Skip to content

fix(engines): the dpkt engine applies the first PCAP-NG interface's linktype and timestamp resolution to every frame #1379

Closed

Description

@JarryShaw

dpkt.pcapng.Reader (dpkt 1.9.8) reads only the first Interface Description Block of a PCAP-NG file. Its constructor loops until it hits an IDB and then breaks (site-packages/dpkt/pcapng.py:589-603), and that one IDB supplies the linktype and timestamp resolution for every packet. Found while cross-reviewing #1370.

Consequence for extract(engine='dpkt'): in a capture whose interfaces differ, for example test.pcapng with 2 IDBs in section 1 and another in section 2, frames on any later interface get interface 0's linktype and if_tsresol. That can mean wrong timestamps, or a frame dissected as the wrong link type. The default engine reads every IDB.

Needed:

  • Measure. Build or find a capture whose IDBs differ in linktype or if_tsresol, compare dpkt against the default engine, and report the differences.
  • Then pick a fix: either feed per-interface linktype and resolution from pcapkit's own PCAP-NG reading into the dpkt engine, or document the limitation beside docs(engines): the dpkt engine silently drops PCAP-NG Simple Packet Blocks #1361's note in 3rdparty.rst.

Blocked on #1370 (same 3rdparty.rst section and engines/dpkt.py docstring) and #1377 (same engines/dpkt.py).

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 7, 2026
  2. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1370 and #1377 have merged, and no open PR now edits engines/dpkt.py or 3rdparty.rst. A worker is starting on the measurement.

  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  4. added a commit that references this issue on Oct 8, 2026
    5fcf07d
  5. added a commit that references this issue on Oct 8, 2026
    979dc37
  6. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 8, 2026
  7. added this to the PyPCAPKit v1.5 milestone on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions