FrameAssembly
Pentest & SecOps · ids_scan_test.fasmFrameAssembly v1.5.1

Generate PCAP for Suricata, Snort & Zeek IDS Signature Validation

Detection engineering needs a zero-noise .pcap to verify that Suricata, Snort, or Zeek triggers alerts on suspicious DNS queries, custom TLS SNI handshakes, rapid SYN scans, and fragmented UDP packets.

What This Capture Builds

Combines a DNS query/response, a stateful TCP + TLS ClientHello SNI flow, rapid SYN probes across ports 21/22/80, and a 2-part fragmented UDP packet.

How to Customize

  1. Define the scanner and target IPs.
  2. Customize dns qname, tls sni, tcp syn ports, or ipid / mf / fragoffset.
ids_scan_test.fasm
host scanner { ip 172.18.99.10 }
host target  { ip 172.18.10.50 }
flow dns_and_tls_check(src, dst) {
    src -> dst dns query txid 0x4401 qname "c2-beacon.bad-domain.test" qtype "A" wait 1ms
    src <- dst dns response txid 0x4401 qname "c2-beacon.bad-domain.test" qtype "A" rcode 5 wait 2ms
    src -> dst tcp syn srcport 53443 dstport 443 win 65535 mss 1460 wait 1ms
    src <- dst tcp syn ack win 65535 mss 1460 wait 1ms
    src -> dst tcp ack wait 1ms
    src -> dst tls client_hello sni "shadow-upload.example.net" ciphersuite 4866 alpn "h2" wait 2ms
}
flow syn_scan_and_fragments(src, dst) {
    src -> dst tcp syn srcport 61001 dstport 21 wait 1ms
    src -> dst tcp syn srcport 61002 dstport 22 wait 1ms
    src -> dst tcp syn srcport 61003 dstport 80 wait 1ms
    src -> dst udp dstport 161 ipid 4421 mf fragoffset 0 wait 1ms
    src -> dst udp dstport 161 ipid 4421 fragoffset 185 wait 1ms
}
compile {
    dns_and_tls_check(scanner, target)
    syn_scan_and_fragments(scanner, target)
}
Local CLI Compile, Inspect & Replay Commands
# Compile the IDS validation capture
frameassembly ids_scan_test.fasm -o ids_scan_test.pcap

# Run Suricata offline against the generated .pcap (writes eve.json / fast.log)
suricata -r ids_scan_test.pcap -k none -l ./suricata_out/

# Or run Zeek offline to generate dns.log, ssl.log, and conn.log
zeek -C -r ids_scan_test.pcap
Step Up From Browser Sandbox to Local Workflow

Automate ids_scan_test.fasm locally with the CLI & VS Code Extension

Commit .fasm files to Git, get syntax highlighting in VS Code, and compile .pcap captures in milliseconds.

Install CLI + VS Code

More Packet & .pcap Use Cases

Browse 81-Protocol Docs
Edit & Sanitize PCAP

Decompile any .pcap or .pcapng into .fasm, rewrite IPs or VLAN tags, scrub customer PII, and recompile.

View use case
SNMP & Monitoring

Trigger Zabbix, SolarWinds, PRTG, LibreNMS, or snmptrapd alerts without pulling live cables.

View use case
Shadow IT & Monitoring

Validate NDR sensors, passive monitoring collectors, and CASB/SNI policies against unauthorized SaaS/AI tools and rogue LAN devices.

View use case