Documentation

Chain Builder Guide

Chains let you define the exact shape of TCP/UDP/ICMP traffic at the packet level โ€” flags, payloads, timing, and TCP options โ€” to simulate any real-world traffic scenario.

Overview

A chain is a plain-text file that describes a sequence of network packets to send repeatedly during a test. Each chain has a mode, optional global directives that configure TCP-layer behaviour, and one or more steps that define individual packets.

Chains are only available on plans with Advanced Methods enabled. Once created through the Chain Builder in your panel, a chain can be selected as the traffic source when launching a Layer 4 test.

๐Ÿ’ก
Mode: fanout vs scaled
Fanout โ€” every worker sends the full chain simultaneously. Best for high-volume burst testing.
Scaled โ€” workers are distributed across chain steps round-robin. Best for sustained, realistic traffic simulation.

Chain File Format

A chain file consists of three logical parts, in order:

  1. Comment header โ€” lines starting with #, ignored by the engine.
  2. Directives โ€” lines starting with @, configure global TCP options.
  3. Steps โ€” lines in delay:protocol:flags:payload[;overrides] format, each defining one packet.
Skeleton
# name: my-chain
# (optional comments)

@tcp   mss=1460 wscale=8 win=65535 sack
@seq   client_isn=random server_isn=random
@ipid  mode=random start=random

0:tcp:S:size=0
100:tcp:A:size=0
200:tcp:PA:size=512

Directives

Directives are optional. When omitted, the engine uses sane defaults. Each directive appears on its own line and starts with @.

@tcp

Configures TCP options sent in the SYN packet.

FieldValuesDescription
mssinteger (0โ€“65535)Maximum Segment Size. Use 0 to omit. Typical: 1460 for Ethernet.
wscaleinteger (0โ€“14)Window scaling factor. Use 0 to disable. Typical: 8.
winintegerInitial TCP window size. Typical: 65535.
sackflag (present/absent)Advertise Selective ACK support. Include the word to enable.
tsflag (present/absent)Advertise TCP Timestamps support.
@tcp mss=1460 wscale=8 win=65535 sack ts

@seq

Controls how TCP sequence numbers are chosen.

FieldValuesDescription
client_isnrandom ยท zero ยท incInitial sequence number for client-side packets. random looks most realistic.
server_isnrandom ยท zero ยท echoISN the engine expects from the server. echo mirrors whatever the server sent.
@seq client_isn=random server_isn=echo

@ts

Configures the TCP timestamp option (RFC 7323). Only relevant when ts is set in @tcp.

FieldValuesDescription
modems ยท inc ยท randomms = real millisecond clock (most realistic). inc = monotonically incrementing. random = random per packet.
startrandom ยท 0 ยท 1Starting value for the timestamp counter.
stepintegerHow much to add per packet in inc mode. Ignored in other modes.
@tcp  mss=1460 wscale=8 win=65535 sack ts
@ts   mode=ms start=random step=100

@ipid

Controls the IP ID field in each packet's IP header.

FieldValuesDescription
moderandom ยท zero ยท incHow the IP ID is chosen. random is most evasive. inc simulates a normal OS stack.
startrandom ยท integerStarting value for inc mode.
@ipid mode=inc start=random

Step Syntax

Each step is a single line with four colon-separated fields, plus an optional override block:

delay:protocol:flags:payload[;overrides]
FieldValuesDescription
delay integer (ms) How many milliseconds to wait before sending this packet. Use 0 for immediate send.
protocol tcp ยท udp ยท icmp Network protocol for this packet.
flags See below For TCP: flag combination. For ICMP: type number. For UDP: ignored (leave blank or -).
payload type=value Payload specification โ€” see Payload Types table below.
overrides key=value,... Optional. Per-packet header overrides separated by commas.

TCP Flag Combinations

FlagMeaningCommon Use
SSYNOpen connection
SASYN+ACKServer handshake reply (simulation)
AACKAcknowledge data
PAPSH+ACKSend data with push
FAFIN+ACKClose connection
RRSTForce-reset connection
RARST+ACKForce-reset with ack

Payload Types

TypeValue formatDescription
sizeinteger (bytes)Zero-filled payload of the given size. Use size=0 for no payload.
randbytesinteger (bytes)Random bytes of the given size. Higher CPU cost, more entropy.
hexhex stringFixed payload specified as hexadecimal (e.g. hex=deadbeef).
hexrhex stringLike hex but randomises bytes marked with ??.
textstringUTF-8 text payload (e.g. an HTTP request).

Per-packet Overrides

After a semicolon, you can override specific header fields for just that packet. Multiple overrides are comma-separated:

KeyDescription
seqOverride the TCP sequence number (integer).
ackOverride the TCP acknowledgement number (integer).
winOverride the TCP window size for this packet.
ttlOverride the IP Time-to-Live for this packet.
Example with overrides
# Send a SYN with a forced seq=1000 and a specific TTL
0:tcp:S:size=0;seq=1000,ttl=64

Examples

01
Basic SYN Flood
Maximum-throughput SYN flood. Minimal chain โ€” just one packet, sent as fast as possible. Ideal for raw connection-rate stress tests.
syn-flood.chain
# name: syn-flood
# mode: fanout
# Sends a bare SYN packet with no payload.
# All TCP options are at engine defaults.

0:tcp:S:size=0
โšก
Use fanout mode for maximum SYN rate โ€” every worker sends the same packet simultaneously.
02
Realistic TCP Handshake Simulation
Simulates a full TCP three-way handshake plus a small data push, with realistic TCP options. Effective for testing stateful firewall and connection-tracking exhaustion.
tcp-handshake.chain
# name: tcp-handshake
# mode: scaled

# TCP options โ€” mirrors a modern Linux client
@tcp  mss=1460 wscale=8 win=65535 sack ts

# Randomise sequence numbers to avoid fingerprinting
@seq  client_isn=random server_isn=echo

# Use real millisecond timestamps for full RFC 7323 compliance
@ts   mode=ms start=random step=100

# Randomise IP ID just like a normal host would
@ipid mode=inc start=random

# Step 1 โ€” SYN (connection open)
0:tcp:S:size=0

# Step 2 โ€” ACK (complete handshake)
50:tcp:A:size=0

# Step 3 โ€” PSH+ACK (send small payload, e.g. HTTP GET request fragment)
100:tcp:PA:size=128

# Step 4 โ€” FIN+ACK (graceful close)
200:tcp:FA:size=0
๐Ÿ’ก
Scaled mode works well here โ€” workers are round-robined across the steps, producing a steady stream of mixed packet types that look like real keep-alive traffic.
03
Mixed Protocol Fanout
Combines TCP SYN, UDP, and ICMP echo in one chain. Useful for testing layer-4 firewalls and IDS/IPS systems that need to handle heterogeneous traffic simultaneously.
mixed-protocol.chain
# name: mixed-protocol
# mode: fanout

@ipid mode=random start=random

# TCP SYN burst
0:tcp:S:size=0

# UDP flood burst โ€” plain zero-filled payload
0:udp:-:size=512

# ICMP Echo Request (type 8) with random payload
0:icmp:8:randbytes=64

# TCP RST โ€” force-closes any half-open connections
10:tcp:R:size=0;seq=0
โš ๏ธ
randbytes payload is more CPU-intensive than size. Use it only when entropy matters for evasion. Prefer size=N for max throughput.

Tips & Limits

๐ŸŽฏ
Keep chains short

1โ€“6 steps is optimal. Long chains increase per-packet processing overhead and reduce overall throughput.

๐Ÿ“
Payload sizes matter

Large payloads slow down packet generation. For connection-rate tests (SYN flood) always use size=0. For bandwidth tests, size=1400 maximises throughput without IP fragmentation on Ethernet.

โฑ๏ธ
Delay of 0 doesn't mean instant

delay=0 means no intentional wait. There is always a small scheduling overhead between steps. For truly simultaneous packets, use multiple chains or the fanout mode.

๐Ÿ”
Chains loop automatically

The engine repeats the full step sequence for the entire test duration. You don't need to add repeat logic โ€” just define the packet sequence for one cycle.

๐Ÿ›ก๏ธ
Test your own infrastructure

You are responsible for ensuring you have authorisation to stress-test the target. Using chains against systems you don't own is against our Terms of Service.

๐Ÿ’พ
Saved chains are account-scoped

Chains are saved to your account and are only visible to you. They persist across sessions and can be edited or deleted at any time from the Chains tab in your panel.