Repository navigation
fix(toolkit): dpkt reads TCP and IP fragments behind MPLS and Cisco ISL #1638
Description
With engine='dpkt', TCP and IP fragments behind an MPLS label stack or a Cisco ISL header go to TCP reassembly and tracing, and to IPv4 or IPv6 reassembly. The default engine dissects neither. It reads Ethernet:MPLS, or an 802.3 length field for ISL, then Raw.
Repro on main (b375656e1), Python 3.14 and dpkt 1.9.8. Python 3.11 gives the same. TCP rows show TCP reassembly inputs / trace inputs. Fragment rows show IPv4, IPv6 reassembly inputs over two fragments.
| Capture | default | dpkt | scapy |
|---|---|---|---|
| IPv4, TCP (control) | 1/1 | 1/1 | 1/1 |
| MPLS, IPv4, TCP | 0/0 | 1/1 | 0/0 |
| MPLS, IPv6, TCP | 0/0 | 1/1 | 0/0 |
| Cisco ISL, Ethernet, IPv4, TCP | 0/0 | 1/1 | 0/0 |
| MPLS, IPv4 fragments | 0, 0 | 2, 0 | 0, 0 |
| MPLS, IPv6 fragments | 0, 0 | 0, 2 | 0, 0 |
| Cisco ISL, Ethernet, IPv4 fragments | 0, 0 | 2, 0 | 0, 0 |
Confirmed in code: dpkt's Ethernet pops an MPLS label stack and guesses IPv4 or IPv6 from the next nibble (dpkt/ethernet.py:106 in 1.9.8). It also unwraps ISL (:146). Either way it names the payload eth.ip or eth.ip6. _network (pcapkit/toolkit/dpkt.py:412) takes that layer, so _tcp_carrier, _first_ipv4 and ipv6_reassembly all start below the encapsulation. dpkt decodes GRE, PPPoE and LLC/SNAP too, but under other names, so those cases agree.
Expected: dpkt takes a network layer only where the default engine dissects one. That engine reads only the layers its dissector builds (pcapkit/toolkit/pcap.py: tcp_segment, ipv4_reassembly, ipv6_reassembly). Link.__proto__ (pcapkit/protocols/link/link.py:75) sends MPLS (0x8847) and an 802.3 length to Raw.
The #1623/#1627 worker reported the MPLS case. I reproduced it and found ISL.
Activity
JarryShaw commentedon Oct 13, 2026
A worker is on it together with #1637, since both edit
pcapkit/toolkit/dpkt.py.