Fos-R, the synthetic network traffic generator

Table of contents

Ask DeepWiki

Fos-R is a high-quality and high-throughput network traffic generator based on ML models. Fos-R can be used for:

  • creating in a few minutes network datasets lasting for weeks, to learn AI models or to evaluate intrusion detection systems;
  • generating background traffic in cyber ranges so the exercise is more realistic and attacks are more difficult to detect.

Try it online!


Loading…

The online version has limited performance and features. Download Fos-R for the full experience!

Get Fos-R

Build version 135a35d4, compiled on 2026-09-11 (changelog).

Graphical interface

Linux

Target Binary file .deb package
x86 (32 bits) link link
x86 (64 bits) link link
ARM (32 bits) link link
ARM (64 bits) link link

Windows

Target Binary file
x86 (64 bits) link
x86 (32 bits) link

Command-line interface

Linux

Target Binary file .deb package
x86 (32 bits) link link
x86 (64 bits) link link
ARM (32 bits) link link
ARM (64 bits) link link

Windows

Target Binary file
x86 (64 bits) link
x86 (32 bits) link

How to use

Fos-R contains several subcommands.

Pcap creation

Check the “Network file” section for more information on how to customize the generation.

If you want to generate a large pcap file, you may not have enough RAM to fit the entire dataset. In that case, use the -p efficient --no-order-pcap to generate an out-of-order pcap, and then use a tool like reordercap to reorder the pcap file. The RAM usage is minimal and is constant relative to the output pcap size with these options.

Create a pcap file for the described network. For deterministic generation, specify -t, --tz and --seed

Usage: fosr-cli create-pcap [OPTIONS] --network <NETWORK> --duration <DURATION> <--default-models <DEFAULT_MODELS>|--custom-models <CUSTOM_MODELS>>

Options:
  -o, --outfile <OUTFILE>
          Output pcap file for synthetic network packets [default: output.pcap]
      --taint
          Taint the packets
  -p, --profile <PROFILE>
          The generation profile to use. Either "fast" that optimizes CPU use but the entire dataset must fit in RAM, "efficient" that requires less RAM but is slower or "auto" for a smart selection. [default: auto] [possible values: fast, efficient, auto]
  -n, --network <NETWORK>
          Path to the network file
  -d, --duration <DURATION>
          Minimum pcap traffic duration described in human-friendly time, such as "15days 30min 5s"
  -t, --start-time <START_TIME>
          Beginning time of the pcap in RFC3339 style ("2025-05-01 10:28:07") or a Unix timestamp. By default, use the current time. Date time is considered to be in the timezone specified with --tz
  -f, --flow-per-day <FLOW_PER_DAY>
          Average number of flows to generate per day. Actual number of generated flows can be lower or higher
  -j, --jobs <JOBS>
          Number of generation jobs. By default, use half the available cores
  -s, --seed <SEED>
          Seed for random number generation
  -m, --default-models <DEFAULT_MODELS>
          Use a default model [possible values: cicids17, cupid, dedale, ccd]
      --alpha <ALPHA>
          Pseudo-counts for the Bayesian network. Increase to artificially favor diversity. Must be at least 1. [default: 1]
      --custom-models <CUSTOM_MODELS>
          Use a custom model
      --tz <TZ>
          Timezone of the generated, used for realistic work hours. By default, local timezone is used. Use a IANA time zone (like Europe/Paris) or an abbreviation (like CET). The offset is assumed constant during the generation time range
      --no-order-pcap
          Disable the temporal sorting of the generated pcap. Reduce significantly the RAM usage when used with "--profile efficient"
  -h, --help
          Print help

Dataset augmentation

In this mode, Fos-R creates a pcap that resembles a dataset Fos-R has learned from.

Create a pcap file that extends a dataset. For deterministic generation, specify -t, --tz and --seed

Usage: fosr-cli augment-dataset [OPTIONS] --duration <DURATION> <--default-models <DEFAULT_MODELS>|--custom-models <CUSTOM_MODELS>>

Options:
  -o, --outfile <OUTFILE>
          Output pcap file for synthetic network packets [default: output.pcap]
      --taint
          Taint the packets
  -p, --profile <PROFILE>
          The generation profile to use. Either "fast" that optimizes CPU use but the entire dataset must fit in RAM, "efficient" that requires less RAM but is slower or "auto" for a smart selection. [default: auto] [possible values: fast, efficient, auto]
  -d, --duration <DURATION>
          Minimum pcap traffic duration described in human-friendly time, such as "15days 30min 5s"
  -t, --start-time <START_TIME>
          Beginning time of the pcap in RFC3339 style ("2025-05-01 10:28:07") or a Unix timestamp. The date cannot be ealier than 1970. By default, use the current time. Date time is considered to be in the timezone specified with --tz
  -j, --jobs <JOBS>
          Number of generation jobs. By default, use half the available cores
  -s, --seed <SEED>
          Seed for random number generation
  -m, --default-models <DEFAULT_MODELS>
          Use a default model [possible values: cicids17, cupid, dedale, ccd]
      --custom-models <CUSTOM_MODELS>
          Use a custom model
      --tz <TZ>
          Timezone of the generated, used for realistic work hours. By default, local timezone is used. Use a IANA time zone (like Europe/Paris) or an abbreviation (like CET). The offset is assumed constant during the generation time range
      --no-order-pcap
          Disable the temporal sorting of the generated pcap. Reduce significantly the RAM usage when used with "--profile efficient"
  -h, --help
          Print help

Untaint pcap file

Remove the Fos-R taint from a pcap file

Usage: fosr-cli untaint --input <INPUT> --output <OUTPUT>

Options:
  -i, --input <INPUT>    Pcap file to untaint
  -o, --output <OUTPUT>  Pcap file output
  -h, --help             Print help

Split-untaint pcap file

Split a pcap file between original and Fos-R packets

Usage: fosr-cli split-untaint <INPUT>

Arguments:
  <INPUT>  Pcap file to untaint

Options:
  -h, --help  Print help

Network file

To use the “create-pcap” command, you must provide a network file that describe the network you want to generate data for.

Here is a minimal network file with a user (IP address: 192.168.0.9) and a server (IP address: 192.168.0.8) which provides two services: an SSH server (on port 2222) and an HTTP server.

metadata:
  title: Sample network
networks:
  - subnet: 192.168.0.0
    mask: 24
    hosts:
      - interfaces:
          - ip_addr: 192.168.0.8
            services:
              - http
              - ssh:2222
          - ip_addr: public
      - interfaces:
          - ip_addr: 192.168.0.9

Besides metadata, a network file consists of a list of hosts, which contain a list of interfaces.

The next example showcases the different available fields:

metadata:
  title: Sample network # Mandatory. The name of the network.
  desc: A sample network file to show all the different available fields # Optional. A description of the network.
  author: Jane Doe # Optional. Author of the file.
  date: 2025/11/05 # Optional. Last modification date.
  version: 0.1.0 # Optional. The version number of this network file. Format is free.
  format: 1 # Reserved for now. The version will be bumped when the format changes.

networks:
  - subnet: 192.168.0.0 # Mandatory. The subnet address
    mask: 24 # Mandatory. The subnet mask
    name: "LAN" # Optional: subnet name
    hosts:
    - hostname: host1 # Optional. The hostname of the host.
      os: linux # Optional (default value: linux). The OS of the host. Possibles values: "linux", "windows".
      type: server  # Optional (default value: "server" if there is at least one service, "user" otherwise). Possible values: "user" (client of services), "server" (proposes services) or "router" (neither of those)
      interfaces:
      - mac_addr: 00:14:2A:3F:47:D8 # Optional. The MAC address of that interface
        services: # Optional (default value: empty list). The list of available services
        - http:8080 # an HTTP server on port 8080
        - https     # an HTTPS server
        - ssh       # an SSH server
        ip_addr: 192.168.0.8 # Mandatory. The IP address of this interface.
      - ip_addr: public # This host has an interface with a public IP
    - interfaces:
        - ip_addr: 192.168.0.11 # Another host with a single interface
internet: # Additional Internet hosts
    - hostname: dns-server
      interfaces:
      - services: [dns]
        ip_addr: 8.8.8.8

This format is still experimental and may change in a next version.

Fos-R & other software

Feel free to contact us if you would like some help integrating Fos-R in your tool!

