Repository navigation
fix(toolkit): pypcapfile engine silently drops TCP in VLAN-tagged or tunnelled frames #1537
Description
The pypcapfile engine silently leaves TCP in 802.1Q/QinQ-tagged frames, and in tunnelled frames (6in4, 6in6, 4in4), out of TCP reassembly and tracing. It does this for IPv4 as well as IPv6.
pcapfile 0.12.0's Ethernet.payload_type (pcapfile/protocols/linklayer/ethernet.py:77-90) decodes only EtherType 0x0800. A VLAN tag (0x8100) therefore leaves the payload undecoded, and _network() in pcapkit/toolkit/pypcapfile.py finds no IP layer.
The default engine sees TCP in all of these. This was measured in the #1535 review on synthetic frames; none of the sample captures carries a VLAN tag.
Expected: warn once per capture, as #1535 does for untagged TCP over IPv6, or read through the tag.
Blocked until #1535 merges, since both change the same detection code in toolkit/pypcapfile.py.
Activity
JarryShaw commentedon Oct 10, 2026
Unblocked: #1535 has merged (
ea883a648) with its warn-once for TCP over IPv6 intoolkit/pypcapfile.py. A worker is now building VLAN, QinQ, 6in4, 6in6 and 4in4 captures and deciding between reading through the encapsulation and warning once per capture. It ownstoolkit/pypcapfile.py; #1512 has the engine file.fix(toolkit): pypcapfile TCP reads past VLAN tags, warns of tunnels, …
fix(toolkit): pypcapfile TCP reads past VLAN tags, warns of tunnels, …
fix(toolkit): pypcapfile TCP reads past VLAN tags, warns of tunnels, …
fix(toolkit): pypcapfile TCP reads past VLAN tags, warns of tunnels, …