embodiments of the present disclosure provide integrated circuits that conduct network stress testing at the media access control ( mac ) level and above . because the testing occurs at the asic level , the cpus in network devices employing integrated circuits according to the present disclosure are only minimally burdened by the testing . integrated circuits according to the present disclosure can generate network traffic at wire speed , including specified high - level protocols and qualities of service . integrated circuits according to the present disclosure can also analyze network traffic , including traffic originated by the present disclosure and traffic sent in reply to such traffic , including analysis of individual data flows and quality of service performance across the network . the networks tested can include any sort of network such as wired , wireless , optical , and so on , and can range in scope from a single network device to very large networks including many network devices . while techniques of the present disclosure are described with respect to a network switch and a network interface controller , it will be understood by those skilled in the relevant arts after reading this description that techniques of the present disclosure can be implemented in other sorts of network devices as well , such as wireless access points , wireless clients , and the like . fig1 shows a network switch application - specific integrated circuit ( asic ) 100 in communication with a network 102 according to the present disclosure . asic 100 includes a forwarding engine 104 to transfer packets of data between ports 106 a through 106 n , a classifier 108 to determine properties of packets received by asic 100 , and one or more optional counters 110 to count packets . in some embodiments , some or all of the counters 110 are implemented within ports 106 . preferably asic 100 includes various counters . those on the port level simply count how many packets are received and sent . more sophisticated counters also on the port level can count certain type of packets based on low - level indications such as bad crc , runt packets , packets too long , and the like . each block includes additional counters that can count the criteria supported by that block . for example , forwarding engine 104 includes counters that can count how many packets have been received or sent on a specific route . as another example , classifier 108 includes counters that count only packets belonging to a specific flow . fig1 also shows detail of one of the ports 106 a , which includes a media access controller ( mac ) 112 , a network receive interface 114 to receive packets of data from network 102 , and a network transmit interface 116 to transmit packets of data to network 102 . mac 112 includes a mac controller 118 , one or more ingress queues 120 to store packets received by port 106 a from network 102 , and one or more egress queues 122 to store packets to be transmitted by port 106 a to network 102 . in some embodiments , some or all of the functions of mac controller 118 are implemented in a central controller in asic 100 . port 106 a also includes a packet generator 128 to generate one or more packets according to one or more packet definitions that can be provided to asic 100 , one or more generator queues 126 to store packets generated by packet generator 128 , and a scheduler 130 to schedule packets in egress queues 124 and generator queues 126 for transmission to network 102 . this arrangement permits asic 100 to conduct network testing while also handling regular network traffic . fig2 shows a process 200 for asic 100 of fig1 . asic 100 operates as a network switch . therefore ports 106 transmit and receive packets of data to and from network 102 ( step 202 ) and forwarding engine 104 transfers the packets between ports 106 ( step 204 ) according to methods well - known in the relevant arts . port 106 a acts as a traffic generator to support network testing . mac controller 118 receives one or more packet definitions ( step 206 ), for example from a host cpu or in a packet from network 102 . the packet definitions specify characteristics of the packets to be generated by port 106 a . for example , the packet definitions can include an address definition that specifies one or more addresses , such as source and destination ip and mac addresses , for the one or more packets of data to be originated by the packet generator , a load definition that specifies the number of packets to be generated , a target definition that specifies one or more destinations for the packets , a protocol definition that specifies one or more network protocols for the packets such as open shortest path first protocol ( ospf ) and routing information protocol ( rip ), a payload definition that specifies one or more data patterns for payloads of the packets , a data rate definition that specifies one or more data rates at which the packets are to be transmitted , a quality of service definition that specifies one or more qualities of service for the packets , and the like . packet generator 128 originates one or more packets of data according to one or more of the packet definitions ( step 208 ). network transmit interface 116 transmits the one or more packets of data originated by the packet generator ( step 210 ). as used herein , the terms “ originate ” and “ originated ” are used to indicate that the packets so described are packets that are generated by a packet generator 128 in a mac 106 , in contrast to packets that merely pass through a mac 106 , such as packets received from network 102 or forwarding engine 104 . this traffic generation function can be used to stress - test network 102 without burdening any cpu controlling asic 100 . for example , in response to a packet definition provided by such a cpu , asic 100 can generate a specified number of packets at a specified data rate and quality of service including a specified payload and addressed to a specified network device . the only burden to the cpu is the time required to provide the packet definition . in some embodiments , asic 100 determines network throughput according to the two - way packet loss of the packets sent by asic 100 , as shown in fig3 as process 300 . the packets originated and transmitted by port 106 a are received by one or more network devices ( step 302 ), which transmit replies to each of the packets ( step 304 ). port 106 a receives the reply packets ( step 306 ) and stores them in ingress queues 120 . classifier 108 identifies the packets that were received in reply to the packets of data that were originated and transmitted by a port in asic 100 such as port 106 a ( step 308 ). preferably classifier 108 is implemented according to a dual lookup for each packet , with one lookup to implement rules for handling test packets such as those received in reply to packets originated by a port 106 in an asic 100 , and another lookup to implement rules for handling access control lists and