Repository navigation
fix(engines): the dpkt engine's own PCAPNGReader drops Simple Packet Blocks #1520
Description
examples/captures/test.pcapng has 4 Enhanced Packet Blocks and 1 Simple Packet Block. extract(engine='dpkt') gives 4 frames; the default engine and scapy give 5.
#1361 documented this as a dpkt limit, but the PCAP-NG reader the engine uses belongs to pcapkit. PCAPNGReader in pcapkit/foundation/engines/dpkt.py (around :124 on main 6af87f608) picks out only Enhanced_Packet_Block and Packet_Block, so the Simple Packet Block is dropped there, in our own code.
Expected: the reader yields Simple Packet Blocks as well. An SPB carries no timestamp, so take the default engine's choice for it, and its original length is in the block.
PR #1508 carries this as a known-failure row, currently cited as Gap(1361). That issue is closed, so no fix would ever delete the row; it will be re-pointed here.
Blocked until both #1508 (which adds the row) and #1511 (which is editing the same PCAPNGReader) merge.
Activity
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
test(foundation): reassembly, traceflow, engine and registry round tr…
JarryShaw commentedon Oct 10, 2026
Unblocked: #1508 and #1511 have both merged. A worker is on this together with #1501, since both fixes are in
pcapkit/foundation/engines/dpkt.py. One PR will close both and delete bothGaprows.fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP …
fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP …
fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP …
fix(engines): dpkt float timestamps, Simple Packet Blocks and raw-IP …