Repository navigation
fix(engines): pypcapfile engine reads zero frames from a big-endian PCAP, without warning #1512
Description
With engine='pypcapfile', examples/captures/big_endian.pcap and big_endian_nanosecond.pcap give 0 frames, against 3 from the default engine.
Measured in a Python 3.11 venv with pypcapfile 0.12.0: pcapfile.savefile.load_savefile(f, layers=0, lazy=False).packets has length 0 for both files, against 7 for tcp.pcap. The engine iterates that empty list (pcapkit/foundation/engines/pypcapfile.py:233-250), so the result is silently empty.
Expected: read the frames, or refuse with a warning or error, as the engine already does for PCAP-NG.
Found by #1508, where it is a Gap(0) row in tests/foundation/engines/test_engine_agreement_runtime.py. Refs #1202.
Activity
JarryShaw commentedon Oct 9, 2026
Blocked until #1508 merges. That PR adds this defect's known-failure row in
tests/foundation/engines/test_engine_agreement_runtime.py, and a fix has to delete that row, so the fix waits for the row to exist onmain.test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
JarryShaw commentedon Oct 9, 2026
Still blocked, now on #1521 instead of #1508. #1508 has merged, but #1521 edits
foundation/engines/pypcapfile.py, which this fix needs. Unblocks when #1521 merges.JarryShaw commentedon Oct 10, 2026
Still blocked, now on #1535 instead of #1521. #1521 has merged, but #1535 (open,
review: good-to-go) editspcapkit/foundation/engines/pypcapfile.py, and this fix needs that file too. Unblocks when #1535 merges.JarryShaw commentedon Oct 10, 2026
Unblocked: #1535 has merged (
ea883a648), sopcapkit/foundation/engines/pypcapfile.pyis free. A worker is now root-causing why pypcapfile returns no packets for a big-endian file. It is working only on the engine, and leavingtoolkit/pypcapfile.pyto #1537.fix(engines): the pypcapfile engine reads the PCAP records pypcapfile…
fix(engines): the pypcapfile engine reads the PCAP records pypcapfile…