sockaddr osa;
+	if (osmo_sockaddr_str_to_osa(addr, &osa))
+		return NULL;
+	return pfcp_tool_have_local_udp_port_by_osa(&osa, fallback_port);
+}
+
+struct udp_port *pfcp_tool_have_core_udp_port_by_osa(const struct osmo_sockaddr *osa, uint16_t fallback_port)
+{
+	return pfcp_tool_have_udp_port_by_osa(&g_pfcp_tool->gtp.gtp_core_addrs, osa, fallback_port);
+}
+
+struct udp_port *pfcp_tool_have_core_udp_port_by_str(const struct osmo_sockaddr_str *addr, uint16_t fallback_port)
+{
+	struct osmo_sockaddr osa;
+	if (osmo_sockaddr_str_to_osa(addr, &osa))
+		return NULL;
+	return pfcp_tool_have_core_udp_port_by_osa(&osa, fallback_port);
+}
+
+static bool add_session_to_gtp_flow(struct gtp_flood *gf, struct pfcp_tool_session *session)
+{
+	struct range *r;
+	struct gtp_flood_flow_cfg cfg = {};
+	const struct pfcp_tool_gtp_tun *tun_access;
+	const struct pfcp_tool_gtp_tun *tun_core = NULL;
+	const struct osmo_sockaddr_str *ue_local_addr = NULL;
+
+	switch (session->kind) {
+	case UP_GTP_U_TUNEND:
+		tun_access = &session->tunend.access;
+		ue_local_addr = &session->tunend.core.ue_local_addr;
+		break;
+	case UP_GTP_U_TUNMAP:
+		tun_access = &session->tunmap.access;
+		tun_core = &session->tunmap.core;
+		break;
+	default:
+		OSMO_ASSERT(false);
+	}
+
+	/* The 'local' and 'remote' naming clashes here. struct pfcp_tool_gtp_tun names its items from the UPF's point
+	 * of view: so the GTP port of osmo-pfcp-tool is 'remote'.
+	 * Here we are setting up a port to emit GTP from osmo-pfcp-tool, the same port is called 'gtp_local'.
+	 */
+	cfg.gtp_local = pfcp_tool_have_local_udp_port_by_str(&tun_access->remote.addr, 2152);
+	if (!cfg.gtp_local) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Cannot set up GTP flow for session, failed to setup local GTP port\n");
+		return false;
+	}
+
+	/* The 'local' and 'remote' naming clashes here. struct pfcp_tool_gtp_tun names its items from the UPF's point
+	 * of view: so the GTP port of UPF is 'local'.
+	 * Here we are reading the GTP port that the UPF has opened to receive GTP traffic; the same port is called
+	 * 'gtp_remote' in cfg, which is remote from osmo-pfcp-tool's point of view.
+	 */
+	if (osmo_sockaddr_str_to_osa(&tun_access->local.addr, &cfg.gtp_remote)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Cannot set up GTP flow for session, failed to identify UPF's GTP port\n");
+		return false;
+	}
+	if (!osmo_sockaddr_port(&cfg.gtp_remote.u.sa))
+		osmo_sockaddr_set_port(&cfg.gtp_remote.u.sa, 2152);
+	cfg.gtp_remote_teid = tun_access->local.teid;
+
+	if (ue_local_addr) {
+		osmo_sockaddr_str_to_osa(ue_local_addr, &cfg.payload_src);
+	} else if (pfcp_tool_next_ue_addr(&cfg.payload_src)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Cannot set up GTP flow for session, failed to identify UE's IP address\n");
+		return false;
+	}
+	r = &g_pfcp_tool->gtp.payload.source.udp_port_range;
+	range_next(r);
+	osmo_sockaddr_set_port(&cfg.payload_src.u.sa, range_val_get_int(&r->next));
+
+	r = &g_pfcp_tool->gtp.payload.target.ip_range;
+	range_next(r);
+	range_val_get_addr(&cfg.payload_dst, &r->next);
+	r = &g_pfcp_tool->gtp.payload.target.udp_port_range;
+	range_next(r);
+	osmo_sockaddr_set_port(&cfg.payload_dst.u.sa, range_val_get_int(&r->next));
+
+	cfg.num_packets = g_pfcp_tool->gtp.flood.packets_per_flow;
+
+	if (g_pfcp_tool->gtp.payload.append_info) {
+		cfg.append_payload_info = true;
+		cfg.payload_info = (struct gtp_flood_payload_info){};
+		if (tun_core)
+			cfg.payload_info.return_teid = htonl(tun_core->local.teid);
+	}
+
+	for (int i = 0; i < g_pfcp_tool->gtp.flood.flows_per_session; i++)
+		gtp_flood_add_flow(gf, &cfg);
+
+	return true;
+}
+
+void pfcp_tool_gtp_flood_start(void)
+{
+	struct gtp_flood *gf;
+	struct pfcp_tool_peer *peer;
+	struct udp_port *port;
+
+	if (g_pfcp_tool->gtp.flood.state) {
+		LOGP(DLGLOBAL, LOGL_ERROR,
+		     "another 'gtp flood' is still running; currently we can run only one gtp flood at a time\n");
+		return;
+	}
+
+	gf = g_pfcp_tool->gtp.flood.state = gtp_flood_alloc(g_pfcp_tool, &g_pfcp_tool->gtp.flood.cfg);
+	if (!gf)
+		return;
+
+	/* add transmitter flows */
+	llist_for_each_entry (peer, &g_pfcp_tool->peers, entry) {
+		struct pfcp_tool_session *session;
+		llist_for_each_entry (session, &peer->sessions, entry) {
+			add_session_to_gtp_flow(gf, session);
+		}
+	}
+
+	/* add listener flows, one per local UDP port (like a GTP port from a 'gtp local 1.2.3.4' vty command) */
+	llist_for_each_entry (port, &g_pfcp_tool->gtp.gtp_local_addrs, entry) {
+		struct gtp_flood_flow_cfg cfg = {
+			.rx = true,
+			.gtp_local = port,
+		};
+		gtp_flood_add_flow(gf, &cfg);
+	}
+
+	gtp_flood_start(gf);
+}
--- a/src/osmo-pfcp-tool/pfcp_tool_vty.c
+++ b/src/osmo-pfcp-tool/pfcp_tool_vty.c
@@ -34,12 +34,7 @@
 #include <osmocom/vty/vty.h>
 #include <osmocom/vty/command.h>

-#include "pfcp_tool.h"
-
-enum pfcp_tool_vty_node {
-	PEER_NODE = _LAST_OSMOVTY_NODE + 1,
-	SESSION_NODE,
-};
+#include <osmocom/pfcptool/pfcp_tool.h>

 DEFUN(c_local_addr, c_local_addr_cmd,
      "local-addr IP_ADDR",
@@ -124,7 +119,7 @@ DEFUN(c_sleep, c_sleep_cmd,

 	/* Still operate the message pump while waiting for time to pass */
 	while (t.active && !osmo_select_shutdown_done()) {
-		if (pfcp_tool_mainloop())
+		if (pfcp_tool_mainloop(0) == -1)
 			break;
 	}

