Chain Builder Guide
Chains let you define the exact shape of TCP/UDP/ICMP traffic at the packet level โ flags, payloads, timing, and TCP options โ to simulate any real-world traffic scenario.
Overview
A chain is a plain-text file that describes a sequence of network packets to send repeatedly during a test. Each chain has a mode, optional global directives that configure TCP-layer behaviour, and one or more steps that define individual packets.
Chains are only available on plans with Advanced Methods enabled. Once created through the Chain Builder in your panel, a chain can be selected as the traffic source when launching a Layer 4 test.
Fanout โ every worker sends the full chain simultaneously. Best for high-volume burst testing.
Scaled โ workers are distributed across chain steps round-robin. Best for sustained, realistic traffic simulation.
Chain File Format
A chain file consists of three logical parts, in order:
- Comment header โ lines starting with
#, ignored by the engine. - Directives โ lines starting with
@, configure global TCP options. - Steps โ lines in
delay:protocol:flags:payload[;overrides]format, each defining one packet.
# name: my-chain # (optional comments) @tcp mss=1460 wscale=8 win=65535 sack @seq client_isn=random server_isn=random @ipid mode=random start=random 0:tcp:S:size=0 100:tcp:A:size=0 200:tcp:PA:size=512
Directives
Directives are optional. When omitted, the engine uses sane defaults.
Each directive appears on its own line and starts with @.
@tcp
Configures TCP options sent in the SYN packet.
| Field | Values | Description |
|---|---|---|
mss | integer (0โ65535) | Maximum Segment Size. Use 0 to omit. Typical: 1460 for Ethernet. |
wscale | integer (0โ14) | Window scaling factor. Use 0 to disable. Typical: 8. |
win | integer | Initial TCP window size. Typical: 65535. |
sack | flag (present/absent) | Advertise Selective ACK support. Include the word to enable. |
ts | flag (present/absent) | Advertise TCP Timestamps support. |
@tcp mss=1460 wscale=8 win=65535 sack ts
@seq
Controls how TCP sequence numbers are chosen.
| Field | Values | Description |
|---|---|---|
client_isn | random ยท zero ยท inc | Initial sequence number for client-side packets. random looks most realistic. |
server_isn | random ยท zero ยท echo | ISN the engine expects from the server. echo mirrors whatever the server sent. |
@seq client_isn=random server_isn=echo
@ts
Configures the TCP timestamp option (RFC 7323). Only relevant when ts is set in @tcp.
| Field | Values | Description |
|---|---|---|
mode | ms ยท inc ยท random | ms = real millisecond clock (most realistic). inc = monotonically incrementing. random = random per packet. |
start | random ยท 0 ยท 1 | Starting value for the timestamp counter. |
step | integer | How much to add per packet in inc mode. Ignored in other modes. |
@tcp mss=1460 wscale=8 win=65535 sack ts @ts mode=ms start=random step=100
@ipid
Controls the IP ID field in each packet's IP header.
| Field | Values | Description |
|---|---|---|
mode | random ยท zero ยท inc | How the IP ID is chosen. random is most evasive. inc simulates a normal OS stack. |
start | random ยท integer | Starting value for inc mode. |
@ipid mode=inc start=random
Step Syntax
Each step is a single line with four colon-separated fields, plus an optional override block:
delay:protocol:flags:payload[;overrides]
| Field | Values | Description |
|---|---|---|
delay |
integer (ms) | How many milliseconds to wait before sending this packet. Use 0 for immediate send. |
protocol |
tcp ยท udp ยท icmp |
Network protocol for this packet. |
flags |
See below | For TCP: flag combination. For ICMP: type number. For UDP: ignored (leave blank or -). |
payload |
type=value |
Payload specification โ see Payload Types table below. |
overrides |
key=value,... |
Optional. Per-packet header overrides separated by commas. |
TCP Flag Combinations
| Flag | Meaning | Common Use |
|---|---|---|
S | SYN | Open connection |
SA | SYN+ACK | Server handshake reply (simulation) |
A | ACK | Acknowledge data |
PA | PSH+ACK | Send data with push |
FA | FIN+ACK | Close connection |
R | RST | Force-reset connection |
RA | RST+ACK | Force-reset with ack |
Payload Types
| Type | Value format | Description |
|---|---|---|
size | integer (bytes) | Zero-filled payload of the given size. Use size=0 for no payload. |
randbytes | integer (bytes) | Random bytes of the given size. Higher CPU cost, more entropy. |
hex | hex string | Fixed payload specified as hexadecimal (e.g. hex=deadbeef). |
hexr | hex string | Like hex but randomises bytes marked with ??. |
text | string | UTF-8 text payload (e.g. an HTTP request). |
Per-packet Overrides
After a semicolon, you can override specific header fields for just that packet. Multiple overrides are comma-separated:
| Key | Description |
|---|---|
seq | Override the TCP sequence number (integer). |
ack | Override the TCP acknowledgement number (integer). |
win | Override the TCP window size for this packet. |
ttl | Override the IP Time-to-Live for this packet. |
# Send a SYN with a forced seq=1000 and a specific TTL 0:tcp:S:size=0;seq=1000,ttl=64
Examples
# name: syn-flood # mode: fanout # Sends a bare SYN packet with no payload. # All TCP options are at engine defaults. 0:tcp:S:size=0
# name: tcp-handshake # mode: scaled # TCP options โ mirrors a modern Linux client @tcp mss=1460 wscale=8 win=65535 sack ts # Randomise sequence numbers to avoid fingerprinting @seq client_isn=random server_isn=echo # Use real millisecond timestamps for full RFC 7323 compliance @ts mode=ms start=random step=100 # Randomise IP ID just like a normal host would @ipid mode=inc start=random # Step 1 โ SYN (connection open) 0:tcp:S:size=0 # Step 2 โ ACK (complete handshake) 50:tcp:A:size=0 # Step 3 โ PSH+ACK (send small payload, e.g. HTTP GET request fragment) 100:tcp:PA:size=128 # Step 4 โ FIN+ACK (graceful close) 200:tcp:FA:size=0
# name: mixed-protocol # mode: fanout @ipid mode=random start=random # TCP SYN burst 0:tcp:S:size=0 # UDP flood burst โ plain zero-filled payload 0:udp:-:size=512 # ICMP Echo Request (type 8) with random payload 0:icmp:8:randbytes=64 # TCP RST โ force-closes any half-open connections 10:tcp:R:size=0;seq=0
randbytes payload is more CPU-intensive than size. Use it only when entropy matters for evasion. Prefer size=N for max throughput.
Tips & Limits
1โ6 steps is optimal. Long chains increase per-packet processing overhead and reduce overall throughput.
Large payloads slow down packet generation. For connection-rate tests (SYN flood) always use size=0. For bandwidth tests, size=1400 maximises throughput without IP fragmentation on Ethernet.
delay=0 means no intentional wait. There is always a small scheduling overhead between steps. For truly simultaneous packets, use multiple chains or the fanout mode.
The engine repeats the full step sequence for the entire test duration. You don't need to add repeat logic โ just define the packet sequence for one cycle.
You are responsible for ensuring you have authorisation to stress-test the target. Using chains against systems you don't own is against our Terms of Service.
Chains are saved to your account and are only visible to you. They persist across sessions and can be edited or deleted at any time from the Chains tab in your panel.