Skip to main content
--mode picks what goes on the wire. Six choices, and the wizard hides whichever fields don’t apply to the one you pick.

​
UDP

The one to start with. Fixed-size UDP frames across as many flows as you ask for.
Uses --src-ip, --dst-ip, --src-port, --dst-port, --vary-dst-port, --flows, --flow-order, --packet-size, --vlan, and the MAC flags.
The IPv4 UDP checksum is left at zero, which is legal, since it’s optional in IPv4. That’s what lets Wireblast change ports per flow without recomputing anything per packet, and it’s part of how packet construction stays allocation-free. Over IPv6 the UDP checksum is mandatory, so there it’s maintained incrementally as ports and addresses change, still without a per-packet allocation.

​
TCP SYN

The same flow machinery, emitting TCP SYNs instead. Checksums are correct and maintained.
Stateless. There’s no handshake, no connection tracking, no retransmission. Wireblast sends SYNs and counts them. Whatever the far end replies goes to its kernel as normal, unless you’ve turned on a receive mode. A SYN bigger than its headers carries filler payload, so --packet-size still works.

​
IMIX

The internet mix: a spread of frame sizes closer to real traffic than any single size. Mean frame size is 362 bytes. Sizes are total Ethernet frame bytes including FCS, the same units as --packet-size, which IMIX otherwise ignores.
A real run:
Sizes are interleaved smoothly, not sent in batches of seven then four then one. Wireblast expands the mix into a 12-entry cycle using weighted round-robin, the same smooth scheduling nginx uses, so the instantaneous bit rate stays near the average instead of pulsing. It’s fully deterministic and reproducible.

​
Raw Ethernet

No IP, no ports. A fixed EtherType and a repeating payload byte. Useful for testing switches, tag handling, or anything that shouldn’t care what’s inside the frame.
Uses --ethertype, --payload-byte, --packet-size, --vlan and the MAC flags. Every IP and flow flag is ignored.
--dst-mac is required. Raw frames carry no IP addresses, so there’s nothing to resolve a next hop from:
EtherType must be 0x0600 or above. Below that the field is a length, not a type.

​
PCAP replay

Replays a real capture, frame for frame. Covered in full on PCAP replay.
--pcap implies --mode pcap, so you can leave --mode off.

​
Receive-only

Transmits nothing; counts what arrives. This is the receiver half of a two-box test.
Needs a --rx-mode other than none, or it would do nothing at all, and Wireblast says so rather than sitting there:
Read transmit and receive before pointing this at a live interface.

​
Which flags apply