FrameAssembly
FrameAssembly v1.5.181 Protocols (L2–L7)PCAP Compiler & Decompiler

FrameAssembly Guide: Create, Edit & Simulate .pcap Captures

Edit or sanitize existing .pcap files, simulate SNMPv1/v2c/v3 traps, test Suricata/Snort IDS and firewall ACLs, craft 802.1Q VLAN / QinQ / MPLS QoS trunks, and generate Modbus, DNP3, and S7comm OT captures.

Jump to Problem or Protocol:

The 3 Building Blocks (Create or Edit Any .pcap Without Coding)

If you can read a network diagram or a Wireshark capture, you already know how to build, edit, or sanitize packets in FrameAssembly.

Block 1 · host

Name or rewrite network endpoints

Give each device a name and an IPv4 or IPv6 address. MAC addresses are optional—and you can paste Linux colons, Windows hyphens, or Cisco 001a.2b3c.4d5e.

host laptop { ip 192.168.1.10 }
host router { ip 192.168.1.1 }
Block 2 · flow

Write 1 line per wire frame

Use -> to send a packet and <- to send a reply back. FrameAssembly calculates TCP sequence numbers, L3/L4 checksums, and flips reply ports automatically.

flow ping_test(a, b) {
    a -> b icmp echo_request wait 1ms
    a <- b icmp echo_reply   wait 1ms
}
Block 3 · compile / reverse

Compile .fasm or decompile .pcap

Plug your device names into compile—or decompile an existing .pcap with frameassembly reverse to edit IPs, VLANs, and payloads.

compile {
    ping_test(laptop, router)
}

Wireshark Display Filter -> FrameAssembly Cheat Sheet

Already know how to filter traffic in Wireshark? Here is how those exact packet fields translate to FrameAssembly:

Networking TaskWireshark Filter You KnowWhat You Write in FrameAssemblyTry It Live
802.1Q VLAN Tag & Priority (PCP)vlan.id == 100 && vlan.priority == 5vlan 100 pcp 5 dei 0
802.1ad QinQ Double VLAN Tagvlan.id == 2000 && vlan.id == 150qinq 2000 inner_vlan 150
DiffServ QoS (DSCP EF Voice) & TTLip.dsfield.dscp == 46 && ip.ttl == 64dscp 46 ecn 0 ttl 64
TCP Ports, Flags & Sequence Numberstcp.dstport == 443 && tcp.flags.syn == 1tcp syn srcport 51234 dstport 443 win 65535
IPv4 Don’t Fragment (DF) or Fragmentationip.flags.mf == 1 || ip.frag_offset > 0ipid 4421 mf fragoffset 0
SNMP Poll / Trap OIDs (sysName / linkDown)snmp.name == 1.3.6.1.2.1.1.5.0varbind 1.3.6.1.2.1.1.5.0 string "sw-01"

Coming From tcprewrite, Scapy, snmptrap, or TraceWrangler? Legacy Tools vs. FrameAssembly

How FrameAssembly replaces complex CLI flags, root raw-socket scripts, and manual hex offsets for high-intent packet engineering tasks:

High-Intent ProblemLegacy Tool & FrictionFrameAssembly WorkflowTry It Live
Edit IP, MAC, or VLAN Tag in Existing .pcaptcprewrite --infile=in.pcap --outfile=out.pcap --srcipmap=192.168.1.0/24:10.0.0.0/24 --enet-vlan=add --enet-vlan-tag=100 --fixcsum1. frameassembly reverse in.pcap -o edit.fasm 2. Edit host IPs / vlan tags in edit.fasm, then run: frameassembly edit.fasm -o out.pcap
Inspect and edit every Layer 2–7 header as readable text; recalculates L3/L4 checksums and TCP SEQ/ACK numbers automatically.
Sanitize & Anonymize Production .pcap for Vendor TACTraceWrangler GUI / editcap -s 64 prod.pcap sliced.pcap (loses Layer 7 bug context)1. frameassembly reverse prod.pcap -o sanitized.fasm 2. Scrub internal IPs & SNI/usernames in sanitized.fasm, then run: frameassembly sanitized.fasm -o tac_clean.pcap
Preserves the exact Layer 7 protocol failure (RADIUS, TLS SNI, HTTP, BGP) while removing customer PII and background noise.
Simulate Encrypted SNMPv3 authPriv Trap (SHA-256 + AES)snmptrap -v 3 -e 0x80001f8801 -u netops -l authPriv -a SHA-256 -A "AuthPass!" -x AES -X "PrivPass!" 10.10.1.50 3600 1.3.6.1.6.3.1.1.5.3sw -> nms snmp3 trap user "netops" engineid "80001f8801" auth sha256 "..." priv aes "..." oid 1.3.6.1.6.3.1.1.5.3
Zero MIB file hunting or Net-SNMP daemon setup. Computes RFC 3414/3826/7860 USM key localization and AES-128 encryption offline.
Generate Stateful TCP + L7 PCAP for Suricata / Snort IDSPython Scapy script with manual seq=1000, ack=1001, len(payload) byte math + wrpcap()c -> s tcp syn / c <- s tcp syn ack / c -> s tcp ack / c -> s http post uri "/admin"
Tracks 4-tuple TCP SEQ/ACK progression and swaps reply ports on <- automatically so Suricata stream engines never drop mid-stream packets.
Build 802.1Q VLAN, 802.1ad QinQ & MPLS Tagged Capturestext2pcap raw hex byte dumps or root raw sockets stripped by desktop OS NIC driverscpe -> pe qinq 2000 inner_vlan 150 mpls 40960 exp 5 dscp 46 ...
Writes Ethernet II, 802.1Q, 802.1ad QinQ, and MPLS shim headers directly into the .pcap file in user space without root.
Simulate Modbus TCP, DNP3, S7comm & OPC UA for OT FirewallsPhysical PLC testbench or custom C++ / Python industrial protocol encodershmi -> plc modbus read_holding_registers ... / dnp3 select ... / s7comm read_var ...
Natively encodes all 6 industrial OT protocols—including automatic IEEE 1815 DNP3 CRC-16 calculation—over stateful TCP.
Step 1 · 1 min read

How FrameAssembly Works (Create & Edit .pcap Files)

Create new .pcap packet captures or edit existing captures using standard networking terms.

  • ✓ No Python virtual environments, loops, or hex math needed.
  • ✓ 1 line of code equals 1 packet in Wireshark.
  • ✓ MAC addresses, ports, checksums, and TCP sequence numbers are filled in automatically.

Why Use FrameAssembly Code Instead of Scapy, tcprewrite, or Lab Gear?

When you need to edit an existing .pcap file, test a firewall rule, simulate an SNMPv3 trap, or check a VLAN trunk, you shouldn’t have to fight Python scripts, arcane tcprewrite flags, or spare hardware routers.

In FrameAssembly, you simply list your devices and write the packets sent between them—or decompile an existing .pcap into .fasm text, edit any IP/VLAN/payload field, and recompile.

Clean Lowercase Syntax & Zero Boilerplate

Write keywords in lowercase (host, flow, compile, tcp, snmp3). Any optional field you leave out is automatically filled with standard RFC defaults.

Starter Example: Web Check + SNMP Alert

Every file has 3 parts: host (name your devices), flow (list the packets), and compile (build the capture).

demo_showcase.fasm
// 1. Name the devices on your network
host client { ip 10.0.10.50 }
host server { ip 10.0.10.80 }
host nms    { ip 10.0.10.100 }
// 2. List the packets (1 line = 1 packet)
flow web_check(c, s) {
    c -> s tcp syn srcport 51234 dstport 80 wait 1ms
    c <- s tcp syn ack wait 1ms
    c -> s tcp ack wait 1ms
    c -> s http get uri "/health" wait 2ms
    c <- s http status 200 body "OK" wait 1ms
}
flow snmp_alert(srv, collector) {
    srv -> collector snmp2 trap community "public" wait 2ms
}
// 3. Build the .pcap capture
compile {
    web_check(client, server)
    snmp_alert(server, nms)
}
Step 2 · 2 min read

The 3 Building Blocks: host, flow, compile

Every FrameAssembly file follows the same three-step layout.

  • ✓ host gives a device a name, an IPv4/IPv6 address, and an optional MAC (colon, hyphen, or Cisco dotted-quad).
  • ✓ flow lists the packets sent between devices using -> and <- arrows.
  • ✓ compile runs your flows to build the final .pcapng file.

1. host — Name Your Devices (Any MAC Format or MAC-Only L2)

Write host <name> { ip <address> } for each device (or host sw1 { mac 00:1c:73:00:00:01 } for MAC-only Layer 2 switches). FrameAssembly v1.5.1 accepts IPv4 or IPv6 addresses and Linux colons (00:1a:2b:3c:4d:5e), Windows hyphens (00-1A-2B-3C-4D-5E), or Cisco dotted-quad format (001a.2b3c.4d5e).

Keep host Blocks Simple & Use // Comments

Write host router { ip 192.168.1.1 mac 001a.2b3c.4d5e } — do not put equals signs (=), colons (:), or /24 subnet masks inside a host block, and always start comments with //.

2. flow & compile — Send Packets

Inside a flow block, each line sends one packet. Then list the flow inside compile to generate the capture.

ping_two_routers.fasm
// 1. Devices (supports colon, hyphen, or Cisco dotted-quad MACs)
host laptop    { ip 192.168.10.25 mac 00-1A-2B-3C-4D-25 }
host branch_gw { ip 192.168.10.1  mac 001a.2b3c.4d01 }
host core_rtr  { ip 10.255.0.1 }
// 2. Packet sequence
flow ping_check(src, dst) {
    src -> dst icmp echo_request id 100 seq 1 wait 2ms
    src <- dst icmp echo_reply   id 100 seq 1 wait 2ms
}
// 3. Build capture
compile {
    ping_check(laptop, branch_gw)
    ping_check(branch_gw, core_rtr)
}
Step 3 · 2 min read

Stateful TCP Handshakes for Firewalls & Suricata IDS

Keep your client on the left and let FrameAssembly handle TCP sequence numbers.

  • ✓ a -> b sends a packet from a to b.
  • ✓ a <- b sends a reply from b back to a.
  • ✓ wait 1ms (or us, s) spaces out packet timestamps in Wireshark.
  • ✓ TCP ports and sequence numbers are tracked automatically after the first syn.

Automatic TCP Handshakes & Replies (No Sequence Math)

Stateful firewalls (Palo Alto, FortiGate, nftables) and IDS engines (Suricata, Snort, Zeek) ignore single spoofed Layer 7 packets unless they follow a valid 3-way TCP handshake. Set srcport and dstport on your first tcp syn packet—FrameAssembly swaps reply ports on <- and advances SEQ/ACK numbers by exact payload lengths automatically.

tcp_session.fasm
host workstation { ip 10.20.30.40 }
host app_gateway { ip 10.20.30.100 }
flow tcp_session(c, s) {
    c -> s tcp syn srcport 51234 dstport 8080 wait 1ms
    c <- s tcp syn ack wait 1ms
    c -> s tcp ack wait 1ms
    c -> s tcp psh ack payload "HELLO_SERVER" wait 2ms
    c <- s tcp psh ack payload "HELLO_CLIENT" wait 2ms
    c -> s tcp fin ack wait 1ms
    c <- s tcp fin ack wait 1ms
    c -> s tcp ack wait 1ms
}
compile {
    tcp_session(workstation, app_gateway)
}
Step 4 · 2 min read

Craft 802.1Q VLAN, 802.1ad QinQ, MPLS & DSCP QoS Captures

Add VLAN tags, double-tagged S-VLAN/C-VLAN headers, MPLS labels, and DSCP markings without root.

  • ✓ Add vlan <1..4094> pcp <0..7> or qinq <s_vid> inner_vlan <c_vid> on any line.
  • ✓ Add mpls <label> exp <0..7> and dscp <0..63> to test WAN shapers and QoS queues.
  • ✓ Use arp, lldp, stp, lacp, and eapol to test Layer 2 switching.

Tagging Packets with VLANs, QinQ & DiffServ QoS

Desktop OS network interfaces strip 802.1Q tags and block unprivileged QinQ or MPLS headers. In FrameAssembly, place vlan 100 pcp 5, qinq 2000 inner_vlan 150, or dscp 46 right before the protocol name on any line to write the exact Ethernet header into your .pcap.

vlan_and_arp.fasm
host access_sw { ip 10.100.1.10 }
host dist_sw   { ip 10.100.1.1 }
flow arp_and_vlans(acc, dist) {
    acc -> dist arp request wait 1ms
    acc <- dist arp reply   wait 1ms
    acc -> dist vlan 100 pcp 5 dscp 46 rtp pt 0 seq 1 timestamp 160 payload "VOICE_EF" wait 1ms
    acc -> dist qinq 2000 inner_vlan 200 mpls 16000 exp 5 udp dstport 5004 payload "METRO_VIDEO" wait 1ms
}
compile {
    arp_and_vlans(access_sw, dist_sw)
}
Step 5 · 2 min read

Simulate SNMPv1/v2c/v3 Traps & NMS Alerts

Trigger Zabbix, SolarWinds, PRTG, LibreNMS, or snmptrapd alerts without pulling live cables.

  • ✓ Use snmp1, snmp2, or encrypted snmp3 (authPriv SHA-256 + AES-128) to build polls and traps.
  • ✓ Attach custom OID values with varbind <oid> string "core-sw-01" or int 2.
  • ✓ No Net-SNMP daemon setup, MIB hunting, or USM key localization math required.

Simulating SNMPv2c Polls and Encrypted SNMPv3 Traps

You can test SolarWinds, Zabbix, LibreNMS, PRTG, or Datadog alert rules offline by generating SNMPv2c or encrypted SNMPv3 USM authPriv traps with your exact EngineID and OIDs.

snmp_monitoring.fasm
host core_switch { ip 10.10.0.10 }
host noc_server  { ip 10.10.0.250 }
flow snmp_test(sw, noc) {
    noc -> sw snmp2 get community "public" reqid 10
        varbind 1.3.6.1.2.1.1.5.0 nullval wait 2ms
    noc <- sw snmp2 response community "public" reqid 10
        varbind 1.3.6.1.2.1.1.5.0 string "core-sw-01" wait 2ms
    sw -> noc snmp3 trap user "noc_admin" engineid "80001f88"
        auth sha256 "AuthPass123!" priv aes "PrivPass123!"
        oid 1.3.6.1.6.3.1.1.5.3 wait 5ms
}
compile {
    snmp_test(core_switch, noc_server)
}
Step 6 · 2 min read

How to Edit, Rewrite IP/MAC, or Sanitize an Existing .pcap File

Decompile any .pcap or .pcapng into .fasm text, edit headers or scrub customer IPs, and recompile.

  • ✓ Run frameassembly reverse capture.pcap -o editable.fasm (or click Import .pcap in the Playground).
  • ✓ Change any IPv4/IPv6 address, MAC, VLAN tag, TCP/UDP port, TLS SNI, or payload in plain text.
  • ✓ Recompile to .pcap/.pcapng with automatic IPv4/TCP/UDP checksums and TCP SEQ/ACK recalculation.

Edit Existing .pcap Files Without tcprewrite or Hex Editors

Need to change IP addresses in a packet capture before replaying with tcpreplay, add an 802.1Q VLAN tag, or sanitize sensitive customer IPs and hostnames before attaching a trace to a vendor TAC ticket?

Instead of chaining tcprewrite flags or slicing payloads with editcap, decompile the .pcap into .fasm code. You can edit the discovered host blocks, modify any packet line, delete background noise, and recompile a clean capture with valid checksums.

Browser Import .pcap or CLI frameassembly reverse

In the FrameAssembly Playground (/playground), click "Import .pcap" to decompile any .pcap or .pcapng file directly in your browser using WebAssembly—zero files are uploaded to a server.

Example: Decompiled & Sanitized Capture Ready to Recompile

Below is the output of frameassembly reverse after replacing internal customer IPs with RFC 5737 documentation addresses (192.0.2.10 and 198.51.100.20) and tagging the flow on VLAN 100:

edited_capture.fasm
// 1. Decompiled host endpoints (edited to RFC 5737 documentation IPs)
host host_1 { ip 192.0.2.10    mac 00:11:22:33:44:01 }
host host_2 { ip 198.51.100.20 mac 00:11:22:33:44:02 }
// 2. Edited packet sequence (added vlan 100 tag and scrubbed TLS SNI)
compile {
    host_1 -> host_2 vlan 100 tcp syn srcport 54321 dstport 443 win 64240 mss 1460 wait 1ms
    host_1 <- host_2 vlan 100 tcp syn ack win 64240 mss 1460 wait 1ms
    host_1 -> host_2 vlan 100 tcp ack wait 1ms
    host_1 -> host_2 vlan 100 tls client_hello sni "sanitized-portal.example.com" ciphersuite 4865 alpn "h2" wait 2ms
    host_1 <- host_2 vlan 100 tcp rst ack wait 1ms
}
Step 7 · 2 min read

Simulate Modbus, DNP3, S7comm & Industrial OT Protocols

Validate Purdue Level 1–3.5 OT firewalls and SCADA IDS rules without physical PLCs.

  • ✓ Natively compiles all 6 core industrial OT protocols: modbus, dnp3, s7comm, bacnet, ethernetip, and opcua.
  • ✓ Automatically computes IEEE 1815 DNP3 CRC-16 checksums across headers and data chunks.
  • ✓ Test read-only vs. write/operate OT firewall policies safely offline.

Safe Offline OT / ICS Packet Generation

Industrial firewalls (Claroty, Dragos, Nozomi, Palo Alto / Fortinet OT profiles) often permit SCADA read polls while blocking register writes or breaker operate commands. FrameAssembly lets you synthesize complete Modbus TCP, DNP3, S7comm, BACnet/IP, EtherNet/IP, and OPC UA sessions in seconds.

ot_firewall_test.fasm
host scada_hmi { ip 10.80.20.10 }
host plant_plc { ip 10.80.10.50 }
flow ot_policy_check(hmi, plc) {
    hmi -> plc tcp syn srcport 50200 dstport 502 wait 1ms
    hmi <- plc tcp syn ack wait 1ms
    hmi -> plc tcp ack wait 1ms
    hmi -> plc modbus read_holding_registers txid 101 unitid 1 addr 40001 count 4 wait 2ms
    hmi <- plc modbus read_holding_registers txid 101 unitid 1 count 4 is_response wait 5ms
    hmi -> plc modbus write_single_register txid 102 unitid 1 addr 40001 value 1500 wait 5ms
    hmi -> plc transport udp dnp3 select src 1 dst 10 group 12 variation 1 wait 2ms
    hmi -> plc transport udp dnp3 operate src 1 dst 10 group 12 variation 1 wait 2ms
}
compile {
    ot_policy_check(scada_hmi, plant_plc)
}

Network & Security Use Cases (Edit PCAPs, SNMPv3, Shadow IT & Firewalls)

Pick a real-world problem below and click Open in Playground to customize IP addresses, VLANs, ports, or SNMP OIDs—or copy the companion CLI commands for tshark, tcpreplay, and suricata.

Edit & Sanitize PCAPtac_sanitized_radius.fasmSolves: edit pcap file · modify ip address in pcap · sanitize pcap for vendor tac · rewrite vlan in pcap · tcprewrite / TraceWrangler alternative

Edit IP/MAC/VLAN Headers & Sanitize Existing .pcap Files (frameassembly reverse)

You have an existing .pcap capture from tcpdump or Wireshark, and you need to rewrite IP addresses for lab replay, inject an 802.1Q VLAN tag, or scrub internal customer IPs and hostnames before attaching it to a vendor TAC ticket.

Dedicated Page
What this script builds: Decompiles the binary .pcap into readable .fasm code via frameassembly reverse (or Playground Import .pcap), edits the host IP/MAC blocks and L2–L7 fields, and recompiles with automatic checksum and TCP sequence recalculation.
How to customize: Run frameassembly reverse incident.pcap -o sanitized.fasm (or click Import .pcap in the Playground). Edit the host IPs (e.g. RFC 5737 192.0.2.x), MACs, VLAN tags, or RADIUS/TLS strings, then recompile.
host branch_gw { ip 192.0.2.1     mac 0011.22aa.bb01 }
host auth_srv  { ip 198.51.100.10 mac 0011.22cc.dd10 }
flow tac_sanitized_radius(gw, srv) {
    gw -> srv vlan 100 radius access_request id 10 user "redacted_user" nas_ip 192.0.2.1 wait 10ms
    gw <- srv vlan 100 radius access_accept  id 10 wait 5ms
    gw -> srv vlan 100 syslog facility 1 severity 6 hostname "branch-gw" app "tacacs" msg "User authenticated via 802.1X" wait 2ms
}
compile {
    tac_sanitized_radius(branch_gw, auth_srv)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# 1. Decompile any existing .pcap or .pcapng into editable .fasm code
frameassembly reverse production_incident.pcap -o tac_sanitized_radius.fasm

# 2. After editing IPs, VLANs, or strings in .fasm, preview and recompile to .pcap
frameassembly show tac_sanitized_radius.fasm
frameassembly tac_sanitized_radius.fasm -o sanitized_ticket.pcap

# 3. Verify updated IPs, VLAN tags, and valid checksums in tshark
tshark -r sanitized_ticket.pcap -V
SNMP & Monitoringsnmpv3_trap_test.fasmSolves: simulate snmp trap · snmpv3 trap generator · test zabbix solarwinds prtg snmpv3 authpriv · generate linkDown trap pcap

Simulate SNMPv2c & Encrypted SNMPv3 Trap Alerts (linkDown & linkUp)

You need to confirm that your monitoring server decodes encrypted SNMPv3 SHA-256/AES traps and pages the on-call tech without unplugging a production switch or fighting Net-SNMP USM flags.

Dedicated Page
What this script builds: Generates an encrypted SNMPv3 USM authPriv linkDown trap followed 10 seconds later by a linkUp recovery trap with interface OID varbinds.
How to customize: Define the router and trap collector IPs in host blocks. Set your SNMPv3 user, hex engineid, sha256 auth password, and aes priv password.
host router { ip 10.250.1.1 }
host nms    { ip 10.250.100.50 }
flow link_flap_traps(rtr, srv) {
    rtr -> srv snmp3 trap user "noc_trap" engineid "8000000903"
        auth sha256 "AuthKey99!" priv aes "PrivKey99!"
        oid 1.3.6.1.6.3.1.1.5.3
        varbind 1.3.6.1.2.1.1.5.0 string "edge-rtr-01"
        varbind 1.3.6.1.2.1.2.2.1.8.1 int 2 wait 10s
    rtr -> srv snmp3 trap user "noc_trap" engineid "8000000903"
        auth sha256 "AuthKey99!" priv aes "PrivKey99!"
        oid 1.3.6.1.6.3.1.1.5.4
        varbind 1.3.6.1.2.1.1.5.0 string "edge-rtr-01"
        varbind 1.3.6.1.2.1.2.2.1.8.1 int 1 wait 5ms
}
compile {
    link_flap_traps(router, nms)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# Compile the SNMPv3 authPriv trap capture
frameassembly snmpv3_trap_test.fasm -o snmpv3_trap_test.pcap

# Inspect SNMPv3 USM EngineID, Username, and Auth/Priv parameters in tshark
tshark -r snmpv3_trap_test.pcap -Y "snmp" -V

# Replay the encrypted traps toward your NMS / trap receiver on eth0
sudo tcpreplay -i eth0 snmpv3_trap_test.pcap
Shadow IT & Monitoringshadow_it_detection.fasmSolves: shadow it detection pcap · test tls sni monitoring rule · unmanaged saas dns query pcap · rogue device mdns ssdp discovery pcap

Test Shadow IT & Rogue Device Detection (Unmanaged SaaS DNS, TLS SNI & mDNS)

You built or deployed a network monitoring / Shadow IT detection pipeline and need a clean, repeatable .pcap to verify that it catches employees connecting to unapproved SaaS or AI endpoints (via DNS or direct TLS SNI) and rogue NAS/IoT gear announcing over mDNS and SSDP.

Dedicated Page
What this script builds: Combines an unauthorized SaaS DNS A-record lookup, a full stateful TCP 443 handshake + TLS ClientHello SNI to an unmanaged AI service, and multicast mDNS / SSDP discovery broadcasts.
How to customize: Replace qname and tls client_hello sni with the exact SaaS, AI, or file-sharing domains on your watchlist. Compile to .pcap and replay into your monitoring SPAN port or run offline against Zeek / Suricata.
host employee_pc { ip 10.30.15.42 }
host corp_gw     { ip 10.30.15.1 }
host mdns_group  { ip 224.0.0.251 }
host ssdp_group  { ip 239.255.255.250 }
flow unmanaged_saas_and_ai(ws, gw) {
    ws -> gw dns query txid 0x7101 qname "personal-cloud-sync.example.io" qtype "A" wait 1ms
    ws <- gw dns response txid 0x7101 qname "personal-cloud-sync.example.io" qtype "A" rdata "198.51.100.77" wait 1ms
    ws -> gw tcp syn srcport 53443 dstport 443 win 65535 mss 1460 wait 1ms
    ws <- gw tcp syn ack win 65535 mss 1460 wait 1ms
    ws -> gw tcp ack wait 1ms
    ws -> gw tls client_hello sni "unmanaged-ai-assistant.example.io" ciphersuite 4865 alpn "h2" wait 2ms
}
flow rogue_device_discovery(ws, mcast_dns, mcast_upnp) {
    ws -> mcast_dns mdns query qname "rogue-office-nas.local" qtype "A" wait 2ms
    ws -> mcast_upnp ssdp msearch st "ssdp:all" mx 3 wait 2ms
}
compile {
    unmanaged_saas_and_ai(employee_pc, corp_gw)
    rogue_device_discovery(employee_pc, mdns_group, ssdp_group)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# 1. Compile the Shadow IT & rogue device test capture
frameassembly shadow_it_detection.fasm -o shadow_it_detection.pcap

# 2. Verify DNS qname, TLS SNI hostname, and mDNS/SSDP discovery fields in tshark
tshark -r shadow_it_detection.pcap -T fields -e frame.number -e ip.src -e dns.qry.name -e tls.handshake.extensions_server_name

# 3. Replay into your monitoring sensor SPAN/TAP interface or evaluate in Zeek
sudo tcpreplay -i eth0 shadow_it_detection.pcap
zeek -C -r shadow_it_detection.pcap
Firewall & ACLsfirewall_acl_test.fasmSolves: firewall acl test pcap · stateful tcp handshake pcap · test palo alto fortigate nftables acl · craft tcp syn rst ack pcap

Create PCAP for Stateful Firewall ACL Testing (Allowed HTTPS vs. Blocked SSH)

You updated a perimeter firewall policy and need a deterministic packet capture showing allowed HTTPS (443) traffic with a valid TCP 3-way handshake alongside blocked SSH (22) attempts.