@@ -134,6 +129,251 @@ DEFUN(c_sleep, c_sleep_cmd,
 	return CMD_SUCCESS;
 }

+DEFUN(c_date, c_date_cmd,
+	"date",
+	"print a timestamp\n")
+{
+	struct timeval tv = {};
+	struct tm tm = {};
+
+	osmo_gettimeofday(&tv, NULL);
+	localtime_r(&tv.tv_sec, &tm);
+
+	vty_out(vty, "%04d-%02d-%02d,%02d:%02d:%02d.%03d%s",
+		tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+		tm.tm_hour, tm.tm_min, tm.tm_sec,
+		(int)(tv.tv_usec / 1000), VTY_NEWLINE);
+	vty_flush(vty);
+	return CMD_SUCCESS;
+}
+
+static bool parse_ip_to_range_val(struct vty *vty, struct range_val *val, const char *ip_addr_str)
+{
+	struct osmo_sockaddr_str a;
+	struct osmo_sockaddr osa;
+	if (osmo_sockaddr_str_from_str(&a, ip_addr_str, 0)
+	    || osmo_sockaddr_str_to_osa(&a, &osa)) {
+		vty_out(vty, "%% Error: invalid IP address: '%s'%s", ip_addr_str, VTY_NEWLINE);
+		return false;
+	}
+	range_val_set_addr(val, &osa);
+	return true;
+}
+
+static bool parse_ip_range(struct vty *vty, struct range *dst, const char *argv[])
+{
+	return parse_ip_to_range_val(vty, &dst->first, argv[0])
+		&& parse_ip_to_range_val(vty, &dst->last, argv[1]);
+}
+
+#define IP_RANGE_STR \
+      "Set a range with first and last address\n" \
+      "First IP address in the range, 1.2.3.4 or 1:2:3::4\n" \
+      "Last IP address in the range, 1.2.3.4 or 1:2:3::4\n"
+
+DEFUN(c_ue_ip_range, c_ue_ip_range_cmd,
+      "ue ip range IP_ADDR_FIRST IP_ADDR_LAST",
+      "UE\n"
+      "Set the IP address range used for the UE IP addresses\n"
+      IP_RANGE_STR)
+{
+	if (!parse_ip_range(vty, &g_pfcp_tool->ue.ip_range, &argv[0]))
+		return CMD_WARNING;
+	return CMD_SUCCESS;
+}
+
+#define GTP_STR "Configure GTP\n"
+#define GTP_IP_STR "Add a GTP IP address\n"
+#define IP_ADDR_STR "IP address, 1.2.3.4 or 1:2:3:4::1\n"
+
+DEFUN(c_gtp_local, c_gtp_local_cmd,
+      "gtp local IP_ADDR [<1-65535>]",
+      GTP_STR
+      "Add a local GTP port, to emit GTP traffic from\n"
+      IP_ADDR_STR
+      "Specific UDP port to use, 2152 if omitted\n")
+{
+	const char *ip_str = argv[0];
+	uint16_t port_nr;
+	struct osmo_sockaddr_str addr_str;
+	struct udp_port *p;
+
+	if (argc > 1)
+		port_nr = atoi(argv[1]);
+	else
+		port_nr = 2152;
+
+	if (osmo_sockaddr_str_from_str(&addr_str, ip_str, port_nr))
+		goto invalid_ip;
+	vty_out(vty, "local GTP port: " OSMO_SOCKADDR_STR_FMT "%s", OSMO_SOCKADDR_STR_FMT_ARGS(&addr_str), VTY_NEWLINE);
+	p = pfcp_tool_have_local_udp_port_by_str(&addr_str, port_nr);
+	if (!p)
+		goto invalid_ip;
+	return CMD_SUCCESS;
+
+invalid_ip:
+	vty_out(vty, "%% Error: invalid IP address: '%s'%s", ip_str, VTY_NEWLINE);
+	return CMD_WARNING;
+}
+
+DEFUN(c_gtp_core, c_gtp_core_cmd,
+      "gtp core IP_ADDR [<1-65535>]",
+      GTP_STR
+      "Add a core GTP port, to emit GTP traffic from\n"
+      IP_ADDR_STR
+      "Specific UDP port to use, 2152 if omitted\n")
+{
+	const char *ip_str = argv[0];
+	uint16_t port_nr;
+	struct osmo_sockaddr_str addr_str;
+	struct udp_port *p;
+
+	if (argc > 1)
+		port_nr = atoi(argv[1]);
+	else
+		port_nr = 2152;
+
+	if (osmo_sockaddr_str_from_str(&addr_str, ip_str, port_nr))
+		goto invalid_ip;
+	vty_out(vty, "core GTP port: " OSMO_SOCKADDR_STR_FMT "%s", OSMO_SOCKADDR_STR_FMT_ARGS(&addr_str), VTY_NEWLINE);
+	p = pfcp_tool_have_core_udp_port_by_str(&addr_str, port_nr);
+	if (!p)
+		goto invalid_ip;
+	return CMD_SUCCESS;
+
+invalid_ip:
+	vty_out(vty, "%% Error: invalid IP address: '%s'%s", ip_str, VTY_NEWLINE);
+	return CMD_WARNING;
+}
+
+static struct cmd_node gtp_flood_node = {
+	GTP_FLOOD_NODE,
+	"%s(gtp-flood)# ",
+	1,
+};
+
+DEFUN(gtp_flood, gtp_flood_cmd,
+      "gtp flood",
+      GTP_STR
+      "Setup GTP traffic\n")
+{
+	vty->node = GTP_FLOOD_NODE;
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_workers, gtpf_workers_cmd,
+      "workers <1-999>",
+      "Number of worker threads to launch, to emit GTP traffic from\n"
+      "Number\n")
+{
+	g_pfcp_tool->gtp.flood.cfg.workers = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_io_uring_queue_size, gtpf_io_uring_queue_size_cmd,
+      "io-uring queue-size <1-65536>",
+      "Fine-tune io-uring usage for optimal GTP packet flooding\n"
+      "Maximum number of packets to submit for sending simultaneously.\n"
+      "Number\n")
+{
+	g_pfcp_tool->gtp.flood.cfg.queue_size = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_flows, gtpf_flows_cmd,
+      "flows-per-session <1-999999>",
+      "Set number of GTP packet flows emitted per PFCP session's GTP tunnel\n"
+      "Number\n")
+{
+	g_pfcp_tool->gtp.flood.flows_per_session = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_packets, gtpf_packets_cmd,
+      "packets-per-flow (<1-2000000000>|infinite)",
+      "Set number of GTP packet flows emitted per PFCP session's GTP tunnel\n"
+      "Number\n")
+{
+	unsigned int val;
+	if (!strcmp("infinite", argv[0]))
+		val = 0;
+	else
+		val = atoi(argv[0]);
+	g_pfcp_tool->gtp.flood.packets_per_flow = val;
+	return CMD_SUCCESS;
+}
+
+#define PAYLOAD_STR "Configure GTP payload\n"
+
+#define RANGE_STR \
+      "Set a range to cycle through\n" \
+      "First value of the range\n" \
+      "Last value of the range\n"
+
+DEFUN(gtpf_payload_src_port, gtpf_payload_src_port_cmd,
+      "payload source port udp range <1-65535> <1-65535>",
+      PAYLOAD_STR
+      "Source port of payload packets. Note: the source IP will always be the UE IP for that session.\n"
+      "Port\n"
+      "UDP port\n"
+      RANGE_STR)
+{
+	range_val_set_int(&g_pfcp_tool->gtp.payload.source.udp_port_range.first,
+			  atoi(argv[0]));
+	range_val_set_int(&g_pfcp_tool->gtp.payload.source.udp_port_range.last,
+			  atoi(argv[1]));
+	return CMD_SUCCESS;
+}
+
+#define PAYLOAD_TARGET_STR PAYLOAD_STR "Target of payload packets\n"
+
+DEFUN(gtpf_payload_target_ip, gtpf_payload_target_ip_cmd,
+      "payload target ip range IP_ADDR_FIRST IP_ADDR_LAST",
+      PAYLOAD_TARGET_STR
+      "IP address\n"
+      RANGE_STR)
+{
+	if (!parse_ip_range(vty, &g_pfcp_tool->gtp.payload.target.ip_range, &argv[0]))
+		return CMD_WARNING;
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_payload_target_port, gtpf_payload_target_port_cmd,
+      "payload target port udp range <1-65535> <1-65535>",
+      PAYLOAD_STR
+      "Target port of payload packets\n"
+      "Port\n"
+      "UDP port\n"
+      RANGE_STR)
+{
+	range_val_set_int(&g_pfcp_tool->gtp.payload.target.udp_port_range.first,
+			  atoi(argv[0]));
+	range_val_set_int(&g_pfcp_tool->gtp.payload.target.udp_port_range.last,
+			  atoi(argv[1]));
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_payload_append_payload_info, gtpf_payload_append_payload_info_cmd,
+      "payload append-info",
+      PAYLOAD_STR
+      "Append info about the data stream to the emitted payload."
+      " In a tunmap scenario, append the UPF's core side's TEID to the end of the generated payload,"
+      " to allow the remote receiver to echo back payload using the correct TEID, without the need"
+      " for out-of-band communication (see osmo-udp-responder)\n")
+{
+	g_pfcp_tool->gtp.payload.append_info = true;
+	return CMD_SUCCESS;
+}
+
+DEFUN(gtpf_slew, gtpf_slew_cmd,
+      "slew <0-1000000000>",
+      "Wait N microseconds after each io_uring transmission submission\n"
+      "microseconds to wait (1000000 == 1 second)\n")
+{
+	g_pfcp_tool->gtp.flood.cfg.slew_us = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
 static struct cmd_node peer_node = {
 	PEER_NODE,
 	"%s(peer)# ",
@@ -397,9 +637,16 @@ DEFUN(s_f_teid_choose, s_f_teid_choose_cmd,
 	return CMD_SUCCESS;
 }

-int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
+enum pdr_id_fixed {
+	PDR_ID_CORE = 1,
+	PDR_ID_ACCESS = 2,
+};
+
+const char * const gtp_ip_core = "10.99.0.1";
+const char * const fallback_gtp_ip_access = "10.99.0.2";
+
+int session_tunend_tx_est_req(struct pfcp_tool_session *session, bool forw, osmo_pfcp_resp_cb resp_cb)
 {
-	struct pfcp_tool_session *session = vty->index;
 	struct pfcp_tool_peer *peer = session->peer;
 	int rc;
 	struct osmo_pfcp_msg *m;
@@ -412,19 +659,19 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 	OSMO_ASSERT(session->kind == UP_GTP_U_TUNEND);

 	if (!g_pfcp_tool->ep) {
-		vty_out(vty, "Endpoint not configured%s", VTY_NEWLINE);
+		LOGP(DLGLOBAL, LOGL_ERROR, "PFCP endpoint not configured\n");
 		return CMD_WARNING;
 	}

-	if (argc > 0 && !strcmp("drop", argv[0]))
-		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);
-	else
+	if (forw)
 		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_FORW, true);
+	else
+		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);

 #define STR_TO_ADDR(DST, SRC) do { \
 			if (osmo_sockaddr_str_to_sockaddr(&SRC, &DST.u.sas)) { \
-				vty_out(vty, "Error in " #SRC ": " OSMO_SOCKADDR_STR_FMT "%s", \
-					OSMO_SOCKADDR_STR_FMT_ARGS(&SRC), VTY_NEWLINE); \
+				LOGP(DLGLOBAL, LOGL_ERROR, "Error in " #SRC ": " OSMO_SOCKADDR_STR_FMT "\n", \
+				     OSMO_SOCKADDR_STR_FMT_ARGS(&SRC)); \
 				return CMD_WARNING; \
 			} \
 		} while (0)
@@ -464,6 +711,10 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 	osmo_pfcp_ip_addrs_set(&cp_f_seid.ip_addr, osmo_pfcp_endpoint_get_local_addr(g_pfcp_tool->ep));

 	m = osmo_pfcp_msg_alloc_tx_req(OTC_SELECT, &peer->remote_addr, OSMO_PFCP_MSGT_SESSION_EST_REQ);
+
+	m->ctx.resp_cb = resp_cb;
+	m->ctx.priv = session;
+
 	m->h.seid_present = true;
 	/* the UPF has yet to assign a SEID for itself, no matter what SEID we (the CPF) use for this session */
 	m->h.seid = 0;
@@ -475,7 +726,7 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 		.create_pdr_count = 2,
 		.create_pdr = {
 			{
-				.pdr_id = 1,
+				.pdr_id = PDR_ID_CORE,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_CORE,
@@ -492,7 +743,7 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 				.far_id = 1,
 			},
 			{
-				.pdr_id = 2,
+				.pdr_id = PDR_ID_ACCESS,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_ACCESS,
@@ -531,16 +782,13 @@ int session_tunend_tx_est_req(struct vty *vty, const char **argv, int argc)
 	};

 	rc = peer_tx(peer, m);
-	if (rc) {
-		vty_out(vty, "Failed to transmit: %s%s", strerror(-rc), VTY_NEWLINE);
+	if (rc)
 		return CMD_WARNING;
-	}
 	return CMD_SUCCESS;
 }

-int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
+int session_tunmap_tx_est_req(struct pfcp_tool_session *session, bool forw, osmo_pfcp_resp_cb resp_cb)
 {
-	struct pfcp_tool_session *session = vty->index;
 	struct pfcp_tool_peer *peer = session->peer;
 	int rc;
 	struct osmo_pfcp_msg *m;
@@ -556,14 +804,14 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 	struct osmo_pfcp_ie_apply_action aa = {};

 	if (!g_pfcp_tool->ep) {
-		vty_out(vty, "Endpoint not configured%s", VTY_NEWLINE);
+		LOGP(DLGLOBAL, LOGL_ERROR, "PFCP endpoint not configured\n");
 		return CMD_WARNING;
 	}

