Skip to content

fix(toolkit): the dpkt engine traces no TCP on a raw-IP link type #1548

Closed

Description

@JarryShaw

Describe the bug
On a raw-IP link type, the dpkt engine traces and reassembles no TCP.

Reproduction
examples/captures/tcp.pcap, with Ethernet stripped and saved as a classic PCAP with LINKTYPE 228 (IPv4). The default engine traces [(1, 2, 6, 7)], and dpkt traces [].

Expected behavior
The same flows as the default engine.

System information
Linux, CPython 3.14.7, dpkt as installed in the repo venv, main at 16fbea054.

Additional context
For a raw-IP link type the engine builds packets as dpkt.ip.IP (pcapkit/foundation/engines/dpkt.py:484). tcp_traceflow and tcp_reassembly (pcapkit/toolkit/dpkt.py:728-733 and :658-665) only find the IP layer through packet.ip or packet.ip6, and otherwise return None. A bare IP has neither attribute.

Found while investigating #1518. The scapy engine raises MissingKeyError('IP') on the same file; that is #1517.

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions