Repository navigation
fix(engines): pyshark engine counts a systemd Journal Export Block as a frame #1515
Description
The #1508 worker measured examples/captures/test.pcapng: engine='pyshark' gives 6 frames, while the default engine gives 5. tshark numbers the Journal Export Block as frame 5, and read_frame takes every tshark frame (pcapkit/foundation/engines/pyshark.py:243-249). I have not reproduced this myself.
Expected: frame counts agree with the default engine. Skip tshark frames that come from a non-packet block.
Correction: in CI this case first crashed on a bug in #1508's own harness, which is now fixed, not on the TCP-flags bug. test.pcapng has no TCP flows. Whether CI's tshark 4.2.2 also counts the block will show on #1508's parity jobs. Found by #1508 (Gap(0)). Refs #1202.
Activity
JarryShaw commentedon Oct 9, 2026
Blocked until #1508 merges. That PR adds this defect's known-failure row in
tests/foundation/engines/test_engine_agreement_runtime.py, and a fix has to delete that row, so the fix waits for the row to exist onmain.test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
JarryShaw commentedon Oct 9, 2026
Unblocked: #1508 has merged, so this defect's known-failure row is on
main. A worker is on the fix, and the fix PR deletes the row.fix(engines): the pyshark engine skips non-packet PCAP-NG blocks (#1515)
fix(engines): the pyshark engine skips non-packet PCAP-NG blocks (#1515)
fix(engines): the pyshark engine skips non-packet PCAP-NG blocks (#1515)
fix(engines): the pyshark engine skips non-packet PCAP-NG blocks (#1515)
fix(engines): the pyshark engine skips non-packet PCAP-NG blocks (#1515…