Direct pcap analysis

If you would like to avoid generating a large pcap file on your machine but would prefer the analysis of Zeek, tshark, or another tool, you can use a fifo to redirect the output of Fos-R to the input of any software.

Create a fifo:

mkfifo /tmp/fifo-fosr

Then, in two terminals, launch:

zeek -C -r /tmp/fifo-fosr

and:

fosr create-pcap [your parameters] -o /tmp/fifo-fosr

This method does not work with tshark with the -2 parameter that requires to seek backwards on the input.

Wireshark

To visualize easily the taint on packets generated by Fos-R on Wireshark, right click on any column name > Column Preferences... > +. Set the fields of the new column as follow:

  • Title: Fos-R
  • Type: Custom
  • Custom Expression: ip.flags&4>0
  • Field occurrence: 0.

Finally, consider moving the column up in the columns list.

Alternatively, you can modify the configuration file of Wireshark and add the line "Fos-R", "%Cus:ip.flags&4>0:0:R" in the gui.column.format list.

How it works

Fos-R generates data with a four-staged generation, as indicated in the schema below.

If you want to know more about the science behind Fos-R, check the publications.

Fos-R library

Fos-R also includes a Rust library that exposes the main parts of the software. Its documentation is here. You can add the stable version of Fos-R to a Rust project with:

cargo add fosr-lib

For the experimental version:

cargo add --git https://gitlab.inria.fr/pirat-public/Fos-R.git fosr-lib.

The Fos-R library is licensed under GPL-3.0.

Real-world uses

BreizhCTF 2025

Fos-R created background network traffic for the Pirhack challenge during the BreizhCTF 2025 hacking competition for about 600 participants. During that competition, Fos-R was deployed on 750 virtual machines for a total of 23,000 cumulated hours.

Education

Fos-R was also used for smaller CTF competitions used for education, such as TCE CTF and RESSI CTF.

Limitations

While Fos-R aims to produce high-quality generation, it still relies on some assumptions and is not suitable for all use cases. Here is what Fos-R should not be used for:

  • works relying on deep packet inspection (DPI). The payloads generated by Fos-R are replayed and may be semantically incorrect.
  • works for advanced networking analysis. Fos-R does not simulate caching or routing. Besides, it simulates an omniscient sensor that would magically capture all emitted packets.
  • anonymizing a dataset. Fos-R has no guarantee about the privacy protection of the training data.

If you are a researcher interested in helping us lift some of the assumptions Fos-R relies on, please contact us!

Publications

  • Synthetic Network Traffic Generation for Intrusion Detection Systems: a Systematic Literature Review
    • Published in ESORICS 2025 International Workshops, 2025
    • Authors: Pierre-François Gimenez (Inria)
  • TADAM: Learning Timed Automata From Noisy Observations
    • Published in SIAM International Conference on Data Mining (SDM25), 2025
    • Authors: Lénaïg Cornanguer (CISPA), Pierre-François Gimenez (Inria)
  • FlowChronicle: Synthetic Network Flow Generation through Pattern Set Mining
    • Published in 20th International Conference on emerging Networking EXperiments and Technologies (CoNEXT), 2024
    • Authors: Joscha Cüppers (CISPA), Adrien Schoen (Inria), Gregory Blanc (Télécom SudParis), Pierre-Francois Gimenez (Inria)
  • A Tale of Two Methods: Unveiling the limitations of GAN and the Rise of Bayesian Networks for Synthetic Network Traffic Generation
    • Published in 9th International Workshop on Traffic Measurements for Cybersecurity (WTMC 2024), 2024
    • Authors: Adrien Schoen (Inria), Gregory Blanc (Télécom SudParis), Pierre-François Gimenez (CentraleSupélec), Yufei Han (Inria), Frédéric Majorczyk (DGA-MI), Ludovic Mé (Inria)

The following software have been created for Fos-R:

Contributors

  • Inria: Pierre-François Gimenez, Adrien Schoen, Pol Jaouen
  • CISPA: Lénaïg Cornanguer, Joscha Cüppers
  • CentraleSupélec: Dorian Bachelot, Evan Morin, Florentin Labelle, Samuel Cordon, Quentin Blin

Contact

You can contact the maintainer at .

Fos-R originates from research carried out by the PIRAT research team and is supported by Inria.