Extend software verification beyond individual components and learn how to test behaviour across interfaces, protocols, middleware and data-processing layers.
This eight-hour module develops practical capability in integration and protocol-level testing, including protocol conformance, traffic analysis, TCP/UDP test harnesses, fuzzing, message-broker behaviour, API integration, ETL validation and persistence testing.
Participants work with tools and technologies including Wireshark, Scapy, mitmproxy, MQTT, Kafka, REST, gRPC, PostgreSQL, MongoDB and TimescaleDB, then combine the activities in an end-to-end multi-protocol integration project.
The module forms part of Alpinum’s Software Testing & Verification Training Programme and builds on the requirements and traceability work developed in Module 5.
View the Full Software Testing & Verification Programme
What You Will Learn
Module 6 moves testing beyond isolated software components into the interfaces and communication paths that connect systems together.
Participants learn how to inspect protocol traffic, construct test packets, exercise networked services under failure conditions, validate message delivery and schema behaviour, and test data ingestion and persistence across multiple layers.
Topics
Protocol & OSI-Layer Testing
- OSI 7-layer testing implications and protocol conformance testing
- Wireshark: capture filters, display filters, dissectors, TCP stream following
- Scapy: packet crafting, sending/sniffing, layering protocols
- TLS/encrypted traffic testing with mitmproxy; protocol fuzzing
Network Programming Testing
- TCP/UDP test harnesses and concurrent-connection testing
- Async networking tests (asyncio, Tokio); timeout, retry and graceful-shutdown testing
- Fuzzing categories: mutation-based vs generation-based; coverage-guided fuzzing
- Crash triage and reproduction
Middleware Testing
- JSON Schema validation; Protobuf/gRPC schema evolution and contract testing
- MQTT QoS levels, retained messages and last-will testing
- Kafka consumer groups, partition rebalancing, message replay
- Idempotency testing and dead letter queues
Data Server Testing
- REST/gRPC ingestion testing, including pagination and error codes
- ETL extract/transform/load stage testing
- SQL transaction rollback testing; NoSQL eventual-consistency testing
- Time-series downsampling validation; data quality checks; multi-protocol aggregation testing
Lab 1: Protocol Analysis & Fuzzing with Wireshark and Scapy
Learning Objectives: Wireshark, Scapy, protocol conformance, protocol fuzzing
Description: Capture and analyse protocol traffic for a sample client/server, then craft and fuzz test packets.
Tasks
- Capture HTTP traffic between a sample client and server in Wireshark.
- Apply a display filter to isolate one conversation and follow its TCP stream.
- Craft a custom packet for the sample protocol using Scapy.
- Send the crafted packet and capture the server’s response using Scapy.
- Apply basic mutation-based fuzz input to the protocol handler.
- Document one malformed-packet test case and the expected error handling.
Extension Tasks
- Inspect TLS-wrapped traffic for the same service using mitmproxy.
- Layer two protocols together in a single Scapy-crafted packet.
Topics Covered
Wireshark, Scapy, Protocol Conformance, Protocol Fuzzing
Open Source Recommendation
Wireshark, Scapy and mitmproxy: all open-source protocol analysis and interception tools.
Lab 2: Network Programming Test Harness & Fuzzing
Learning Objectives: TCP/UDP test harness, concurrent connections, fuzzing categories
Description: Build a client-side test harness against a sample TCP server and run a basic fuzz campaign against it.
Tasks
- Build a test harness that connects to and exercises a sample TCP server.
- Simulate multiple concurrent clients against the server.
- Force and validate a timeout scenario.
- Force and validate retry/backoff behaviour after a simulated failure.
- Validate graceful shutdown behaviour under an in-flight request.
- Run a basic mutation-based fuzz test against the server and log any crash.
Extension Tasks
- Add a generation-based fuzz input model for the protocol.
- Triage and reproduce one fuzz-found crash reliably.
Topics Covered
TCP/UDP Testing, Concurrent Connections, Fuzzing, Crash Triage
Open Source Recommendation
A Python asyncio- or Rust Tokio-based harness combined with a lightweight open-source fuzzer such as AFL++.