-	if (argc > 0 && !strcmp("drop", argv[0]))
-		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);
-	else
+	if (forw)
 		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_FORW, true);
+	else
+		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);

 	if (session->tunmap.access.local.teid == 0) {
 		f_teid_access_local = (struct osmo_pfcp_ie_f_teid){
@@ -625,6 +873,10 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 	osmo_pfcp_ip_addrs_set(&cp_f_seid.ip_addr, osmo_pfcp_endpoint_get_local_addr(g_pfcp_tool->ep));

 	m = osmo_pfcp_msg_alloc_tx_req(OTC_SELECT, &peer->remote_addr, OSMO_PFCP_MSGT_SESSION_EST_REQ);
+
+	m->ctx.resp_cb = resp_cb;
+	m->ctx.priv = session;
+
 	m->h.seid_present = true;
 	m->h.seid = 0;
 	/* GTP tunmap: remove header from both directions, and add header in both directions */
@@ -635,7 +887,7 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 		.create_pdr_count = 2,
 		.create_pdr = {
 			{
-				.pdr_id = 1,
+				.pdr_id = PDR_ID_CORE,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_CORE,
@@ -650,7 +902,7 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 				.far_id = 1,
 			},
 			{
-				.pdr_id = 2,
+				.pdr_id = PDR_ID_ACCESS,
 				.precedence = 255,
 				.pdi = {
 					.source_iface = OSMO_PFCP_SOURCE_IFACE_ACCESS,
@@ -691,10 +943,8 @@ int session_tunmap_tx_est_req(struct vty *vty, const char **argv, int argc)
 	};

 	rc = peer_tx(peer, m);
-	if (rc) {
-		vty_out(vty, "Failed to transmit: %s%s", strerror(-rc), VTY_NEWLINE);
+	if (rc)
 		return CMD_WARNING;
-	}
 	return CMD_SUCCESS;
 }

@@ -705,24 +955,20 @@ DEFUN(session_tx_est_req, session_tx_est_req_cmd,
      "Set FAR to DROP = 1\n")
 {
 	struct pfcp_tool_session *session = vty->index;
+	bool forw = (argc == 0 || !strcmp("forw", argv[0]));
 	switch (session->kind) {
 	case UP_GTP_U_TUNEND:
-		return session_tunend_tx_est_req(vty, argv, argc);
+		return session_tunend_tx_est_req(session, forw, NULL);
 	case UP_GTP_U_TUNMAP:
-		return session_tunmap_tx_est_req(vty, argv, argc);
+		return session_tunmap_tx_est_req(session, forw, NULL);
 	default:
 		vty_out(vty, "unknown gtp action%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
 }

-DEFUN(session_tx_mod_req, session_tx_mod_req_cmd,
-      "tx session-mod-req far [(forw|drop)]",
-      TX_STR "Send a Session Modification Request\n"
-      "Set FAR to FORW = 1\n"
-      "Set FAR to DROP = 1\n")
+int session_tunmap_tx_mod_req(struct pfcp_tool_session *session, bool forw, osmo_pfcp_resp_cb resp_cb)
 {
-	struct pfcp_tool_session *session = vty->index;
 	struct pfcp_tool_peer *peer = session->peer;
 	int rc;
 	struct osmo_pfcp_msg *m;
@@ -730,14 +976,14 @@ DEFUN(session_tx_mod_req, session_tx_mod_req_cmd,
 	struct osmo_pfcp_ie_f_seid cp_f_seid;

 	if (!g_pfcp_tool->ep) {
-		vty_out(vty, "Endpoint not configured%s", VTY_NEWLINE);
+		LOGP(DLGLOBAL, LOGL_ERROR, "PFCP endpoint not configured\n");
 		return CMD_WARNING;
 	}

-	if (argc > 0 && !strcmp("drop", argv[0]))
-		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);
-	else
+	if (forw)
 		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_FORW, true);
+	else
+		osmo_pfcp_bits_set(aa.bits, OSMO_PFCP_APPLY_ACTION_DROP, true);

 	cp_f_seid = (struct osmo_pfcp_ie_f_seid){
 		.seid = session->cp_seid,
@@ -745,6 +991,10 @@ DEFUN(session_tx_mod_req, session_tx_mod_req_cmd,
 	osmo_pfcp_ip_addrs_set(&cp_f_seid.ip_addr, osmo_pfcp_endpoint_get_local_addr(g_pfcp_tool->ep));

 	m = osmo_pfcp_msg_alloc_tx_req(OTC_SELECT, &peer->remote_addr, OSMO_PFCP_MSGT_SESSION_MOD_REQ);
+
+	m->ctx.resp_cb = resp_cb;
+	m->ctx.priv = session;
+
 	m->h.seid_present = true;
 	m->h.seid = session->up_f_seid.seid;
 	m->ies.session_mod_req = (struct osmo_pfcp_msg_session_mod_req){
@@ -766,13 +1016,25 @@ DEFUN(session_tx_mod_req, session_tx_mod_req_cmd,
 	};

 	rc = peer_tx(peer, m);
-	if (rc) {
-		vty_out(vty, "Failed to transmit: %s%s", strerror(-rc), VTY_NEWLINE);
+	if (rc)
 		return CMD_WARNING;
-	}
 	return CMD_SUCCESS;
 }

+DEFUN(session_tx_mod_req, session_tx_mod_req_cmd,
+      "tx session-mod-req far [(forw|drop)]",
+      TX_STR "Send a Session Modification Request\n"
+      "Set FAR to FORW = 1\n"
+      "Set FAR to DROP = 1\n")
+{
+	struct pfcp_tool_session *session = vty->index;
+	bool forw = (argc == 0 || !strcmp("forw", argv[0]));
+	int rc = session_tunmap_tx_mod_req(session, forw, NULL);
+	if (rc != CMD_SUCCESS)
+		vty_out(vty, "Failed to send Session Modification Request%s", VTY_NEWLINE);
+	return rc;
+}
+
 DEFUN(session_tx_del_req, session_tx_del_req_cmd,
      "tx session-del-req",
      TX_STR "Send a Session Deletion Request\n")
@@ -799,6 +1061,371 @@ DEFUN(session_tx_del_req, session_tx_del_req_cmd,
 	return CMD_SUCCESS;
 }

+/* N SESSIONS */
+
+static int responses_pending = 0;
+
+DEFUN(wait_responses, wait_responses_cmd,
+	"wait responses",
+	"Let some time pass until events have occurred\n"
+	"Wait for all PFCP responses for pending PFCP requests\n")
+{
+	if (!responses_pending) {
+		vty_out(vty, "no responses pending, not waiting.%s", VTY_NEWLINE);
+		return CMD_SUCCESS;
+	}
+
+	vty_out(vty, "waiting for %d responses...%s", responses_pending, VTY_NEWLINE);
+	vty_flush(vty);
+
+	/* Still operate the message pump while waiting for time to pass */
+	while (!osmo_select_shutdown_done()) {
+		if (pfcp_tool_mainloop(0) == -1)
+			break;
+		if (responses_pending == 0)
+			break;
+	}
+
+	vty_out(vty, "...done waiting for responses%s", VTY_NEWLINE);
+	vty_flush(vty);
+	return CMD_SUCCESS;
+}
+
+/* N SESSIONS TUNEND */
+
+int one_session_mod_tunend_resp_cb(struct osmo_pfcp_msg *req, struct osmo_pfcp_msg *rx_resp, const char *errmsg)
+{
+	responses_pending--;
+	return 0;
+}
+
+int one_session_mod_tunend(struct pfcp_tool_session *session)
+{
+	int rc;
+
+	rc = session_tunmap_tx_mod_req(session, true, one_session_mod_tunend_resp_cb);
+	if (rc == CMD_SUCCESS)
+		responses_pending++;
+	return rc;
+}
+
+void est_resp_get_created_f_teid(struct pfcp_tool_gtp_tun_ep *dst, const struct osmo_pfcp_msg *rx_resp, uint16_t pdr_id)
+{
+	int i;
+	const struct osmo_pfcp_msg_session_est_resp *r;
+	if (rx_resp->h.message_type != OSMO_PFCP_MSGT_SESSION_EST_RESP)
+		return;
+
+	r = &rx_resp->ies.session_est_resp;
+
+	for (i = 0; i < r->created_pdr_count; i++) {
+		const struct osmo_pfcp_ie_created_pdr *p = &r->created_pdr[i];
+		if (p->pdr_id != pdr_id)
+			continue;
+		if (!p->local_f_teid_present)
+			continue;
+		osmo_sockaddr_str_from_sockaddr(&dst->addr,
+						&p->local_f_teid.fixed.ip_addr.v4.u.sas);
+		dst->teid = p->local_f_teid.fixed.teid;
+	}
+}
+
+int one_session_create_tunend_resp_cb(struct osmo_pfcp_msg *req, struct osmo_pfcp_msg *rx_resp, const char *errmsg)
+{
+	struct pfcp_tool_session *session = req->ctx.priv;
+	enum osmo_pfcp_cause *cause;
+	const struct osmo_pfcp_msg_session_est_resp *r = NULL;
+	if (rx_resp)
+		r = &rx_resp->ies.session_est_resp;
+
+	responses_pending--;
+
+	if (errmsg)
+		LOGP(DLPFCP, LOGL_ERROR, "%s\n", errmsg);
+
+	cause = rx_resp ? osmo_pfcp_msg_cause(rx_resp) : NULL;
+	if (!cause || *cause != OSMO_PFCP_CAUSE_REQUEST_ACCEPTED)
+		return 0;
+
+	/* store SEID */
+	if (r && r->up_f_seid_present)
+		session->up_f_seid = r->up_f_seid;
+	/* store access local F-TEID */
+	est_resp_get_created_f_teid(&session->tunend.access.local, rx_resp, PDR_ID_ACCESS);
+
+	/* Success response, now continue with second step: Session Mod to set the CORE's remote side GTP */
+	one_session_mod_tunend(session);
+	return 0;
+}
+
+static int set_access_ran_tunend(struct pfcp_tool_gtp_tun_ep *dst)
+{
+	if (llist_empty(&g_pfcp_tool->gtp.gtp_local_addrs)) {
+		/* No local GTP ports configured, just set an arbitrary address. */
+		if (osmo_sockaddr_str_from_str2(&dst->addr, fallback_gtp_ip_access)) {
+			LOGP(DLGLOBAL, LOGL_ERROR, "Error setting Access side GTP IP address from %s\n",
+			     osmo_quote_cstr_c(OTC_SELECT, fallback_gtp_ip_access, -1));
+			return CMD_WARNING;
+		}
+		return CMD_SUCCESS;
+	}
+
+	/* next local GTP address to emit from */
+	struct udp_port *next;
+	next = g_pfcp_tool->gtp.gtp_local_addrs_next;
+	if (next) {
+		/* Move on by one gtp_local_addr. If past the end of the list, wrap back to the start below. */
+		if (next->entry.next == &g_pfcp_tool->gtp.gtp_local_addrs)
+			next = NULL;
+		else
+			next = container_of(next->entry.next, struct udp_port, entry);
+	}
+	if (!next)
+		next = llist_first_entry_or_null(&g_pfcp_tool->gtp.gtp_local_addrs, struct udp_port,
+						 entry);
+	OSMO_ASSERT(next);
+	g_pfcp_tool->gtp.gtp_local_addrs_next = next;
+
+	if (osmo_sockaddr_str_from_osa(&dst->addr, &next->osa)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Error setting Access side GTP IP address from %s\n",
+		     osmo_sockaddr_to_str_c(OTC_SELECT, &next->osa));
+		return CMD_WARNING;
+	}
+	dst->teid = pfcp_tool_new_teid();
+	LOGP(DLGLOBAL, LOGL_DEBUG, "session picked gtp local " OSMO_SOCKADDR_STR_FMT " TEID 0x%x\n",
+	     OSMO_SOCKADDR_STR_FMT_ARGS(&dst->addr), dst->teid);
+	return CMD_SUCCESS;
+}
+
+static int set_core_cn_tunend(struct pfcp_tool_gtp_tun_ep *dst)
+{
+	if (llist_empty(&g_pfcp_tool->gtp.gtp_core_addrs)) {
+		/* No core GTP ports configured, just set an arbitrary address. */
+		if (osmo_sockaddr_str_from_str2(&dst->addr, fallback_gtp_ip_access)) {
+			LOGP(DLGLOBAL, LOGL_ERROR, "Error setting Access side GTP IP address from %s\n",
+			     osmo_quote_cstr_c(OTC_SELECT, fallback_gtp_ip_access, -1));
+			return CMD_WARNING;
+		}
+		return CMD_SUCCESS;
+	}
+
+	/* next core GTP address to emit from */
+	struct udp_port *next;
+	next = g_pfcp_tool->gtp.gtp_core_addrs_next;
+	if (next) {
+		/* Move on by one gtp_core_addr. If past the end of the list, wrap back to the start below. */
+		if (next->entry.next == &g_pfcp_tool->gtp.gtp_core_addrs)
+			next = NULL;
+		else
+			next = container_of(next->entry.next, struct udp_port, entry);
+	}
+	if (!next)
+		next = llist_first_entry_or_null(&g_pfcp_tool->gtp.gtp_core_addrs, struct udp_port,
+						 entry);
+	OSMO_ASSERT(next);
+	g_pfcp_tool->gtp.gtp_core_addrs_next = next;
+
+	if (osmo_sockaddr_str_from_osa(&dst->addr, &next->osa)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Error setting Access side GTP IP address from %s\n",
+		     osmo_sockaddr_to_str_c(OTC_SELECT, &next->osa));
+		return CMD_WARNING;
+	}
+	dst->teid = pfcp_tool_new_teid();
+	LOGP(DLGLOBAL, LOGL_DEBUG, "session picked gtp core " OSMO_SOCKADDR_STR_FMT " TEID 0x%x\n",
+	     OSMO_SOCKADDR_STR_FMT_ARGS(&dst->addr), dst->teid);
+	return CMD_SUCCESS;
+}
+