Dedicated Page
What this script builds: Models the stateful TCP 443 handshake + TLS ClientHello SNI and the rejected TCP 22 syn -> rst ack in 10 lines.
How to customize: Define the outside tester and DMZ web server. Send an allowed TCP 443 handshake and TLS hello, followed by a blocked port 22 probe.
host outside_tester { ip 203.0.113.45 }
host dmz_web_server { ip 198.51.100.80 }
flow allow_https(ext, dmz) {
    ext -> dmz tcp syn srcport 52100 dstport 443 wait 1ms
    ext <- dmz tcp syn ack wait 1ms
    ext -> dmz tcp ack wait 1ms
    ext -> dmz tls client_hello sni "portal.local" wait 2ms
}
flow block_ssh(ext, dmz) {
    ext -> dmz tcp syn srcport 52101 dstport 22 wait 1ms
    ext <- dmz tcp rst ack wait 1ms
}
compile {
    allow_https(outside_tester, dmz_web_server)
    block_ssh(outside_tester, dmz_web_server)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# Compile the stateful firewall ACL audit capture
frameassembly firewall_acl_test.fasm -o firewall_acl_test.pcap

# Verify TCP 3-way handshake sequence numbers, TLS SNI, and RST ACK in tshark
tshark -r firewall_acl_test.pcap

# Replay into your firewall test interface or SPAN port
sudo tcpreplay -i eth0 firewall_acl_test.pcap
Pentest & SecOpsids_scan_test.fasmSolves: generate pcap for suricata · test snort signature pcap · zeek pcap generator · craft fragmented packet port scan pcap

Generate PCAP for Suricata, Snort & Zeek IDS Signature Validation

Detection engineering needs a zero-noise .pcap to verify that Suricata, Snort, or Zeek triggers alerts on suspicious DNS queries, custom TLS SNI handshakes, rapid SYN scans, and fragmented UDP packets.

Dedicated Page
What this script builds: Combines a DNS query/response, a stateful TCP + TLS ClientHello SNI flow, rapid SYN probes across ports 21/22/80, and a 2-part fragmented UDP packet.
How to customize: Define the scanner and target IPs. Customize dns qname, tls sni, tcp syn ports, or ipid / mf / fragoffset.
host scanner { ip 172.18.99.10 }
host target  { ip 172.18.10.50 }
flow dns_and_tls_check(src, dst) {
    src -> dst dns query txid 0x4401 qname "c2-beacon.bad-domain.test" qtype "A" wait 1ms
    src <- dst dns response txid 0x4401 qname "c2-beacon.bad-domain.test" qtype "A" rcode 5 wait 2ms
    src -> dst tcp syn srcport 53443 dstport 443 win 65535 mss 1460 wait 1ms
    src <- dst tcp syn ack win 65535 mss 1460 wait 1ms
    src -> dst tcp ack wait 1ms
    src -> dst tls client_hello sni "shadow-upload.example.net" ciphersuite 4866 alpn "h2" wait 2ms
}
flow syn_scan_and_fragments(src, dst) {
    src -> dst tcp syn srcport 61001 dstport 21 wait 1ms
    src -> dst tcp syn srcport 61002 dstport 22 wait 1ms
    src -> dst tcp syn srcport 61003 dstport 80 wait 1ms
    src -> dst udp dstport 161 ipid 4421 mf fragoffset 0 wait 1ms
    src -> dst udp dstport 161 ipid 4421 fragoffset 185 wait 1ms
}
compile {
    dns_and_tls_check(scanner, target)
    syn_scan_and_fragments(scanner, target)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# Compile the IDS validation capture
frameassembly ids_scan_test.fasm -o ids_scan_test.pcap

# Run Suricata offline against the generated .pcap (writes eve.json / fast.log)
suricata -r ids_scan_test.pcap -k none -l ./suricata_out/

# Or run Zeek offline to generate dns.log, ssl.log, and conn.log
zeek -C -r ids_scan_test.pcap
Campus & VLANsqinq_mpls_trunk.fasmSolves: create vlan tagged pcap · 802.1ad qinq pcap example · mpls label pcap generator · dscp ef 46 voip rtp pcap

Craft 802.1Q VLAN, 802.1ad QinQ, MPLS & DiffServ DSCP QoS Captures

You are turning up a Metro Ethernet circuit or campus QoS policy and need a test capture with 802.1Q VLAN priority (PCP 5, DSCP 46) plus outer S-VLAN 2000, inner C-VLAN 150, and MPLS label 40960.