Lab 3: Middleware & Message Broker Testing
Learning Objectives: JSON Schema, gRPC contract testing, MQTT, Kafka
Description: Validate schema conformance and message delivery behaviour across an MQTT broker and a Kafka topic.
Tasks
- Validate a sample JSON message against a defined JSON Schema.
- Write a simple consumer-driven contract for a gRPC service call.
- Publish and subscribe to a topic on an MQTT broker, testing at least two QoS levels.
- Verify retained-message and last-will behaviour on the broker.
- Produce and consume test messages on a Kafka topic, verifying consumer-group partition assignment.
- Test idempotent handling of a deliberately duplicated message.
Extension Tasks
- Simulate a broker outage and observe system behaviour.
- Route a repeatedly failing message to a dead letter queue.
Topics Covered
JSON Schema, Contract Testing, MQTT, Kafka
Open Source Recommendation
Eclipse Mosquitto (MQTT broker), Eclipse Paho (MQTT client) and Apache Kafka: all open-source.
Lab 4: Data Server Integration & ETL Testing
Learning Objectives: REST/gRPC ingestion, ETL testing, SQL/NoSQL persistence, data quality
Description: Run integration tests against a sample data server’s ingestion, ETL and persistence layers.
Tasks
- Write an integration test against a REST ingestion endpoint, including pagination.
- Write an integration test against a gRPC ingestion endpoint, including one error-code case.
- Test the extract, transform and load stages of a sample ETL pipeline independently.
- Verify a failed SQL transaction leaves no partial state (rollback test).
- Verify NoSQL eventual-consistency behaviour while data is still converging.
- Run a data-quality completeness check on ingested sample data.
Extension Tasks
- Validate a downsampled time-series query against expected aggregated values.
- Test the multi-protocol (CAN/MQTT/REST) aggregation path end-to-end.
Topics Covered
REST/gRPC Ingestion, ETL Testing, SQL/NoSQL Persistence, Data Quality
Open Source Recommendation
PostgreSQL, MongoDB and TimescaleDB (all open-source) as the SQL, NoSQL and time-series targets.
Module 6 Coverage Matrix
| Topic | Lab 1 | Lab 2 | Lab 3 | Lab 4 |
|---|---|---|---|---|
| Protocol & OSI-Layer Testing | ✓ | |||
| Network Programming Testing | ✓ | |||
| Fuzzing | ✓ | ✓ | ||
| Middleware & Message Broker Testing | ✓ | |||
| Data Server & ETL Testing | ✓ |
Module Project: Multi-Protocol Data Aggregation Server Integration Suite
Multi-protocol data aggregation server integration suite — validate protocol-level, network, middleware and data-persistence behaviour end-to-end for a CAN/MQTT/REST aggregation server, including one fuzz-based negative test.
This module project combines the four practical layers into one integrated verification activity.
Participants move from individual tests toward an evidence chain spanning:
Protocol traffic
↓
Network behaviour
↓
Middleware/message delivery
↓
Data ingestion
↓
Persistence
↓
End-to-end integration evidence
The result demonstrates how failures can emerge not only inside individual software components but also at the interfaces and data boundaries between them.
From Component Testing to System Integration
Earlier modules focus primarily on individual requirements, functions or software components.
Module 6 expands the verification boundary.
Instead of asking only:
Does this component behave correctly?
participants also examine:
Does the interface behave correctly?
Does the protocol handle valid and malformed traffic?
Does the system behave correctly during timeouts, retries or connection failures?
Are messages delivered and processed correctly?
Does data remain correct across ingestion, transformation and persistence?
This makes Module 6 the programme’s main bridge from component-level verification into connected systems.
Protocol Analysis and Negative Testing
Protocol testing requires more than validating successful communication.
Participants use Wireshark and Scapy to inspect and construct network traffic, then deliberately introduce malformed inputs as part of protocol-level negative testing.