+static int one_session_create_tunend(struct pfcp_tool_peer *peer)
+{
+	struct pfcp_tool_session *session;
+	struct pfcp_tool_tunend *te;
+	struct pfcp_tool_gtp_tun_ep *dst;
+	struct osmo_sockaddr osa;
+	int rc;
+
+	session = pfcp_tool_session_find_or_create(peer, peer_new_seid(peer), UP_GTP_U_TUNEND);
+	te = &session->tunend;
+
+	/* Access: set remote GTP address from UPF's point of view.
+	 * A local GTP port from osmo-pfcp-tool's point of view. */
+	dst = &te->access.remote;
+	rc = set_access_ran_tunend(dst);
+	if (rc != CMD_SUCCESS)
+		return rc;
+
+	/* Set UE address */
+	te->access.local = (struct pfcp_tool_gtp_tun_ep){};
+	pfcp_tool_next_ue_addr(&osa);
+	if (osmo_sockaddr_str_from_osa(&te->core.ue_local_addr, &osa)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Error setting UE address from %s\n",
+		     osmo_sockaddr_to_str_c(OTC_SELECT, &osa));
+		return CMD_WARNING;
+	};
+
+	/* Send initial Session Establishment Request */
+	rc = session_tunend_tx_est_req(session, false, one_session_create_tunend_resp_cb);
+	if (rc == CMD_SUCCESS)
+		responses_pending++;
+	return rc;
+}
+
+/* N SESSIONS TUNMAP */
+
+int one_session_mod_tunmap_resp_cb(struct osmo_pfcp_msg *req, struct osmo_pfcp_msg *rx_resp, const char *errmsg)
+{
+	responses_pending--;
+	return 0;
+}
+
+int one_session_mod_tunmap(struct pfcp_tool_session *session)
+{
+	struct pfcp_tool_gtp_tun_ep *dst;
+	int rc;
+
+	dst = &session->tunmap.core.remote;
+	if (osmo_sockaddr_str_from_str2(&dst->addr, gtp_ip_core)) {
+		LOGP(DLGLOBAL, LOGL_ERROR, "Error setting GTP IP address from %s\n",
+		     osmo_quote_cstr_c(OTC_SELECT, gtp_ip_core, -1));
+		return CMD_WARNING;
+	}
+	dst->teid = pfcp_tool_new_teid();
+
+	rc = session_tunmap_tx_mod_req(session, true, one_session_mod_tunmap_resp_cb);
+	if (rc == CMD_SUCCESS)
+		responses_pending++;
+	return rc;
+}
+
+int one_session_create_tunmap_resp_cb(struct osmo_pfcp_msg *req, struct osmo_pfcp_msg *rx_resp, const char *errmsg)
+{
+	struct pfcp_tool_session *session = req->ctx.priv;
+	enum osmo_pfcp_cause *cause;
+
+	responses_pending--;
+
+	if (errmsg)
+		LOGP(DLPFCP, LOGL_ERROR, "%s\n", errmsg);
+
+	cause = rx_resp ? osmo_pfcp_msg_cause(rx_resp) : NULL;
+	if (!cause || *cause != OSMO_PFCP_CAUSE_REQUEST_ACCEPTED)
+		return 0;
+
+	/* store SEID */
+	if (rx_resp->ies.session_est_resp.up_f_seid_present)
+		session->up_f_seid = rx_resp->ies.session_est_resp.up_f_seid;
+
+	/* store local F-TEIDs */
+	est_resp_get_created_f_teid(&session->tunmap.access.local, rx_resp, PDR_ID_ACCESS);
+	est_resp_get_created_f_teid(&session->tunmap.core.local, rx_resp, PDR_ID_CORE);
+
+	/* Success response, now continue with second step: Session Mod to set the CORE's remote side GTP */
+	one_session_mod_tunmap(session);
+	return 0;
+}
+
+static int one_session_create_tunmap(struct pfcp_tool_peer *peer)
+{
+	struct pfcp_tool_session *session;
+	struct pfcp_tool_tunmap *tm;
+	struct pfcp_tool_gtp_tun_ep *dst;
+	int rc;
+
+	session = pfcp_tool_session_find_or_create(peer, peer_new_seid(peer), UP_GTP_U_TUNMAP);
+	tm = &session->tunmap;
+
+	/* Access: set remote GTP address from UPF's point of view.
+	 * A local GTP port from osmo-pfcp-tool's point of view. */
+	dst = &tm->access.remote;
+	rc = set_access_ran_tunend(dst);
+	if (rc != CMD_SUCCESS)
+		return rc;
+
+	/* Core: set remote GTP address */
+	dst = &tm->core.remote;
+	rc = set_core_cn_tunend(dst);
+	if (rc != CMD_SUCCESS)
+		return rc;
+
+	/* Set local F-TEIDs == CHOOSE */
+	tm->access.local = (struct pfcp_tool_gtp_tun_ep){};
+	tm->core.local = (struct pfcp_tool_gtp_tun_ep){};
+
+	/* Send initial Session Establishment Request */
+	rc = session_tunmap_tx_est_req(session, false, one_session_create_tunmap_resp_cb);
+	if (rc == CMD_SUCCESS)
+		responses_pending++;
+	return rc;
+	return CMD_WARNING;
+}
+
+static void n_sessions_create(struct vty *vty, struct pfcp_tool_peer *peer, int n, enum up_gtp_action_kind kind)
+{
+	int i;
+	for (i = 0; i < n; i++) {
+		int rc;
+		if (kind == UP_GTP_U_TUNMAP)
+			rc = one_session_create_tunmap(peer);
+		else
+			rc = one_session_create_tunend(peer);
+		if (rc != CMD_SUCCESS)
+			break;
+
+		/* handle any pending select work */
+		while (!osmo_select_shutdown_done()) {
+			rc = pfcp_tool_mainloop(1);
+			/* quit requested */
+			if (rc < 0)
+				return;
+			/* no fd needed service */
+			if (rc == 0)
+				break;
+		}
+
+		/* Every N created sessions, wait for pending responses */
+		if (!(i & 0x3f) && responses_pending) {
+			vty_out(vty, "waiting for %d responses...%s", responses_pending, VTY_NEWLINE);
+			vty_flush(vty);
+			while (!osmo_select_shutdown_done()) {
+				if (pfcp_tool_mainloop(0) == -1)
+					break;
+				if (responses_pending == 0)
+					break;
+			}
+		}
+	}
+}
+
+static void n_sessions_delete(struct pfcp_tool_peer *peer, int n, enum up_gtp_action_kind kind)
+{
+}
+
+DEFUN(n_sessions, n_sessions_cmd,
+      "n (<0-2147483647>|all) session (create|delete) (tunend|tunmap)",
+      "Batch run\n"
+      "Perform the action N times, or on all available entries\n"
+      "In a batch run, create and later delete a number of sessions at once.\n"
+      "Create N new sessions\n"
+      "Delete N sessions created earlier\n"
+      TUNEND_STR TUNMAP_STR)
+{
+	struct pfcp_tool_peer *peer = vty->index;
+	int n = ((strcmp("all", argv[0]) == 0) ? -1 : atoi(argv[0]));
+	bool create = (strcmp("create", argv[1]) == 0);
+	enum up_gtp_action_kind kind;
+	if (!strcmp(argv[2], "tunmap"))
+		kind = UP_GTP_U_TUNMAP;
+	else
+		kind = UP_GTP_U_TUNEND;
+
+	if (create)
+		n_sessions_create(vty, peer, n, kind);
+	else
+		n_sessions_delete(peer, n, kind);
+	return CMD_SUCCESS;
+}
+
+
 static void install_ve_and_config(struct cmd_element *cmd)
 {
 	install_element_ve(cmd);
@@ -818,23 +1445,58 @@ void pfcp_tool_vty_init_cmds()
 	OSMO_ASSERT(g_pfcp_tool != NULL);

