For some 30 years, fuzzing has been a favored methodology for vulnerability discovery and robustness testing by researchers anddevelopers alike. Following the popularity of American Fuzzy Lop and the rise of coverage-guided fuzzing, many state-of-the-art fuzzersemploy heavy instrumentation, work best on small components and often require source code access. For networking equipmentsuch as switches and routers, this may not be feasible. If the software needs to run on or interact with specialized hardware, fuzzingthe equipment on a component level becomes very difficult. Heavy instrumentation may also degrade the performance of the SUTtoo much, thus invalidating the testing. Furthermore, the customers who buy the networking equipment often want to do their ownsecurity or robustness testing, but lack access to the source code.This paper details the design and usage of a grammar-based fuzzing framework and applies it to the Link Layer Discovery Protocol(LLDP), which is commonly used by industrial networking equipment. By modeling the fuzzing campaign as a multi-armed banditproblem, the grammar used to generate frames is able to adapt to observations made by lightweight probes, a novel concept accordingto the author’s knowledge.
QC 20230123