Repository navigation
fix(toolkit): the scapy engine dates a Simple Packet Block with the time it was read #1503
Description
Describe the bug
A PCAP-NG Simple Packet Block carries no timestamp. scapy leaves its construction time on the packet, and the scapy adapter passes that on as the capture time.
Reproduction
On examples/captures/test.pcapng, frame 4 (an SPB) is 1791577350.34… from scapy and 0 from the default engine. The scapy value changes on every run.
Expected behavior
The same value as the default engine, with no wall-clock time leaking in.
System information
Linux, CPython 3.14.7, main at 00aa1fc90.
Additional context
pcapkit/toolkit/scapy.py:186 passes float(packet.time) unconditionally.
Found by the #1202 foundation round-trip slice; reproduced on main.
Activity
JarryShaw commentedon Oct 9, 2026
Blocked until the #1202 foundation-slice test PR (branch
test/1202-foundation-roundtrips) merges. That PR adds this defect'sGaprow, and the fix must delete the row.JarryShaw commentedon Oct 9, 2026
Still blocked, now on #1511 instead of #1508. #1508 has merged, but #1511 is editing the same file this fix needs. Unblocks when #1511 merges.
JarryShaw commentedon Oct 10, 2026
Unblocked: #1511 has merged (
2d088a745). A worker is on this together with #1517, since both fixes are inpcapkit/toolkit/scapy.py. One PR will close both.JarryShaw commentedon Oct 10, 2026
Blocked again, this time on the #1522 fix. The worker found that the link type and the "no timestamp" signal are only visible in
_reader_type()(pcapkit/foundation/engines/scapy.py:61-121). scapy never copies either onto the packet, and the #1522 fix edits that same function. Once the #1522 PR merges, one PR will fix #1503 and #1517 across the engine andtoolkit/scapy.py.JarryShaw commentedon Oct 10, 2026
Unblocked: #1546 has merged, so the scapy reader now resets its interfaces per section. A worker is fixing #1503, #1517 and #1549 together in one PR, because all three need
_reader_type()inpcapkit/foundation/engines/scapy.py.fix(engines): take a scapy packet's link type and clock from its inte…
fix(engines): take a scapy packet's link type and clock from its inte…