quality of service ( qos ) rules for regular network traffic . one or more of counters 110 counts the number of the packets received in reply to the packets that were originated and transmitted by one of the ports 106 in asic 100 , such as port 106 a ( step 310 ). controller 118 determines a packet loss based on the number of the packets that were originated and transmitted by one or more ports 106 in asic 100 and the number of packets received by asic 100 in reply to those packets ( step 312 ). in some embodiments , asic 100 determines network throughput according to the one - way packet loss of the packets sent by asic 100 , as shown in fig4 as process 400 . the packets originated and transmitted by port 106 a are received by one or more network devices ( step 402 ), which count the number of originated packets received ( step 404 ) and transmit one or more packets to asic 100 representing those numbers ( step 406 ). controller 118 determines the packet loss based on the number of packets of data originated by packet generator 128 and transmitted by network transmit interface 116 to the network devices and the number of those packets that were received by the network devices ( step 408 ). in some embodiments , the packet loss can be calculated based on a subset of the packets such as a specific data flow according to specified properties of the packets . for example , the packet loss determination can be limited to packets having one or more specified qualities of service , for example to verify the quality - of - service performance of network 102 . other example properties include source and destination addresses of the packets and the like . in some embodiments asic 100 also counts certain packets received from network 102 , for example to support a packet loss calculation by another asic . fig5 shows a process 500 for such packet counting . a port 106 in asic 100 receives packets ( step 502 ) and stores them in ingress queues 120 . classifier 108 determines one or more properties of the packets ( step 504 ). the classifier 108 may be implemented according to a dual lookup for each packet , as described above . one or more of counters 110 counts the number of received packets having properties that match one or more property definitions ( step 506 ). the property definitions can include , for example , a value for a field in the packets that indicates the packets were originated by one of the ports 106 in asic 100 , a value for a field in packets that indicates the packets were originated by a port in another asic , one or more qualities of service for the packets , and the like . asic 100 optionally transmits the packet count in response to a request . asic 100 receives a request for the contents of one or more of counters 110 ( step 508 ). in response , asic 100 transmits a packet of data including the contents of counter ( s ) 110 ( step 510 ). asic 100 can be implemented in a network device such as a network switch . the network switch can include a user interface to provide the one or more packet definitions and property definitions to asic 100 , and to retrieve data from asic 100 , such as the contents of counter ( s ) 110 . fig6 shows a network interface controller asic 600 in communication with a host 632 and a network 602 according to the present disclosure . asic 600 includes a host interface 604 to exchange packets of data with host 632 , a port 606 to exchange packets of data with network 602 , a classifier 608 to determine properties of packets received by asic 600 , and one or more optional counters 610 to count packets . in some embodiments , some or all of the counters 610 are implemented within port 606 . fig6 also shows detail of port 606 , which includes a media access controller ( mac ) 612 , a network receive interface 614 to receive packets of data from network 602 , and a network transmit interface 616 to transmit packets of data to network 602 . mac 612 includes a mac controller 618 , one or more ingress queues 620 to store packets received by port 606 from network 602 , and one or more egress queues 622 to store packets to be transmitted by port 606 to network 602 . in some embodiments , some or all of the functions of mac controller 618 are implemented in a central controller in asic 600 . port 606 also includes a packet generator 628 to generate one or more packets according to one or more packet definitions that can be provided to asic 600 by host 632 , one or more generator queues 626 to store packets generated by packet generator 628 , and a scheduler 630 to schedule packets in egress queues 624 and generator queues 626 for transmission to network 602 . this arrangement permits asic 600 to conduct network testing while also handling regular network traffic . fig7 shows a process 700 for asic 600 of fig6 . asic 600 operates as a network interface controller . therefore port 606 transmits and receives packets of data to and from network 602 ( step 702 ) and host interface 604 transfers the packets between port 606 and host 632 ( step 704 ) according to methods well - known in the relevant arts . port 606 acts as a traffic generator to support network testing . mac controller 618 receives one or more packet definitions ( step 706 ), for example from a host cpu or in a packet from network 602 . the packet definitions specify characteristics of the packets to be generated by port 606 . for example , the packet definitions can include an address definition that specifies one or more addresses , such as source and destination ip and mac addresses , for the one or more packets of data to be originated by the packet generator , a load definition that specifies the number of packets to be generated , a target definition that specifies one or more destinations for the packets , a protocol definition that specifies one or more network protocols for the packets such as open shortest path first protocol ( ospf ) and routing information protocol ( rip ), a payload definition that specifies one or more data patterns for payloads of the packets , a data rate definition that specifies one or more data rates at which the packets are to be transmitted , a quality of service definition that specifies one or more qualities of service for the packets , and the like . packet generator 628 originates one or more packets of data according to one or more of the packet definitions ( step 708 ). network transmit interface 616 transmits the one or more packets of data originated by the packet generator ( step 710 ). as used herein , the terms “ originate ” and “ originated ” are used to indicate that the packets so described are packets that are generated by a packet generator 628 in a mac 606 , in contrast to packets that merely pass through a mac 606 , such as packets received from network 602 or host interface 604 . this traffic generation function can be used to stress - test network 602 without burdening any cpu controlling asic 600 . for example , in response to a packet definition provided by such a cpu , asic 600 can