Skip to content

feat(protocols): the default engine has no LINKTYPE_NULL (BSD loopback) dissector #1574

Closed

Description

@JarryShaw

The default engine has no dissector for LINKTYPE_NULL (0, BSD loopback), so frames on such an interface are never dissected. scapy dissects them.

Repro: on main (a3da376dd), frames 3 and 4 of examples/captures/many_interfaces.pcapng sit on interface 10, whose link type is LINKTYPE_NULL. Their protocol chain is just NULL, while the frames on interface 0 read Ethernet:IPv4:UDP:Raw.

  • LinkType.NULL is missing from PCAPNG.__proto__, whose keys are only 1, 228 and 229.
  • pcapkit/protocols/link/ has no loopback protocol.

Cause of a misfiled gap: #1502 blamed the missing datagrams in many_interfaces.pcapng (34 against scapy's 36) on LINKTYPE_RAW. The #1573 worker found that this capture has no type-101 frames; the gap is these two NULL frames. So the many_interfaces labels in the Gap(1502) row belong to this issue.

Expected: a BSD loopback link layer. It is a 4-octet address-family header in the capturing host's byte order, with 2 = IPv4 and 24/28/30 = IPv6. It dispatches to IPv4/IPv6 and is registered for LINKTYPE_NULL in the PCAP frame and PCAP-NG dispatch tables, so the many_interfaces datagrams match scapy's.

Blocked: this waits until #1550, #1563 and #1573 merge. It edits the same dispatch tables (protocols/misc/pcap/frame.py, protocols/misc/pcapng.py) and Gap rows as #1502, and it will land together with #1502.

Activity

  1. added
    featPull requests that add a new capability (feat: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 10, 2026
  2. JarryShaw commented on Oct 10, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1550, #1563 and #1573 have all merged (e9f3340f7). One worker is doing this in a single PR with #1502, which handles LINKTYPE_RAW. This issue adds a BSD loopback layer for LINKTYPE_NULL and registers it in the PCAP and PCAP-NG dispatch tables.

  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 10, 2026
  4. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    featPull requests that add a new capability (feat: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions