Edit or sanitize existing .pcap files, simulate SNMPv1/v2c/v3 traps, test Suricata/Snort IDS and firewall ACLs, craft 802.1Q VLAN / QinQ / MPLS QoS trunks, and generate Modbus, DNP3, and S7comm OT captures.
Jump to Problem or Protocol:
The 3 Building Blocks (Create or Edit Any .pcap Without Coding)
If you can read a network diagram or a Wireshark capture, you already know how to build, edit, or sanitize packets in FrameAssembly.
Block 1 · host
Name or rewrite network endpoints
Give each device a name and an IPv4 or IPv6 address. MAC addresses are optional—and you can paste Linux colons, Windows hyphens, or Cisco 001a.2b3c.4d5e.
host laptop { ip 192.168.1.10 }
host router { ip 192.168.1.1 }
Block 2 · flow
Write 1 line per wire frame
Use -> to send a packet and <- to send a reply back. FrameAssembly calculates TCP sequence numbers, L3/L4 checksums, and flips reply ports automatically.
flow ping_test(a, b) {
a -> b icmp echo_request wait 1ms
a <- b icmp echo_reply wait 1ms
}
Block 3 · compile / reverse
Compile .fasm or decompile .pcap
Plug your device names into compile—or decompile an existing .pcap with frameassembly reverse to edit IPs, VLANs, and payloads.
Natively encodes all 6 industrial OT protocols—including automatic IEEE 1815 DNP3 CRC-16 calculation—over stateful TCP.
Step 1 · 1 min read
How FrameAssembly Works (Create & Edit .pcap Files)
Create new .pcap packet captures or edit existing captures using standard networking terms.
✓ No Python virtual environments, loops, or hex math needed.
✓ 1 line of code equals 1 packet in Wireshark.
✓ MAC addresses, ports, checksums, and TCP sequence numbers are filled in automatically.
Why Use FrameAssembly Code Instead of Scapy, tcprewrite, or Lab Gear?
When you need to edit an existing .pcap file, test a firewall rule, simulate an SNMPv3 trap, or check a VLAN trunk, you shouldn’t have to fight Python scripts, arcane tcprewrite flags, or spare hardware routers.
In FrameAssembly, you simply list your devices and write the packets sent between them—or decompile an existing .pcap into .fasm text, edit any IP/VLAN/payload field, and recompile.
Clean Lowercase Syntax & Zero Boilerplate
Write keywords in lowercase (host, flow, compile, tcp, snmp3). Any optional field you leave out is automatically filled with standard RFC defaults.
Starter Example: Web Check + SNMP Alert
Every file has 3 parts: host (name your devices), flow (list the packets), and compile (build the capture).
demo_showcase.fasm— Starter Example: Web Handshake & SNMP Trap
Every FrameAssembly file follows the same three-step layout.
✓ host gives a device a name, an IPv4/IPv6 address, and an optional MAC (colon, hyphen, or Cisco dotted-quad).
✓ flow lists the packets sent between devices using -> and <- arrows.
✓ compile runs your flows to build the final .pcapng file.
1. host — Name Your Devices (Any MAC Format or MAC-Only L2)
Write host <name> { ip <address> } for each device (or host sw1 { mac 00:1c:73:00:00:01 } for MAC-only Layer 2 switches). FrameAssembly v1.5.1 accepts IPv4 or IPv6 addresses and Linux colons (00:1a:2b:3c:4d:5e), Windows hyphens (00-1A-2B-3C-4D-5E), or Cisco dotted-quad format (001a.2b3c.4d5e).
Keep host Blocks Simple & Use // Comments
Write host router { ip 192.168.1.1 mac 001a.2b3c.4d5e } — do not put equals signs (=), colons (:), or /24 subnet masks inside a host block, and always start comments with //.