 	install_ve_and_config(&c_sleep_cmd);
+	install_ve_and_config(&c_date_cmd);
+	install_ve_and_config(&wait_responses_cmd);

 	install_ve_and_config(&peer_cmd);
 	install_node(&peer_node, NULL);

 	install_element(PEER_NODE, &c_sleep_cmd);
+	install_element(PEER_NODE, &c_date_cmd);
 	install_element(PEER_NODE, &peer_tx_heartbeat_cmd);
 	install_element(PEER_NODE, &peer_tx_assoc_setup_req_cmd);
 	install_element(PEER_NODE, &peer_retrans_req_cmd);
+	install_element(PEER_NODE, &n_sessions_cmd);
+	install_element(PEER_NODE, &wait_responses_cmd);

 	install_element(PEER_NODE, &session_cmd);
 	install_element(PEER_NODE, &session_endecaps_cmd);
 	install_node(&session_node, NULL);
 	install_element(SESSION_NODE, &c_sleep_cmd);
+	install_element(SESSION_NODE, &c_date_cmd);
 	install_element(SESSION_NODE, &session_tx_est_req_cmd);
 	install_element(SESSION_NODE, &session_tx_mod_req_cmd);
 	install_element(SESSION_NODE, &session_tx_del_req_cmd);
 	install_element(SESSION_NODE, &s_ue_cmd);
 	install_element(SESSION_NODE, &s_f_teid_cmd);
 	install_element(SESSION_NODE, &s_f_teid_choose_cmd);
+
+	install_ve_and_config(&c_gtp_local_cmd);
+	install_ve_and_config(&c_gtp_core_cmd);
+	install_ve_and_config(&c_ue_ip_range_cmd);
+
+	install_ve_and_config(&gtp_flood_cmd);
+	install_node(&gtp_flood_node, NULL);
+	install_element(GTP_FLOOD_NODE, &gtpf_workers_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_io_uring_queue_size_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_flows_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_packets_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_payload_src_port_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_payload_target_ip_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_payload_target_port_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_payload_append_payload_info_cmd);
+	install_element(GTP_FLOOD_NODE, &gtpf_slew_cmd);
+}
+
+int pfcp_tool_vty_go_parent(struct vty *vty)
+{
+	switch (vty->node) {
+	case GTP_FLOOD_NODE:
+		/* exiting a 'gtp flood' configuration, start the flooding */
+		pfcp_tool_gtp_flood_start();
+		break;
+	default:
+		break;
+	}
+	return 0;
 }
--- a/src/osmo-pfcp-tool/range.c
+++ b/src/osmo-pfcp-tool/range.c
@@ -0,0 +1,111 @@
+/*
+ * (C) 2024 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved.
+ *
+ * Author: Neels Janosch Hofmeyr <nhofmeyr@sysmocom.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/socket.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/pfcptool/range.h>
+
+void range_val_set_int(struct range_val *rv, uint32_t val)
+{
+	*rv = (struct range_val){
+		.buf = { (uint64_t)val, 0 },
+		.size = sizeof(val),
+	};
+}
+
+uint32_t range_val_get_int(const struct range_val *rv)
+{
+	return rv->buf[0];
+}
+
+void range_val_set_addr(struct range_val *rv, const struct osmo_sockaddr *val)
+{
+	*rv = (struct range_val){};
+	rv->size = osmo_sockaddr_to_octets((void *)rv->buf, sizeof(rv->buf), val);
+
+#if !OSMO_IS_BIG_ENDIAN
+	for (int i = 0; i < rv->size / 2; i++) {
+		uint8_t *rvbuf = (void *)rv->buf;
+		uint8_t tmp = rvbuf[i];
+		rvbuf[i] = rvbuf[rv->size - 1 - i];
+		rvbuf[rv->size - 1 - i] = tmp;
+	}
+#endif
+}
+
+void range_val_get_addr(struct osmo_sockaddr *dst, const struct range_val *rv)
+{
+	void *buf;
+#if OSMO_IS_BIG_ENDIAN
+	buf = rv->buf;
+#else
+	int i;
+	uint8_t rev[sizeof(rv->buf)];
+	uint8_t *val = (void *)rv->buf;
+	for (i = 0; i < rv->size; i++)
+		rev[i] = val[rv->size - 1 - i];
+	buf = rev;
+#endif
+	osmo_sockaddr_from_octets(dst, buf, rv->size);
+}
+
+void range_val_inc(struct range_val *rv)
+{
+	uint64_t was = rv->buf[0];
+	rv->buf[0]++;
+	if (rv->buf[0] < was)
+		rv->buf[1]++;
+}
+
+int range_val_cmp(const struct range_val *a, const struct range_val *b)
+{
+	int rc;
+	if (a == b)
+		return 0;
+	if (!a)
+		return -1;
+	if (!b)
+		return 1;
+	rc = OSMO_CMP(a->buf[0], b->buf[0]);
+	if (rc)
+		return rc;
+	rc = OSMO_CMP(a->buf[1], b->buf[1]);
+	if (rc)
+		return rc;
+	return OSMO_CMP(a->size, b->size);
+}
+
+void range_next(struct range *r)
+{
+	if (range_val_cmp(&r->next, &r->first) < 0) {
+		r->next = r->first;
+		return;
+	}
+	if (range_val_cmp(&r->next, &r->last) >= 0) {
+		r->next = r->first;
+		r->wrapped = true;
+		return;
+	}
+	range_val_inc(&r->next);
+}
Author	SHA1	Message	Date
Neels Hofmeyr	07c95ce770	gtplab0	2024-09-21 07:13:08 +02:00
Neels Hofmeyr	a01dd18276	gtplab0	2024-09-16 23:42:15 +02:00
Neels Janosch Hofmeyr	570cfc9a43	udp flood test Change-Id: Ia19ac41c9924ba4d44b3e087e17ede83a7c548bf	2024-09-16 23:37:50 +02:00
Neels Hofmeyr	4dbf2e7189	gtplab2	2024-09-14 06:20:48 +02:00
Neels Hofmeyr	85dd1f64a6	gtplab1	2024-09-14 06:20:21 +02:00
Neels Hofmeyr	ac52bbbffb	gtplab0	2024-09-14 06:19:35 +02:00
Neels Janosch Hofmeyr	a75e42f210	gtpflood tunmap Change-Id: I5226be3cc42b912fbd912d24f6c9de5fc5030230	2024-09-14 02:19:44 +02:00
Neels Janosch Hofmeyr	429686528e	gtpflood tunmap Change-Id: I621d40a9bdcd00987a7af10cc1efd7b5561476d0	2024-09-14 02:10:30 +02:00