generate a specified number of packets at a specified data rate and quality of service including a specified payload and addressed to a specified network device . the only burden to the cpu is the time required to provide the packet definition . in some embodiments , asic 600 determines network throughput according to the two - way packet loss of the packets sent by asic 600 , as shown in fig8 as process 800 . the packets originated and transmitted by port 606 are received by one or more network devices ( step 802 ), which transmit replies to each of the packets ( step 804 ). port 606 receives the reply packets ( step 806 ) and stores them in ingress queues 620 . classifier 608 identifies the packets that were received in reply to the packets of data that were originated and transmitted by port 606 ( step 808 ). preferably classifier 608 is implemented according to a dual lookup for each packet , with one lookup to implement rules for handling test packets such as those received in reply to packets originated by a port 606 in an asic 600 , and another lookup to implement rules for handling regular network traffic . one or more of counters 610 counts the number of the packets received in reply to the packets that were originated and transmitted by one of the ports 606 in asic 600 , such as port 606 ( step 810 ). controller 618 determines a packet loss based on the number of the packets that were originated and transmitted by port 606 in asic 600 and the number of packets received by asic 600 in reply to those packets ( step 812 ). in some embodiments , asic 600 determines network throughput according to the one - way packet loss of the packets sent by asic 600 , as shown in fig9 as process 900 . the packets originated and transmitted by port 606 are received by one or more network devices , which count the number of originated packets received and transmit one or more packets to asic 600 representing those numbers ( step 902 ). controller 618 determines the packet loss based on the number of packets of data originated by packet generator 628 and transmitted by network transmit interface 616 to the network devices and the number of those packets that were received by the network devices ( step 906 ). in some embodiments , the packet loss can be calculated based on a subset of the packets such as a data flow according to specified properties of the packets . for example , the packet loss determination can be limited to packets having one or more specified qualities of service , for example to verify the quality - of - service performance of network 602 . other example properties include source and destination addresses of the packets and the like . in some embodiments asic 600 also counts certain packets received from network 602 , for example to support a packet loss calculation by another asic . fig1 shows a process 1000 for such packet counting . port 606 receives packets ( step 1002 ) and stores them in ingress queues 620 . classifier 608 determines one or more properties of the packets ( step 1004 ). the classifier 608 may be implemented according to a dual lookup for each packet , as described above . one or more of counters 610 counts the number of received packets having properties that match one or more property definitions ( step 1006 ). the property definitions can include , for example , a value for a field in the packets that indicates the packets were originated by port 606 in asic 600 , a value for a field in packets that indicates the packets were originated by a port in another asic , one or more qualities of service for the packets , and the like . asic 600 optionally transmits the packet count in response to a request . asic 600 receives a request for the contents of one or more of counters 610 ( step 1008 ). in response , asic 600 transmits a packet of data including the contents of counter ( s ) 610 ( step 1010 ). asic 600 can be implemented in a network device such as a network interface card . the network interface card can include a user interface to provide the one or more packet definitions and property definitions to asic 600 , and to retrieve data from asic 600 , such as the contents of counter ( s ) 610 . the techniques disclosed herein can be implemented in digital electronic circuitry , or in computer hardware , firmware , software , or in combinations of them . apparatuses of the disclosure can be implemented in a computer program product tangibly embodied in a machine - readable storage device for execution by a programmable processor ; and method steps of the disclosure can be performed by a programmable processor executing a program of instructions to perform functions of the disclosure by operating on input data and generating output . the techniques can be implemented advantageously in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from , and to transmit data and instructions to , a data storage system , at least one input device , and at least one output device . each computer program can be implemented in a high - level procedural or object - oriented programming language , or in assembly or machine language if desired ; and in any case , the language can be a compiled or interpreted language . suitable processors include , by way of example , both general and special purpose microprocessors . generally , a processor will receive instructions and data from a read - only memory and / or a random access memory . generally , a computer will include one or more mass storage devices for storing data files ; such devices include magnetic disks , such as internal hard disks and removable disks ; magneto - optical disks ; and optical disks . storage devices suitable for tangibly embodying computer program instructions and data include all forms of non - volatile memory , including by way of example semiconductor memory devices , such as eprom , eeprom , and flash memory devices ; magnetic disks such as internal hard disks and removable disks ; magneto - optical disks ; and cd - rom disks . any of the foregoing can be supplemented by , or incorporated in , asics ( application - specific integrated circuits ). the foregoing description is merely illustrative in nature and is in no way intended to limit the disclosure , its application , or uses . the broad teachings of the disclosure can be implemented in a variety of forms . therefore , while this disclosure includes particular examples , the true scope of the disclosure should not be so limited since other modifications will become apparent upon a study of the drawings , the specification , and the following claims . for purposes of clarity , the same reference numbers will be used in the drawings to identify similar elements . as used herein , the phrase at least one of a , b , and c should be construed to mean a logical ( a or b or c ), using a non - exclusive logical or . it should be understood that one or more steps within a method may be executed in different order ( or concurrently ) without altering the principles of the present disclosure .