2. flow & compile — Send Packets
Inside a flow block, each line sends one packet. Then list the flow inside compile to generate the capture.
ping_two_routers.fasm— Ping Two Routers (Using Cisco & Standard MAC Formats)
1// 1. Devices (supports colon, hyphen, or Cisco dotted-quad MACs)
2hostlaptop{ip192.168.10.25mac00-1A-2B-3C-4D-25}
3hostbranch_gw{ip192.168.10.1mac001a.2b3c.4d01}
4hostcore_rtr{ip10.255.0.1}
5
6// 2. Packet sequence
7flowping_check(src, dst){
8 src -> dst icmpecho_request id 100seq1wait2ms
9 src <- dst icmpecho_reply id 100seq1wait2ms
10}
11
12// 3. Build capture
13compile{
14ping_check(laptop, branch_gw)
15ping_check(branch_gw, core_rtr)
16}
Step 3 · 2 min read
Stateful TCP Handshakes for Firewalls & Suricata IDS
Keep your client on the left and let FrameAssembly handle TCP sequence numbers.
✓ a -> b sends a packet from a to b.
✓ a <- b sends a reply from b back to a.
✓ wait 1ms (or us, s) spaces out packet timestamps in Wireshark.
✓ TCP ports and sequence numbers are tracked automatically after the first syn.
Automatic TCP Handshakes & Replies (No Sequence Math)
Stateful firewalls (Palo Alto, FortiGate, nftables) and IDS engines (Suricata, Snort, Zeek) ignore single spoofed Layer 7 packets unless they follow a valid 3-way TCP handshake. Set srcport and dstport on your first tcp syn packet—FrameAssembly swaps reply ports on <- and advances SEQ/ACK numbers by exact payload lengths automatically.
tcp_session.fasm— Clean TCP Handshake, Data Transfer & Close
Add VLAN tags, double-tagged S-VLAN/C-VLAN headers, MPLS labels, and DSCP markings without root.
✓ Add vlan <1..4094> pcp <0..7> or qinq <s_vid> inner_vlan <c_vid> on any line.
✓ Add mpls <label> exp <0..7> and dscp <0..63> to test WAN shapers and QoS queues.
✓ Use arp, lldp, stp, lacp, and eapol to test Layer 2 switching.
Tagging Packets with VLANs, QinQ & DiffServ QoS
Desktop OS network interfaces strip 802.1Q tags and block unprivileged QinQ or MPLS headers. In FrameAssembly, place vlan 100 pcp 5, qinq 2000 inner_vlan 150, or dscp 46 right before the protocol name on any line to write the exact Ethernet header into your .pcap.
vlan_and_arp.fasm— ARP Lookup + VLAN-Tagged Voice & QinQ WAN Packets
Trigger Zabbix, SolarWinds, PRTG, LibreNMS, or snmptrapd alerts without pulling live cables.
✓ Use snmp1, snmp2, or encrypted snmp3 (authPriv SHA-256 + AES-128) to build polls and traps.
✓ Attach custom OID values with varbind <oid> string "core-sw-01" or int 2.
✓ No Net-SNMP daemon setup, MIB hunting, or USM key localization math required.
Simulating SNMPv2c Polls and Encrypted SNMPv3 Traps
You can test SolarWinds, Zabbix, LibreNMS, PRTG, or Datadog alert rules offline by generating SNMPv2c or encrypted SNMPv3 USM authPriv traps with your exact EngineID and OIDs.
snmp_monitoring.fasm— SNMPv2c Status Poll & Encrypted SNMPv3 Trap
How to Edit, Rewrite IP/MAC, or Sanitize an Existing .pcap File
Decompile any .pcap or .pcapng into .fasm text, edit headers or scrub customer IPs, and recompile.
✓ Run frameassembly reverse capture.pcap -o editable.fasm (or click Import .pcap in the Playground).
✓ Change any IPv4/IPv6 address, MAC, VLAN tag, TCP/UDP port, TLS SNI, or payload in plain text.
✓ Recompile to .pcap/.pcapng with automatic IPv4/TCP/UDP checksums and TCP SEQ/ACK recalculation.
Edit Existing .pcap Files Without tcprewrite or Hex Editors
Need to change IP addresses in a packet capture before replaying with tcpreplay, add an 802.1Q VLAN tag, or sanitize sensitive customer IPs and hostnames before attaching a trace to a vendor TAC ticket?
Instead of chaining tcprewrite flags or slicing payloads with editcap, decompile the .pcap into .fasm code. You can edit the discovered host blocks, modify any packet line, delete background noise, and recompile a clean capture with valid checksums.
Browser Import .pcap or CLI frameassembly reverse
In the FrameAssembly Playground (/ide), click "Import .pcap" to decompile any .pcap or .pcapng file directly in your browser using WebAssembly—zero files are uploaded to a server.
Example: Decompiled & Sanitized Capture Ready to Recompile
Below is the output of frameassembly reverse after replacing internal customer IPs with RFC 5737 documentation addresses (192.0.2.10 and 198.51.100.20) and tagging the flow on VLAN 100:
Pick a real-world problem below and click Open in Playground to customize IP addresses, VLANs, ports, or SNMP OIDs—or copy the companion CLI commands for tshark, tcpreplay, and suricata.
Edit & Sanitize PCAP·tac_sanitized_radius.fasm·Solves: edit pcap file · modify ip address in pcap · sanitize pcap for vendor tac · rewrite vlan in pcap · tcprewrite / TraceWrangler alternative
You have an existing .pcap capture from tcpdump or Wireshark, and you need to rewrite IP addresses for lab replay, inject an 802.1Q VLAN tag, or scrub internal customer IPs and hostnames before attaching it to a vendor TAC ticket.
What this script builds: Decompiles the binary .pcap into readable .fasm code via frameassembly reverse (or Playground Import .pcap), edits the host IP/MAC blocks and L2–L7 fields, and recompiles with automatic checksum and TCP sequence recalculation.
How to customize: Run frameassembly reverse incident.pcap -o sanitized.fasm (or click Import .pcap in the Playground). Edit the host IPs (e.g. RFC 5737 192.0.2.x), MACs, VLAN tags, or RADIUS/TLS strings, then recompile.
1hostbranch_gw{ip192.0.2.1mac0011.22aa.bb01}
2hostauth_srv{ip198.51.100.10mac0011.22cc.dd10}
3
4flowtac_sanitized_radius(gw, srv){
5 gw -> srv vlan100radius access_request id 10user"redacted_user" nas_ip 192.0.2.1wait10ms
6 gw <- srv vlan100radius access_accept id 10wait5ms
# 1. Decompile any existing .pcap or .pcapng into editable .fasm code
frameassembly reverse production_incident.pcap -o tac_sanitized_radius.fasm
# 2. After editing IPs, VLANs, or strings in .fasm, preview and recompile to .pcap
frameassembly show tac_sanitized_radius.fasm
frameassembly tac_sanitized_radius.fasm -o sanitized_ticket.pcap
# 3. Verify updated IPs, VLAN tags, and valid checksums in tshark
tshark -r sanitized_ticket.pcap -V
You need to confirm that your monitoring server decodes encrypted SNMPv3 SHA-256/AES traps and pages the on-call tech without unplugging a production switch or fighting Net-SNMP USM flags.
What this script builds: Generates an encrypted SNMPv3 USM authPriv linkDown trap followed 10 seconds later by a linkUp recovery trap with interface OID varbinds.
How to customize: Define the router and trap collector IPs in host blocks. Set your SNMPv3 user, hex engineid, sha256 auth password, and aes priv password.
# Compile the SNMPv3 authPriv trap capture
frameassembly snmpv3_trap_test.fasm -o snmpv3_trap_test.pcap
# Inspect SNMPv3 USM EngineID, Username, and Auth/Priv parameters in tshark
tshark -r snmpv3_trap_test.pcap -Y "snmp" -V
# Replay the encrypted traps toward your NMS / trap receiver on eth0
sudo tcpreplay -i eth0 snmpv3_trap_test.pcap
Firewall & ACLs·firewall_acl_test.fasm·Solves: firewall acl test pcap · stateful tcp handshake pcap · test palo alto fortigate nftables acl · craft tcp syn rst ack pcap
Create PCAP for Stateful Firewall ACL Testing (Allowed HTTPS vs. Blocked SSH)
You updated a perimeter firewall policy and need a deterministic packet capture showing allowed HTTPS (443) traffic with a valid TCP 3-way handshake alongside blocked SSH (22) attempts.
What this script builds: Models the stateful TCP 443 handshake + TLS ClientHello SNI and the rejected TCP 22 syn -> rst ack in 10 lines.
How to customize: Define the outside tester and DMZ web server. Send an allowed TCP 443 handshake and TLS hello, followed by a blocked port 22 probe.
# Compile the stateful firewall ACL audit capture
frameassembly firewall_acl_test.fasm -o firewall_acl_test.pcap
# Verify TCP 3-way handshake sequence numbers, TLS SNI, and RST ACK in tshark
tshark -r firewall_acl_test.pcap
# Replay into your firewall test interface or SPAN port
sudo tcpreplay -i eth0 firewall_acl_test.pcap
Pentest & SecOps·ids_scan_test.fasm·Solves: generate pcap for suricata · test snort signature pcap · zeek pcap generator · craft fragmented packet port scan pcap
Generate PCAP for Suricata, Snort & Zeek IDS Signature Validation
Detection engineering needs a zero-noise .pcap to verify that Suricata, Snort, or Zeek triggers alerts on suspicious DNS queries, custom TLS SNI handshakes, rapid SYN scans, and fragmented UDP packets.
What this script builds: Combines a DNS query/response, a stateful TCP + TLS ClientHello SNI flow, rapid SYN probes across ports 21/22/80, and a 2-part fragmented UDP packet.
How to customize: Define the scanner and target IPs. Customize dns qname, tls sni, tcp syn ports, or ipid / mf / fragoffset.
You are turning up a Metro Ethernet circuit or campus QoS policy and need a test capture with 802.1Q VLAN priority (PCP 5, DSCP 46) plus outer S-VLAN 2000, inner C-VLAN 150, and MPLS label 40960.
What this script builds: Emits a voice VLAN RTP frame (VLAN 110, PCP 5, DSCP 46) followed by double-tagged qinq 2000 inner_vlan 150 and mpls 40960 frames.
How to customize: Define the branch CPE and HQ gateway. Add vlan, pcp, dscp, qinq, inner_vlan, and mpls tags before the protocol keyword.
You need a safe, synthetic industrial OT capture to verify that your OT firewall permits SCADA register reads while blocking unauthorized Modbus writes or DNP3 breaker operate commands.
What this script builds: Completes a TCP port 502 handshake for Modbus register read/write checks, followed by S7comm DB reads, DNP3 Select/Operate with automatic CRC-16, BACnet, EtherNet/IP, and OPC UA frames.
How to customize: Define the SCADA HMI workstation and PLC controller. Run a TCP handshake on port 502 followed by modbus, s7comm, dnp3, bacnet, ethernetip, or opcua statements.
# Compile the Industrial OT / SCADA conduit capture
frameassembly scada_modbus.fasm -o scada_modbus.pcap
# Inspect Modbus function codes, DNP3 CRC-16 frames, and BACnet properties in tshark
tshark -r scada_modbus.pcap
# Replay across your OT zone firewall or passive ICS sensor SPAN port
sudo tcpreplay -i eth1 scada_modbus.pcap
Need exact keyword syntax for any of the 81 supported L2–L7 protocols?
Explore the complete 14-chapter Protocol Handbook with live WASM execution on every code block.
High-Intent Packet Engineering Reference
Common Packet Engineering & PCAP Questions (FAQ)
Direct solutions for editing and sanitizing .pcap captures, simulating SNMPv1/v2c/v3 traps, testing Suricata/Snort IDS and firewall ACLs, tagging 802.1Q VLAN / QinQ / MPLS trunks, and generating Modbus, DNP3, and S7comm industrial OT traffic.
How do I edit an IP address, MAC address, or VLAN tag in an existing .pcap file?
Decompile the capture into human-readable .fasm code with frameassembly reverse capture.pcap -o editable.fasm (or click Import .pcap in the FrameAssembly Playground). Edit the IPv4/IPv6 addresses in the host blocks or change the vlan/qinq/port fields on any packet line, then recompile with frameassembly editable.fasm -o edited.pcap. FrameAssembly recalculates all IPv4, TCP, UDP, ICMP, and SCTP checksums and TCP sequence numbers automatically.
Step 1 · Decompile existing .pcap into editable .fasm code
How do I sanitize or anonymize a production .pcap file before sending it to vendor TAC?
Run frameassembly reverse incident.pcap -o sanitized.fasm, replace internal production IPs with RFC 5737 documentation addresses (192.0.2.0/24 or 198.51.100.0/24), scrub sensitive TLS SNI hostnames or RADIUS/HTTP usernames, delete unrelated background frames, and recompile to a clean .pcap file.
Step 1 · Decompile production .pcap into .fasm code
How do I generate a custom .pcap with a valid TCP 3-way handshake for Suricata, Snort, or Zeek rule testing?
Start your flow with c -> s tcp syn, c <- s tcp syn ack, and c -> s tcp ack, then add Layer 7 statements like http, tls client_hello sni, dns, or smb. FrameAssembly tracks 4-tuple TCP SEQ/ACK progression and swaps reply ports automatically so stateful IDS engines and firewalls inspect the stream without dropping packets as mid-stream anomalies.
Step 1 · Compile the stateful TCP + Layer 7 stream to .pcap
Step 2 · Run Suricata offline against the generated capture
$suricata -r suricata_test.pcap -k none
faq_suricata_stream.fasm· Stateful TCP 3-Way Handshake + HTTP/TLS for Suricata
1hostclient{ip10.40.5.25}
2hostserver{ip10.40.5.80}
3
4flowids_stream(c, s){
5 c -> s tcpsynsrcport52080dstport80win65535mss1460wait1ms
6 c <- s tcpsynackwin65535mss1460wait1ms
7 c -> s tcpackwait1ms
8 c -> s httpgeturi"/cgi-bin/test"host_hdr"target.local" user_agent "IDS-Test/1.0"wait2ms
9 c <- s httpstatus200reason"OK"body"OK"
10}
11
12compile{
13ids_stream(client, server)
14}
How do I craft 802.1Q VLAN, 802.1ad QinQ double-tagged, MPLS, or DSCP QoS packet captures without root?
Add vlan 100 pcp 5, qinq 2000 inner_vlan 150, mpls 40960 exp 5, or dscp 46 directly before the protocol keyword on any .fasm packet statement. Because FrameAssembly writes Ethernet frames directly into the .pcap file in user space, OS network drivers cannot strip VLAN tags or block unprivileged headers.
Step 1 · Compile the VLAN / QinQ / MPLS / DSCP specification to .pcap
$frameassembly trunk_tags.fasm -o trunk_tags.pcap
Step 2 · Inspect VLAN IDs, MPLS labels, and DSCP markings in tshark
6 edge_sw -> core_pe qinq2000inner_vlan110mpls24010exp5bos1mpls_ttl64icmpecho_request id 1seq1
7}
How do I simulate Modbus TCP, DNP3, S7comm, BACnet, EtherNet/IP, or OPC UA traffic for OT firewall testing?
Complete a 3-way TCP handshake on the industrial port (such as port 502 for Modbus, 20000 for DNP3, 102 for S7comm, or 4840 for OPC UA) and add modbus, dnp3, s7comm, bacnet, ethernetip, or opcua statements. FrameAssembly automatically computes IEEE 1815 DNP3 CRC-16 checksums and TCP sequence numbers.
Step 1 · Compile the Industrial OT / SCADA conduit capture to .pcap
$frameassembly ot_conduit.fasm -o ot_conduit.pcap
Step 2 · Inspect the generated OT frames in tshark
$tshark -r ot_conduit.pcap
faq_ot_modbus_dnp3.fasm· Modbus TCP, S7comm & DNP3 OT Conduit Check
1hosthmi{ip192.168.100.10}
2hostplc{ip192.168.100.50}
3
4flowot_check(a, b){
5 a -> b tcpsynsrcport50200dstport502wait1ms
6 a <- b tcpsynackwait1ms
7 a -> b tcpackwait1ms
8 a -> b modbus read_holding_registers txid1unitid1addr40001count2wait2ms
9 a <- b modbus read_holding_registers txid1unitid1count2is_responsewait2ms
10 a -> b transport udpdnp3 read src 1 dst 10 group 60 variation 1