Read every frame.
Edit every byte.
Trust every fix.
A byte-editable hex dump for .pcap and .pcapng captures. Decode 108 protocols, edit, craft, investigate and fix.
See it in under 5 minutes
Watch a frame get crafted
One workbench, six jobs
Everything works on the same frame table. Edit a byte and every view follows.
Investigate
Attack story, Extract files, certificates, indicator lists, detection rule testing and the Health check tell you what happened in a capture.
See what it does →Decode
109 protocols down to the field, TLS and QUIC decryption, streams, graphs and a Values tab.
See what it does →Edit and fix
Change any byte. Lengths and checksums are repaired for you, and every edit can be undone.
See what it does →Craft
Sixteen builders, from TCP, DNS and ICMP to DHCP, TLS, SNMP and Modbus/TCP, with values picked by name, or a whole connection written in one line.
See what it does →Big captures
A gigabyte opens in about 20 s, and the windows stay light and give their memory back.
See what it does →Private
No telemetry and no account. Nothing leaves your computer unless you choose to send it, and it works offline.
See what it does →Ask a model about a capture, and check every answer
The AI assistant reads what Frame Bench has decoded. It explains a frame, triages a capture, answers questions with tools that run on your computer, and drafts filters and rules that are tested before you see them.
- Read the exact text before anything is sent, with names and addresses replaced at the level you choose
- A model on your computer, or a cloud service with your own key, off until you switch it on
- Every frame, stream or finding it cites is looked up in the capture, and what does not check out is marked
- 66 tools, most of them read-only, and eight short videos
109 protocols, from the link layer up
The list says what each one decodes and what it does not.
Pick a tier
Each tier contains the one before it. Start from what you do with a capture: read and fix it, generate and send traffic, or hand the result on. Every tier includes a year of updates and support, licensed directly by Netomize.
Choose Analyst if you investigate and fix captures, or put together the odd frame by hand: troubleshooting, forensics, incident review, teaching.
Choose Crafting if you make traffic often, or in bulk: guided builders, generated series, fuzzing, and sending it onto a test network.
Choose Complete if you hand decrypted evidence to other people, want one set of Expert findings rules for a whole team, want ready-made protocol scenarios and shareable packs for a test lab, or need to export the Attack story and extracted files as evidence.
What each tier includes
Every tier opens, decodes and edits any capture, and can put frames together by hand. The higher tiers add guided builders, generated traffic and sending, then decrypted evidence and shared rules.
| Feature | AnalystUS$500 | CraftingUS$900 | CompleteUS$1,300 |
|---|---|---|---|
| Read, edit and analyze | |||
| Decode and byte-edit any capture, with undo and redo | |||
| Expert findings with the built-in checks and adjustable thresholds | |||
| Expert findings reports: text, ticket, HTML, CSV, JSON, SARIF | |||
| Health check, Streams, Conversations, Hosts and ports | |||
| Build frames by hand, layer by layer, from the template palette | |||
| Craft lab, one frame at a time, with a live preview | |||
| Batch apply and Rewrite addresses | |||
| Read decrypted TLS, DTLS and QUIC with a key log | |||
| Build and send traffic | |||
| Guided packet builders (sixteen, from stream and DNS to DHCP, TLS, SNMP and Modbus/TCP) | – | ||
| Craft lab: series, mutate and fuzz, and whole TCP and UDP streams in expressions | – | ||
| Send to a network through Npcap, with safety limits | – | ||
| Evidence and teamwork | |||
| Save decrypted TLS, DTLS and QUIC traffic as a pcap | – | – | |
| Load decrypted streams into the frame table | – | – | |
| Craft lab scenarios: ready-made SMTP, FTP, HTTP/2, TLS, page-load and scan exchanges | – | – | |
| Craft lab packs: share named sets of conversations as a file | – | – | |
| Write custom Expert findings rules and share them as files | – | – | |
| Read rules from a shared folder, from Preferences | – | – | |
| See how every built-in Expert rule decides | – | – | |
| Investigate | |||
| Attack story: relationship graph, evidence and timeline | |||
| Extract files: list, gallery, timeline, preview, hashes and name warnings; save one file | |||
| Certificates: every certificate listed with what is wrong with it, and tls.cert filters | |||
| Indicator lists: match addresses, names, networks and hashes on your computer | |||
| Save a redacted copy: passwords, tokens and internal addresses replaced | |||
| Attack story exports: HTML, CSV, JSON, STIX, MISP, Suricata, Sigma, OpenIOC, PDF, batch reports | – | – | |
| Extract files: save as ZIP, file list as CSV, a whole folder of captures at once | – | – | |
| Reputation lookups: VirusTotal, AbuseIPDB and AlienVault OTX, when you choose | – | – | |
| AI assistance: ask a model on your computer or your own cloud account about a capture, after you read what will be sent | – | – | |
| Detection rule testing: Suricata, Snort and YARA-X on a capture, with a rule maker | – | – | |
| Support | |||
| A year of updates and standard support | |||
| Priority support | – | – | |
Prices in USD, before tax. Not sure which one? Request an evaluation or contact us; volume pricing is available.
Get Frame Bench
No public installer. Tell us your platform and tier and we will send a quote and your build.
All Rights Reserved © Netomize