You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(engines): the dpkt engine applies the first PCAP-NG interface's linktype and timestamp resolution to every frame #1379
dpkt.pcapng.Reader (dpkt 1.9.8) reads only the first Interface Description Block of a PCAP-NG file. Its constructor loops until it hits an IDB and then breaks (site-packages/dpkt/pcapng.py:589-603), and that one IDB supplies the linktype and timestamp resolution for every packet. Found while cross-reviewing #1370.
Consequence for extract(engine='dpkt'): in a capture whose interfaces differ, for example test.pcapng with 2 IDBs in section 1 and another in section 2, frames on any later interface get interface 0's linktype and if_tsresol. That can mean wrong timestamps, or a frame dissected as the wrong link type. The default engine reads every IDB.
Needed:
Measure. Build or find a capture whose IDBs differ in linktype or if_tsresol, compare dpkt against the default engine, and report the differences.
Activity
JarryShaw commentedon Oct 8, 2026
Unblocked: #1370 and #1377 have merged, and no open PR now edits
engines/dpkt.pyor3rdparty.rst. A worker is starting on the measurement.fix(engines): the dpkt engine applies the first PCAP-NG interface's l…
fix(engines): the dpkt engine applies the first PCAP-NG interface's l…