Dedicated Page
What this script builds: Emits a voice VLAN RTP frame (VLAN 110, PCP 5, DSCP 46) followed by double-tagged qinq 2000 inner_vlan 150 and mpls 40960 frames.
How to customize: Define the branch CPE and HQ gateway. Add vlan, pcp, dscp, qinq, inner_vlan, and mpls tags before the protocol keyword.
host branch_cpe { ip 10.220.1.10 }
host hq_gateway { ip 10.220.1.200 }
flow metro_trunk(cpe, hq) {
    cpe -> hq vlan 110 pcp 5 dei 0 dscp 46 rtp pt 0 seq 1 timestamp 160 payload "G711_VOICE_EF" wait 5ms
    cpe -> hq qinq 2000 inner_vlan 150 mpls 40960 exp 5 tls client_hello sni "wan.example.com" wait 5ms
    cpe <- hq qinq 2000 inner_vlan 150 mpls 40960 exp 5 tls server_hello wait 5ms
}
compile {
    metro_trunk(branch_cpe, hq_gateway)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# Compile the VLAN, QinQ, MPLS & DSCP QoS capture
frameassembly qinq_mpls_trunk.fasm -o qinq_mpls_trunk.pcap

# Verify VLAN IDs, 802.1p PCP priority, DSCP markings, and MPLS labels in tshark
tshark -r qinq_mpls_trunk.pcap -T fields -e frame.number -e vlan.id -e vlan.priority -e mpls.label -e ip.dsfield.dscp

# Replay onto your 802.1Q / 802.1ad trunk interface
sudo tcpreplay -i eth0 qinq_mpls_trunk.pcap
Industrial OTscada_modbus.fasmSolves: modbus tcp pcap generator · simulate dnp3 s7comm traffic · bacnet ethernetip opcua pcap · ot firewall conduit test pcap

Simulate Modbus TCP, DNP3, S7comm, BACnet, EtherNet/IP & OPC UA Conduits

You need a safe, synthetic industrial OT capture to verify that your OT firewall permits SCADA register reads while blocking unauthorized Modbus writes or DNP3 breaker operate commands.

Dedicated Page
What this script builds: Completes a TCP port 502 handshake for Modbus register read/write checks, followed by S7comm DB reads, DNP3 Select/Operate with automatic CRC-16, BACnet, EtherNet/IP, and OPC UA frames.
How to customize: Define the SCADA HMI workstation and PLC controller. Run a TCP handshake on port 502 followed by modbus, s7comm, dnp3, bacnet, ethernetip, or opcua statements.
host scada_hmi { ip 10.80.20.10 }
host plc_node  { ip 10.80.10.50 }
flow modbus_and_ot_poll(hmi, plc) {
    hmi -> plc tcp syn srcport 50200 dstport 502 wait 1ms
    hmi <- plc tcp syn ack wait 1ms
    hmi -> plc tcp ack wait 1ms
    hmi -> plc modbus read_holding_registers txid 101 unitid 1 addr 40001 count 4 wait 5ms
    hmi <- plc modbus read_holding_registers txid 101 unitid 1 count 4 is_response wait 5ms
    hmi -> plc modbus write_single_register txid 102 unitid 1 addr 40001 value 1500 wait 5ms
    hmi -> plc transport udp dnp3 select src 1 dst 10 group 12 variation 1 wait 2ms
    hmi -> plc transport udp dnp3 operate src 1 dst 10 group 12 variation 1 wait 2ms
    hmi -> plc bacnet read_property invoke_id 10 object_type 0 object_instance 1 property_id 85 wait 2ms
}
compile {
    modbus_and_ot_poll(scada_hmi, plc_node)
}
CLI Compile, Dissect & Replay / IDS Verification Commands
# Compile the Industrial OT / SCADA conduit capture
frameassembly scada_modbus.fasm -o scada_modbus.pcap

# Inspect Modbus function codes, DNP3 CRC-16 frames, and BACnet properties in tshark
tshark -r scada_modbus.pcap

# Replay across your OT zone firewall or passive ICS sensor SPAN port
sudo tcpreplay -i eth1 scada_modbus.pcap

Need exact keyword syntax for any of the 81 supported L2–L7 protocols?

Explore the complete 14-chapter Protocol Handbook with live WASM execution on every code block.

Open-Source Licensing

Frequently Asked Question

Can I use FrameAssembly commercially?

Yes. FrameAssembly is released under the permissive MIT License. You can use it free of charge in commercial environments, internal monitoring and firewall testing workflows, client consulting, and proprietary CI/CD pipelines with no royalties or copyleft restrictions—just preserve the copyright and license notice if you redistribute the software itself. Read the MIT License on GitHub ->