Frame Bench 3.2

Ask a model about a capture and check every answer, send traffic faster and more exactly, build packets from a guided form, and test detection rules without installing anything.

Frame Bench 3.2 is the biggest release since 3.0. It has one headline feature and a long list of things we kept hearing people ask for. The headline first, because it is the one that needed the most care.

Ask a model about a capture

The AI assistant (Complete bundle, desktop app) can explain a frame, a stream, an Expert finding, an Attack story node, an extracted file or a fired detection rule. It can give you a ranked list of what to look at first. Or you can simply chat with it about the open capture, and it has 66 tools for reading the capture, almost all of which only read.

A capture is full of other people's data, so we built the feature around three promises.

You read the exact text before anything is sent. Every conversation starts with a preview: the text, where it is going, how large it is in tokens, an estimated cost if you have set a price, and how many addresses, names and secrets were replaced. Nothing leaves the computer until you press Send.

You choose how much is replaced. Redaction has four levels: Off, Secrets (passwords, keys and tokens), Names (also addresses, host names and accounts, replaced by stand-ins) and Strict (also no payload bytes). The table that maps stand-ins back to real values stays on your computer and is never saved.

Every answer is checked. The model has to cite the capture: [F:123] for a frame, with an optional value such as [F:123 tcp.dstport=80], and the same for streams, findings, Attack story nodes, extracted files, hosts and detection alerts. Frame Bench checks each citation against the capture. A frame that does not exist, or a value that is not in that frame, is marked as not found instead of being passed along as fact.

The model can be one on your own computer (Ollama, LM Studio, llama.cpp, or anything that speaks the OpenAI chat format) or a cloud service you have your own key for (OpenAI-compatible services and Anthropic). Frame Bench decides which it is from the address, so a cloud address cannot be passed off as local. A cloud service stays off until you turn it on in a window that says what leaves the computer, and an Offline mode switch stops all cloud contact at once. Keys are kept in your operating system's protected storage. There is still no telemetry, no account and no automatic update check.

A few things people use most:

• Better on real captures. Logins in the clear (FTP, SMTP, POP3, IMAP, HTTP Basic, Telnet, LDAP, RADIUS) and SMB sign-ins are paired with the server's answer, so "did the guessing work?" has an answer you can verify.
• A model for each kind of question. Explain, triage, chat, filter, rule, report and decoding can each use their own service and model, with daily limits in tokens and cost and an activity log of every request.
• Describe the traffic you want. It writes a display filter that Frame Bench parses and counts before you apply it. It can draft a whole TCP or UDP conversation, or a Suricata, Snort or YARA rule that is checked, tested on the capture and against ordinary traffic, and revised, with nothing saved or run on a live engine without you.
• Results stay with the case. Every answer is saved with a fingerprint of the evidence it cites, and when you open the capture again each one says Current, Evidence changed or Evidence missing. They also come back by themselves: the chats and results of a capture are kept on your computer and returned when you open the same capture again, even under another name, with no session file. A switch in Preferences turns that off, and Forget this capture removes it.

Eight videos in the Learn section, about 24 minutes in all, walk through it from the first question to the saved records.

Send to a network, much faster and more exact

Send to a network (Crafting bundle, desktop app) now sends from a thread that does nothing else, so frames leave within a small part of a millisecond of their time even while the rest of the program is busy. Onto the loopback adapter it reaches well over 100,000 frames per second. The result tells you how many frames per second were really reached and how many left on time, and you can send by rate, by run time, with counters, and with saved profiles.

The window also floats now. It no longer blocks the page, so the frame list stays usable beside it. Drag it, resize it from any side, maximize it or collapse it to its title bar.

Sixteen guided builders

The guided builders (Crafting bundle) now cover DHCP, IP packets (IPv4 or IPv6), SNMP v1, v2c and v3, TLS 1.0 to 1.3, SIP, Modbus/TCP, MQTT 3.1 to 5, NTP, Ethernet (II, 802.3, QinQ, LLDP and Spanning Tree), IGMP and Wake-on-LAN, next to the ones that were already there.

Two things make them quicker than a blank hex editor. You pick values by name: 423 TLS cipher suites, 155 supported groups, 104 signature algorithms, 144 EtherTypes, 225 IP protocols and more are offered with their usual names. And you can take the packet from your capture: open a frame, press From a capture, and every tab of the NTP, DHCP, SIP, MQTT and TLS builders is filled from it, with its addresses and ports.

More of the network, decoded

• Kerberos (every license). UDP and TCP port 88 is read as Kerberos V5: the AS, TGS and AP exchanges, KRB-SAFE, KRB-PRIV, KRB-CRED and KRB-ERROR, with names, realms, times, encryption types and the KDC and AP options as named bits.
• DNS records. SOA, SRV and EDNS0 OPT records are decoded into words: a SOA as its name server, mailbox, serial and times, an SRV as priority, weight, port and target.
• Stream numbers in filters. tcp.stream == 3 and udp.stream == 0 show every frame of one connection in both directions, and there is a Stream column. The AI assistant uses the same numbers.
• Decrypt all streams. The TLS / DTLS and QUIC decrypt windows have a button that tries every stream of the capture with the key log you gave it and lists what opened.

Detection rules, with YARA-X built in

The Detection rules window (Complete bundle, desktop app) scans with YARA-X inside Frame Bench, from memory, with no program to install and no file written for each frame. Suricata and Snort are still used when you have them installed.

The Rule maker got ten improvements. It counts how common a value is across the whole capture, offers stretches of the frame's own bytes that appear nowhere else as facts, can tighten a rule, shows which of your other rules already cover it, and remembers a baseline of ordinary traffic you pointed it at.

Faster, lighter and safer

• Memory comes back. Close capture now gives the memory back: 1,842 MB were held after closing a capture of 1,000,000 frames, and now about 250 MB are. Closing a window releases what it built a moment later, and the stream filters answer from the streams' own lists.
• Safer with files from other people. A very small compressed file can unpack to many gigabytes, so everything Frame Bench unpacks (a gzip, deflate, Brotli or Zstandard web body, a ZIP entry, a saved session) is counted as it is made and stops with a message at 256 MB, or 512 MB for a session. The window scripts can run in is narrower, the program checks its own code archive when it starts on Windows, and Electron is updated to 44.11.0.
• Fixed along the way. The scroll bar at the edge of a window could only be used to resize it and now works; IEC 60870-5-104 bitstrings were read with their octets the wrong way round; a restored session could show the start of a request cut off in the stream view.

A look you can change, and help you can search

Appearance has a preview that follows every change. Theme is Light, Dark or System, with seven accent colors and a picker for any color, each worked out again for the light and dark theme so text stays readable, plus high contrast and a look you can save to a file. The Help guide search now understands exact phrases, OR, exclusions, wildcards, regular expressions and scopes such as section: and heading:. And a Tour button in more than twenty windows walks through its parts.

Getting it

The AI features need the Complete bundle and the desktop app. Send to a network and the guided builders need the Crafting bundle. Kerberos, stream filters and the Appearance changes come with every license. If you already have Frame Bench, download the 3.2 installer from the customer downloads page and check it's SHA-256 checksum against the one listed with the file. The full list of changes is on the What's new page, and the Help guide, now with search, is built into the app.

If there is something you reach for in your own work that is still missing, tell us.

---

Frame Bench is a product of Netomize. Questions and security reports: support@framebench.ca.