Repository navigation
fix(engines): scapy engine keeps the first section's timestamp resolution after a second PCAP-NG section #1522
Description
On main 6af87f608, the input is a PCAP-NG with two sections, built by the #1511 reviewer: section 1 uses if_tsresol=9, section 2 uses microseconds. The scapy engine stamps section 2's frames 1000x too small:
| engine | first frame | last frame |
|---|---|---|
| default | 2017-07-14 02:40:00.000774 |
02:40:00.006195 |
| scapy | 1500000000.000774011 |
1500000.000006195 |
Scapy's own rdpcap gives the same wrong value. Its PcapNgReader keeps section 1's interface table, and with it tsresol, after a second Section Header Block.
Expected: each section's interfaces are reset at its SHB, as the PCAP-NG specification defines a section. Fix it in pcapkit's reader subclass rather than waiting for scapy.
Blocked until #1511 merges, because that PR adds the scapy reader subclasses (engines/scapy.py) where the fix belongs.
Activity
JarryShaw commentedon Oct 10, 2026
Unblocked: #1511 has merged, so the scapy reader subclasses are on
maininpcapkit/foundation/engines/scapy.py. A worker is on the fix there.fix(engines): reset the scapy reader's interfaces at each PCAP-NG sec…