Neels Janosch Hofmeyr	6aa0a7c97b	gtpflood tunmap Change-Id: Id5771f00ff393471dd2ca84b3b4f35f0560d7b07	2024-09-14 01:32:42 +02:00
Neels Janosch Hofmeyr	53408d0437	gtpflood tunmap Change-Id: Ifdc9ad2a7a1924bc27371028d036683e51b617f3	2024-09-14 00:57:47 +02:00
Neels Janosch Hofmeyr	1c3bc6b531	gtpflood tunmap Change-Id: Id4f15a9faca0ae7c082fed84ddf8757363a105c2	2024-09-13 23:31:53 +02:00
Neels Hofmeyr	9cb575b920	gtplab1	2024-09-13 06:52:15 +02:00
Neels Hofmeyr	34427ab995	osmo-pfcp-tool log tweak: s/NOTICE/DEBUG	2024-09-13 06:50:06 +02:00
Neels Hofmeyr	6428a9bf78	gtplab0	2024-09-13 05:58:56 +02:00
Neels Hofmeyr	033a21b5ff	udp-responder	2024-09-13 05:53:22 +02:00
Neels Hofmeyr	c60686199f	gtplab2	2024-09-13 05:53:22 +02:00
Neels Hofmeyr	bb4b6c1855	gtplab0	2024-09-13 05:51:17 +02:00
Neels Hofmeyr	245cf0ceed	gtplab1	2024-09-13 05:50:42 +02:00
Neels Janosch Hofmeyr	c73263f85f	gtp_flood wip Change-Id: Ia9cf685081c91206198065619a4a6b30ed3deb7e	2024-09-13 05:18:12 +02:00
Neels Janosch Hofmeyr	bb96fbb1c2	gtp_flood wip Change-Id: Ida26774b570b86ce6d91fde66c301bde8fd59930	2024-09-13 04:16:57 +02:00
Neels Janosch Hofmeyr	f6e3f3023b	overview Change-Id: I3db3614a3d4ffcd835e82a104eb13494e0848930	2024-09-13 02:44:38 +02:00
Neels Hofmeyr	b2ab19b894	TEMP udp-responder: disable ctr	2024-09-12 04:44:28 +02:00
Neels Hofmeyr	f137c01491	gtpflood tunend: flooding tweaks	2024-09-12 04:44:28 +02:00
Neels Hofmeyr	7cbf627329	gtpflood tunend osmo-upf.cfg	2024-09-12 04:41:49 +02:00
Neels Hofmeyr	30ce4a47c1	gtpflood tunend eupf.cfg	2024-09-12 04:41:49 +02:00
Neels Hofmeyr	ad730f410f	wip	2024-09-12 04:41:49 +02:00
Neels Hofmeyr	1d12b2c01a	gtpflood tunend: flooding tweaks	2024-09-12 04:12:38 +02:00
Neels Hofmeyr	5b32f65a95	gtpflood tunend	2024-09-12 04:12:38 +02:00
Neels Janosch Hofmeyr	f324fa5512	osmo-pfcp-tool gtp-flood: rx GTP packets Change-Id: I49c7c9de09121cbdde859242775d4d0afeb71c29	2024-09-12 04:10:01 +02:00
Neels Hofmeyr	b5e89d9f98	udp_responder fu	2024-09-12 04:02:35 +02:00
Neels Hofmeyr	f235ca2228	gtpflood tunend	2024-09-12 02:36:08 +02:00
Neels Janosch Hofmeyr	1418f3fb9a	udp-responder: add rate counter for bytes per seconds display Change-Id: Ic81bfe2a363545886a2123baf67a9acab3b3d207	2024-09-12 02:34:27 +02:00
Neels Janosch Hofmeyr	2bc25789c9	gtplab wip Change-Id: I58278d6f1d7eb5fff9e1eaf301d546101759a491	2024-09-11 03:11:15 +02:00
Neels Janosch Hofmeyr	eddc387d37	udp_responder Change-Id: I39418fab40b073cd0eedf370ad6f9e1fed8efffe	2024-09-11 03:11:15 +02:00
Neels Janosch Hofmeyr	7d5c405e12	osmo-pfcp-tool: add GTP flooding using io_uring Freely copying from gtp-load-gen.c, implement GTP flooding in osmo-pfcp-tool scripts. Add dependency liburing. It can be disabled with configure --disable-uring in which case the new 'gtp flood' command only logs an error. This verbosely commented example script serves as a good explanation: contrib/osmo-pfcp-tool-scripts/gtp_flood.vty Related: SYS#6590 Change-Id: I332aa0e2efd55f6e357cde4752a3d8b584db531b	2024-09-11 03:11:15 +02:00
Neels Janosch Hofmeyr	32772f3846	move pfcp_tool.h to include/osmocom/pfcptool/ Related: SYS#6590 Change-Id: If3e7cc4df3defd08df9e75965715a1be0388ed01	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	7a31d130ff	pfcp_tool: add 'date' Allow scripts to output timestamps to easily measure how long certain actions took to complete. Related: measuring PFCP session management performance bounds of osmo-upf. Change-Id: I0486cc92ea298bb9926a0e5c26da17ba5970a72c	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	a7a3a012b4	pfcp-tool: n-sessions [4/4]: implement 'n <0-2147483647> session create' Related: SYS#6590 Change-Id: I74a21cc31296ab89a2acda1da8ae9693c1992e66	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	ac46306cc5	pfcp-tool: n-sessions [3/4]: add poll arg to pfcp_tool_mainloop() Allow calling in non-blocking mode, prepare for N sessions. Related: SYS#6590 Change-Id: I20bb2803b28681face18ee665d8a1aad06d58091	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	fc8b905a7b	pfcp-tool: n-sessions [2/4]: generalize function args Change some VTY DEFUN into generally callable functions. Prepare for N sessions commands. Related: SYS#6590 Change-Id: I112206049e704b7adad7072b1f7953f7ee4f18ca	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	968666caab	pfcp-tool: n-sessions [1/4]: add generators for TEID and UE IP Add the ability to establish a large number of sessions automatically. Useful for load testing. Related: SYS#6590 Change-Id: Iec164a222782d382aefe8d0342f398ebba1eac05	2024-09-10 05:46:28 +02:00
Neels Janosch Hofmeyr	2b3e46d3b1	pfcp-tool: always use specific PDR ids for access and core Makes it easier to find the right one later. This will be used to fetch the UPF chosen TEIDs from PFCP responses in upcoming "n-sessions [4/4]" I74a21cc31296ab89a2acda1da8ae9693c1992e66. Related: SYS#6590 Change-Id: Ic343494001c70a84f3402ce5749d08e729551b26	2024-09-10 05:46:28 +02:00