Repository navigation
fix(protocols): the default engine does not dissect LINKTYPE_RAW (101) in PCAP and PCAP-NG #1502
Description
Describe the bug
A frame with link type LINKTYPE_RAW (101, raw IP) is left as RAW by the default engine, so its IP datagram is never reassembled. scapy dissects it.
Reproduction
On examples/captures/test.pcapng, frame 2 comes out as RAW. The IPv4 datagrams are [(1,), (4,), (5,)] from the default engine and [(1,), (2,), (4,), (5,)] from scapy. many_interfaces.pcapng gives 34 datagrams versus 36.
Expected behavior
Link type 101 dispatches to IPv4 or IPv6 by the version nibble, and the datagrams match scapy's.
System information
Linux, CPython 3.14.7, main at 00aa1fc90.
Additional context
Not registered in the PCAP frame dispatch (pcapkit/protocols/misc/pcap/frame.py:90), in PCAP-NG (pcapkit/protocols/misc/pcapng.py:699), or in dpkt's mapping (pcapkit/foundation/engines/dpkt.py:401).
Found by the #1202 foundation round-trip slice; reproduced on main.
Activity
JarryShaw commentedon Oct 9, 2026
Blocked until the #1202 foundation-slice test PR (branch
test/1202-foundation-roundtrips) merges. That PR adds this defect'sGaprow, and the fix must delete the row.JarryShaw commentedon Oct 9, 2026
Still blocked, now on #1523 instead of #1508. #1508 has merged, but #1523 edits
protocols/misc/pcapng.py, which this fix needs. Unblocks when #1523 merges.JarryShaw commentedon Oct 10, 2026
Unblocking early to meet a deadline. A worker started from
main(a3da376dd) on #1502, #1504 and #1558 together, since all three needpcapkit/protocols/misc/pcapng.py. It will rebase over #1523 when that merges, keeping every #1523 hunk.JarryShaw commentedon Oct 10, 2026
The worker split this out of #1573, which now closes #1504 and #1558 only. #1502 stays open, blocked until #1550, #1563 and #1573 have all merged.
LINKTYPE_RAWdispatched by the version nibble in PCAP-NG, frame 2 oftest.pcapngbecomesIPv4:UDP:Raw.foundation/engines/dpkt.py, which fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP tracing (#1501, #1520, #1548) #1550 owns.Gap(1520)rows (fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP tracing (#1501, #1520, #1548) #1550) and exposestest.pcapng/scapy/ipv4, which is fix(engines): take a scapy packet's link type and clock from its interface (#1503, #1517, #1549) #1563's row.protocols/misc/pcap/frame.py, and that edit is approved.many_interfaceslabels: the labels in this issue'sGaprow are notLINKTYPE_RAW. That capture has no type-101 frames. Its gap is twoLINKTYPE_NULLframes, now filed as feat(protocols): the default engine has no LINKTYPE_NULL (BSD loopback) dissector #1574 and landing with this one.JarryShaw commentedon Oct 10, 2026
Unblocked: #1550, #1563 and #1573 have all merged (
e9f3340f7). One worker is doing this together with #1574 in a single PR: LINKTYPE_RAW dispatch in the PCAP, PCAP-NG and dpkt tables, plus a BSD loopback layer for LINKTYPE_NULL.fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…