Packet builder modules

The packet builder module is used for building a template packet for a stream, and creating a Field Engine program to change fields in the packet.


  • Build a IP/UDP/DNS packet with a src_ip range of to
  • Build IP/UDP packets in IMIX sizes

For example, this snippet creates a SYN attack:

# create attack from random src_ip from and random src_port 1025-65000
# attack server

def create_stream (self):

    # TCP SYN
    base_pkt  = Ether()/IP(dst="")/TCP(dport=80,flags="S")

    pkt = STLPktBuilder(pkt = base_pkt)

    return STLStream(packet = pkt,    #<<<<< set packet builder inside the stream
                     mode = STLTXCont())

STLPktBuilder class

Aggregate a raw instructions objects

class trex.stl.trex_stl_packet_builder_scapy.STLPktBuilder(pkt=None, pkt_buffer=None, vm=None, path_relative_to_profile=False, build_raw=False, remove_fcs=True)[source]

This class defines a method for building a template packet and Field Engine using the Scapy package. Using this class the user can also define how TRex will handle the packet by specifying the Field engine settings. The pkt can be a Scapy pkt or pcap file name. If using a pcap file, and path_relative_to_profile is True, then the function loads the pcap file from a path relative to the profile.

# Example6

# packet is scapy
STLPktBuilder( pkt = Ether()/IP(src="",dst="")/UDP(dport=12,sport=1025)/(10*'x') )

# packet is taken from pcap file relative to python 
STLPktBuilder( pkt ="stl/yaml/udp_64B_no_crc.pcap")

# packet is taken from pcap file relative to profile file 
STLPktBuilder( pkt ="stl/yaml/udp_64B_no_crc.pcap",
                    path_relative_to_profile = True )

vm = STLScVmRaw( [   STLVmTupleGen ( ip_min="", ip_max="", 
                                       port_min=1025, port_max=65535,
                                        name="tuple"), # define tuple gen 

                 STLVmWrFlowVar (fv_name="tuple.ip", pkt_offset= "IP.src" ), # write ip to packet IP.src
                 STLVmFixIpv4(offset = "IP"),                                # fix checksum
                 STLVmWrFlowVar (fv_name="tuple.port", pkt_offset= "" )  #write udp.port

base_pkt = Ether()/IP(src="",dst="")/UDP(dport=12,sport=1025)
pad = max(0, size - len(base_pkt)) * 'x'

STLPktBuilder(pkt = base_pkt/pad, vm= vm)
pkt : string,

Scapy object or pcap filename.

pkt_buffer : bytes

Packet as buffer.

vm : list or base on trex.stl.trex_stl_packet_builder_scapy.STLScVmRaw

List of instructions to manipulate packet fields.

path_relative_to_profile : bool

If pkt is a pcap file, determines whether to load it relative to profile file.

build_raw : bool

If a buffer is specified (by pkt_buffer), determines whether to build Scapy. Useful in cases where it is necessary to take the offset from Scapy.

remove_fcs : bool

If a buffer is specified (by pkt_buffer), determines whether to remove FCS.


Dumps the instructions




  • json object of instructions

  • AssertionError, in case VM is not compiled (is None).

Dumps the packet as a decimal array of bytes (each item x gets value in range 0-255)

encode : bool

Encode using base64. (disable for debug)

Default: True


  • packet representation as array of bytes

  • AssertionError, in case packet is empty.

Return layer description in this format: IP:TCP:Pyload


Load raw pcap file into a buffer. Loads only the first packet.


pcap_file : file_name

  • AssertionError, if packet is empty.

Scapy packet


pkt =Ether()/IP(src="",dst="")/UDP(dport=12,sport=1025)/IP()/('x'*10)

write packet builder to JSON format

static from_json(json_data)[source]

given a JSON, construct a valid packet builder object