> ## Documentation Index
> Fetch the complete documentation index at: https://wireblast.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Choosing a pattern
> UDP, TCP SYN, IMIX, raw Ethernet, PCAP and receive-only. What each one emits and which flags apply.
`--mode` picks what goes on the wire. Six choices, and the wizard hides whichever fields don't apply to the one you pick.
| Mode | What it sends |
| -------------------------- | ------------------------------------------------------ |
| [`udp`](#udp) | One or many deterministic UDP flows. The default. |
| [`tcp-syn`](#tcp-syn) | Stateless TCP SYNs. No handshake, no connection state. |
| [`imix`](#imix) | The classic 7:4:1 mix of 64, 594 and 1518-byte frames. |
| [`raw`](#raw-ethernet) | A fixed EtherType and payload pattern. No IP at all. |
| [`pcap`](/patterns/pcap) | Replays an Ethernet capture file. |
| [`receive`](#receive-only) | Transmits nothing and counts what arrives. |
***
## UDP
The one to start with. Fixed-size UDP frames across as many flows as you ask for.
```bash theme={null}
sudo wireblast -i eno2 --dst-ip 192.0.2.10 --dst-port 9000 \
--packet-size 512 --flows 64 --pps 1M -d 30s
```
Uses `--src-ip`, `--dst-ip`, `--src-port`, `--dst-port`, `--vary-dst-port`, `--flows`, `--flow-order`, `--packet-size`, `--vlan`, and the MAC flags.
The IPv4 UDP checksum is left at zero, which is legal, since it's optional in IPv4. That's what lets Wireblast change ports per flow without recomputing anything per packet, and it's part of how packet construction stays allocation-free. Over IPv6 the UDP checksum is mandatory, so there it's maintained incrementally as ports and addresses change, still without a per-packet allocation.
## TCP SYN
The same flow machinery, emitting TCP SYNs instead. Checksums are correct and maintained.
```bash theme={null}
sudo wireblast -i eno2 --dst-ip 192.0.2.10 --dst-port 443 \
--flows 10000 --pps 2M -d 30s
```
**Stateless.** There's no handshake, no connection tracking, no retransmission. Wireblast sends SYNs and counts them. Whatever the far end replies goes to its kernel as normal, unless you've turned on a [receive mode](/concepts/receive).
A SYN bigger than its headers carries filler payload, so `--packet-size` still works.
## IMIX
The internet mix: a spread of frame sizes closer to real traffic than any single size.
| Frame size | Weight | Represents |
| ---------- | ------ | ------------------------------------------------------ |
| 64 B | 7 | a bare TCP ack (40-byte IP packet) |
| 594 B | 4 | the old minimum reassembly buffer (576-byte IP packet) |
| 1518 B | 1 | a full Ethernet MTU (1500-byte IP packet) |
Mean frame size is **362 bytes**. Sizes are total Ethernet frame bytes including FCS, the same units as `--packet-size`, which IMIX otherwise ignores.
```bash theme={null}
sudo wireblast -i eno2 --dst-ip 192.0.2.10 --mode imix \
--flows 64 --pps 200k -d 30s
```
A real run:
```text theme={null}
[0:05] tx 949.81 k pkts 200 kpps L1 610.96 Mbit/s L2 578.96 Mbit/s avg 362B
ran for 0:12
tx: 2.4 M packets, 868.24 MB, 199.86 kpps, L1 610.52 Mbit/s, L2 578.54 Mbit/s, avg frame 362B
```
Sizes are interleaved smoothly, not sent in batches of seven then four then one. Wireblast expands the mix into a 12-entry cycle using weighted round-robin, the same smooth scheduling nginx uses, so the instantaneous bit rate stays near the average instead of pulsing. It's fully deterministic and reproducible.
## Raw Ethernet
No IP, no ports. A fixed EtherType and a repeating payload byte. Useful for testing switches, tag handling, or anything that shouldn't care what's inside the frame.
```bash theme={null}
sudo wireblast -i eno2 --mode raw --ethertype 0x88b5 \
--dst-mac 3c:ec:ef:b4:c2:dc --packet-size 128 --pps 1M -d 30s
```
Uses `--ethertype`, `--payload-byte`, `--packet-size`, `--vlan` and the MAC flags. Every IP and flow flag is ignored.
**`--dst-mac` is required.** Raw frames carry no IP addresses, so there's nothing to resolve a next hop from:
```text theme={null}
raw Ethernet frames carry no IP addresses, so there is nothing to resolve a
next-hop MAC from.
Give an explicit --dst-mac (or fill in Destination MAC in the wizard) to continue.
```
EtherType must be `0x0600` or above. Below that the field is a length, not a type.
## PCAP replay
Replays a real capture, frame for frame. Covered in full on [PCAP replay](/patterns/pcap).
```bash theme={null}
sudo wireblast -i eno2 --pcap capture.pcap --pps 100k -d 30s
```
`--pcap` implies `--mode pcap`, so you can leave `--mode` off.
## Receive-only
Transmits nothing; counts what arrives. This is the receiver half of a two-box test.
```bash theme={null}
sudo wireblast --no-tui -i eno2 --mode receive \
--rx-mode udp-port --rx-port 9000 -d 60s -y
```
Needs a `--rx-mode` other than `none`, or it would do nothing at all, and Wireblast says so rather than sitting there:
```text theme={null}
--mode receive transmits nothing, so with --rx-mode none it would do nothing at
all. Choose what to receive: --rx-mode generated-flow, udp-port, tcp-port, cidr
or all
```
Read [transmit and receive](/concepts/receive) before pointing this at a live interface.
***
## Which flags apply
| | udp | tcp-syn | imix | raw | pcap | receive |
| -------------------------------- | ---- | ------- | ------- | ------------ | -------- | ------------ |
| `--src-ip` / `--dst-ip` | yes | yes | yes | | | |
| `--src-port` / `--dst-port` | yes | yes | yes | | | |
| `--flows` / `--flow-order` | yes | yes | yes | | | |
| `--packet-size` | yes | yes | ignored | yes | ignored | |
| `--ethertype` / `--payload-byte` | | | | yes | | |
| `--vlan` | yes | yes | yes | yes | | |
| `--dst-mac` | auto | auto | auto | **required** | optional | |
| `--pps` / `--bps` | yes | yes | yes | yes | yes | |
| `--rx-mode` | yes | yes | yes | yes | yes | **required** |