Skip to content

fix(engines): the pypcapfile engine stops reading at a zero-length PCAP record #1571

Closed

Description

@JarryShaw

With engine='pypcapfile', reading stops silently at the first PCAP record whose captured length is 0, so every later frame is dropped. The default engine reads past such a record.

Repro: a little-endian PCAP with three records of 75, 0 and 77 captured octets.

Cause: pypcapfile's record reader returns None when not raw_packet_data (pcapfile/savefile.py:221), and its loader treats None as end of file. A caplen of 0 is a legal record.

Expected: the same frames as the default engine. Keep reading past a zero-length record, and handle a truncated final record as the default engine does.

Found by the #1569 review. It is being fixed in #1569, which already rewrites the record loop in pcapkit/foundation/engines/pypcapfile.py.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 10, 2026
  2. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 10, 2026
  3. added this to the PyPCAPKit v1.5 milestone on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions