FrameAssembly
SNMP & Monitoring · snmpv3_trap_test.fasmFrameAssembly v1.5.1

Simulate SNMPv2c & Encrypted SNMPv3 Trap Alerts (linkDown & linkUp)

You need to confirm that your monitoring server decodes encrypted SNMPv3 SHA-256/AES traps and pages the on-call tech without unplugging a production switch or fighting Net-SNMP USM flags.

What This Capture Builds

Generates an encrypted SNMPv3 USM authPriv linkDown trap followed 10 seconds later by a linkUp recovery trap with interface OID varbinds.

How to Customize

  1. Define the router and trap collector IPs in host blocks.
  2. Set your SNMPv3 user, hex engineid, sha256 auth password, and aes priv password.
snmpv3_trap_test.fasm
host router { ip 10.250.1.1 }
host nms    { ip 10.250.100.50 }
flow link_flap_traps(rtr, srv) {
    rtr -> srv snmp3 trap user "noc_trap" engineid "8000000903"
        auth sha256 "AuthKey99!" priv aes "PrivKey99!"
        oid 1.3.6.1.6.3.1.1.5.3
        varbind 1.3.6.1.2.1.1.5.0 string "edge-rtr-01"
        varbind 1.3.6.1.2.1.2.2.1.8.1 int 2 wait 10s
    rtr -> srv snmp3 trap user "noc_trap" engineid "8000000903"
        auth sha256 "AuthKey99!" priv aes "PrivKey99!"
        oid 1.3.6.1.6.3.1.1.5.4
        varbind 1.3.6.1.2.1.1.5.0 string "edge-rtr-01"
        varbind 1.3.6.1.2.1.2.2.1.8.1 int 1 wait 5ms
}
compile {
    link_flap_traps(router, nms)
}
Local CLI Compile, Inspect & Replay Commands
# Compile the SNMPv3 authPriv trap capture
frameassembly snmpv3_trap_test.fasm -o snmpv3_trap_test.pcap

# Inspect SNMPv3 USM EngineID, Username, and Auth/Priv parameters in tshark
tshark -r snmpv3_trap_test.pcap -Y "snmp" -V

# Replay the encrypted traps toward your NMS / trap receiver on eth0
sudo tcpreplay -i eth0 snmpv3_trap_test.pcap
Step Up From Browser Sandbox to Local Workflow

Automate snmpv3_trap_test.fasm locally with the CLI & VS Code Extension

Commit .fasm files to Git, get syntax highlighting in VS Code, and compile .pcap captures in milliseconds.

Install CLI + VS Code

More Packet & .pcap Use Cases

Browse 81-Protocol Docs
Edit & Sanitize PCAP

Decompile any .pcap or .pcapng into .fasm, rewrite IPs or VLAN tags, scrub customer PII, and recompile.

View use case
Shadow IT & Monitoring

Validate NDR sensors, passive monitoring collectors, and CASB/SNI policies against unauthorized SaaS/AI tools and rogue LAN devices.

View use case
Firewall & ACLs

Verify that TCP port 443 completes a 3-way handshake + TLS ClientHello while port 22 is rejected with TCP RST.

View use case