FrameAssembly
Firewall & ACLs · firewall_acl_test.fasmFrameAssembly v1.5.1

Create PCAP for Stateful Firewall ACL Testing (Allowed HTTPS vs. Blocked SSH)

You updated a perimeter firewall policy and need a deterministic packet capture showing allowed HTTPS (443) traffic with a valid TCP 3-way handshake alongside blocked SSH (22) attempts.

What This Capture Builds

Models the stateful TCP 443 handshake + TLS ClientHello SNI and the rejected TCP 22 syn -> rst ack in 10 lines.

How to Customize

  1. Define the outside tester and DMZ web server.
  2. Send an allowed TCP 443 handshake and TLS hello, followed by a blocked port 22 probe.
firewall_acl_test.fasm
host outside_tester { ip 203.0.113.45 }
host dmz_web_server { ip 198.51.100.80 }
flow allow_https(ext, dmz) {
    ext -> dmz tcp syn srcport 52100 dstport 443 wait 1ms
    ext <- dmz tcp syn ack wait 1ms
    ext -> dmz tcp ack wait 1ms
    ext -> dmz tls client_hello sni "portal.local" wait 2ms
}
flow block_ssh(ext, dmz) {
    ext -> dmz tcp syn srcport 52101 dstport 22 wait 1ms
    ext <- dmz tcp rst ack wait 1ms
}
compile {
    allow_https(outside_tester, dmz_web_server)
    block_ssh(outside_tester, dmz_web_server)
}
Local CLI Compile, Inspect & Replay Commands
# Compile the stateful firewall ACL audit capture
frameassembly firewall_acl_test.fasm -o firewall_acl_test.pcap

# Verify TCP 3-way handshake sequence numbers, TLS SNI, and RST ACK in tshark
tshark -r firewall_acl_test.pcap

# Replay into your firewall test interface or SPAN port
sudo tcpreplay -i eth0 firewall_acl_test.pcap
Step Up From Browser Sandbox to Local Workflow

Automate firewall_acl_test.fasm locally with the CLI & VS Code Extension

Commit .fasm files to Git, get syntax highlighting in VS Code, and compile .pcap captures in milliseconds.

Install CLI + VS Code

More Packet & .pcap Use Cases

Browse 81-Protocol Docs
Edit & Sanitize PCAP

Decompile any .pcap or .pcapng into .fasm, rewrite IPs or VLAN tags, scrub customer PII, and recompile.

View use case
SNMP & Monitoring

Trigger Zabbix, SolarWinds, PRTG, LibreNMS, or snmptrapd alerts without pulling live cables.

View use case
Shadow IT & Monitoring

Validate NDR sensors, passive monitoring collectors, and CASB/SNI policies against unauthorized SaaS/AI tools and rogue LAN devices.

View use case