FrameAssembly
Shadow IT & Monitoring · shadow_it_detection.fasmFrameAssembly v1.5.1

Test Shadow IT & Rogue Device Detection (Unmanaged SaaS DNS, TLS SNI & mDNS)

You built or deployed a network monitoring / Shadow IT detection pipeline and need a clean, repeatable .pcap to verify that it catches employees connecting to unapproved SaaS or AI endpoints (via DNS or direct TLS SNI) and rogue NAS/IoT gear announcing over mDNS and SSDP.

What This Capture Builds

Combines an unauthorized SaaS DNS A-record lookup, a full stateful TCP 443 handshake + TLS ClientHello SNI to an unmanaged AI service, and multicast mDNS / SSDP discovery broadcasts.

How to Customize

  1. Replace qname and tls client_hello sni with the exact SaaS, AI, or file-sharing domains on your watchlist.
  2. Compile to .pcap and replay into your monitoring SPAN port or run offline against Zeek / Suricata.
shadow_it_detection.fasm
host employee_pc { ip 10.30.15.42 }
host corp_gw     { ip 10.30.15.1 }
host mdns_group  { ip 224.0.0.251 }
host ssdp_group  { ip 239.255.255.250 }
flow unmanaged_saas_and_ai(ws, gw) {
    ws -> gw dns query txid 0x7101 qname "personal-cloud-sync.example.io" qtype "A" wait 1ms
    ws <- gw dns response txid 0x7101 qname "personal-cloud-sync.example.io" qtype "A" rdata "198.51.100.77" wait 1ms
    ws -> gw tcp syn srcport 53443 dstport 443 win 65535 mss 1460 wait 1ms
    ws <- gw tcp syn ack win 65535 mss 1460 wait 1ms
    ws -> gw tcp ack wait 1ms
    ws -> gw tls client_hello sni "unmanaged-ai-assistant.example.io" ciphersuite 4865 alpn "h2" wait 2ms
}
flow rogue_device_discovery(ws, mcast_dns, mcast_upnp) {
    ws -> mcast_dns mdns query qname "rogue-office-nas.local" qtype "A" wait 2ms
    ws -> mcast_upnp ssdp msearch st "ssdp:all" mx 3 wait 2ms
}
compile {
    unmanaged_saas_and_ai(employee_pc, corp_gw)
    rogue_device_discovery(employee_pc, mdns_group, ssdp_group)
}
Local CLI Compile, Inspect & Replay Commands
# 1. Compile the Shadow IT & rogue device test capture
frameassembly shadow_it_detection.fasm -o shadow_it_detection.pcap

# 2. Verify DNS qname, TLS SNI hostname, and mDNS/SSDP discovery fields in tshark
tshark -r shadow_it_detection.pcap -T fields -e frame.number -e ip.src -e dns.qry.name -e tls.handshake.extensions_server_name

# 3. Replay into your monitoring sensor SPAN/TAP interface or evaluate in Zeek
sudo tcpreplay -i eth0 shadow_it_detection.pcap
zeek -C -r shadow_it_detection.pcap
Step Up From Browser Sandbox to Local Workflow

Automate shadow_it_detection.fasm locally with the CLI & VS Code Extension

Commit .fasm files to Git, get syntax highlighting in VS Code, and compile .pcap captures in milliseconds.

Install CLI + VS Code

More Packet & .pcap Use Cases

Browse 81-Protocol Docs
Edit & Sanitize PCAP

Decompile any .pcap or .pcapng into .fasm, rewrite IPs or VLAN tags, scrub customer PII, and recompile.

View use case
SNMP & Monitoring

Trigger Zabbix, SolarWinds, PRTG, LibreNMS, or snmptrapd alerts without pulling live cables.

View use case
Firewall & ACLs

Verify that TCP port 443 completes a 3-way handshake + TLS ClientHello while port 22 is rejected with TCP RST.

View use case