The module also introduces fuzzing concepts including:
- Mutation-based fuzzing
- Generation-based fuzzing
- Coverage-guided fuzzing
- Crash detection
- Crash triage
- Reproducible failure analysis
Keep this section focused on the curriculum’s testing intent rather than turning the page into a general cybersecurity or penetration-testing page.
Testing Network Behaviour Under Failure
Reliable networked software must handle conditions beyond successful requests.
Module 6 therefore includes testing for:
- Concurrent clients
- Timeouts
- Retry/backoff behaviour
- Graceful shutdown
- In-flight requests
- Malformed inputs
- Fuzz-found crashes
This gives participants practical experience testing network behaviour when the expected happy path no longer holds.
Middleware and Message Broker Testing
The module also introduces verification across asynchronous and message-driven systems.
Participants work with JSON Schema and gRPC contract testing before validating MQTT and Kafka behaviour.
The practical exercises include:
- MQTT QoS
- Retained messages
- Last-will behaviour
- Kafka consumer groups
- Partition assignment
- Duplicated messages
- Idempotent processing
- Broker failure
- Dead letter queues
This section should remain subordinate to the wider Integration & Protocol-Level Testing intent rather than becoming a separate “Kafka training” landing page.
Data Server & ETL Integration Testing
The final laboratory extends integration testing into ingestion, transformation and persistence layers.
Participants test:
REST/gRPC ingestion
↓
ETL stages
↓
SQL/NoSQL persistence
↓
Data-quality checks
The exercises also cover rollback behaviour, eventual consistency and time-series data validation.
This completes the module’s progression from communication interfaces through to persisted system data.
How Module 6 Connects With the Programme
Module 5: Requirements-Based Testing & Traceability
Module 5 establishes the relationship between requirements and verification evidence. Module 6 expands execution into interconnected interfaces and services.
Module 7: Embedded & Real-Time Systems Testing
The programme next moves into constrained and real-time software environments, including QEMU, FreeRTOS and dynamic interfaces such as GPIO/UART/SPI/I2C/CAN.
Module 8: IoT & Networking Applications Testing
Module 8 extends several networking concepts into complete device/gateway/cloud scenarios, OTA updates, load testing, failover and observability.
These relationships are useful internal links because they reflect the actual curriculum progression rather than merely connecting similar keywords. Module 7 begins immediately after this integration module, while Module 8 expands into IoT/networked application testing.
Frequently Asked Questions
What does the Integration & Protocol-Level Testing module cover?
The module covers protocol and OSI-layer testing, network-programming testing, middleware and message brokers, data-server integration and ETL testing.
Which protocol-analysis tools are used?
Participants use Wireshark for traffic analysis and Scapy for packet crafting, sending and sniffing. mitmproxy is included as an extension for TLS-wrapped traffic.
Is protocol fuzzing covered?
Yes. Participants apply mutation-based fuzz input to a protocol handler, and the curriculum also introduces generation-based and coverage-guided fuzzing concepts.
Does the module cover TCP and UDP testing?
Yes. The network-programming section includes TCP/UDP test harnesses, concurrent connections, timeout behaviour, retry/backoff and graceful shutdown testing.
Are MQTT and Kafka included?
Yes. Participants test MQTT QoS, retained-message and last-will behaviour, as well as Kafka consumer groups and partition assignment.
Does the module cover REST and gRPC testing?
Yes. REST and gRPC ingestion testing are included, along with pagination and error-code cases.
Is database testing included?
Yes. The data-server laboratory includes SQL rollback testing, NoSQL eventual-consistency behaviour and data-quality validation.
Does Module 6 cover ETL testing?
Yes. Participants test extract, transform and load stages independently as part of the data-server integration laboratory.
Which open-source technologies are recommended?
The curriculum references Wireshark, Scapy, mitmproxy, AFL++, Eclipse Mosquitto, Eclipse Paho, Apache Kafka, PostgreSQL, MongoDB and TimescaleDB.
What is the Module 6 project?
The project is a Multi-Protocol Data Aggregation Server Integration Suite validating protocol, network, middleware and persistence behaviour across a CAN/MQTT/REST aggregation server, including a fuzz-based negative test.
