You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(protocols): the default engine has no LINKTYPE_NULL (BSD loopback) dissector #1574
The default engine has no dissector for LINKTYPE_NULL (0, BSD loopback), so frames on such an interface are never dissected. scapy dissects them.
Repro: on main (a3da376dd), frames 3 and 4 of examples/captures/many_interfaces.pcapng sit on interface 10, whose link type is LINKTYPE_NULL. Their protocol chain is just NULL, while the frames on interface 0 read Ethernet:IPv4:UDP:Raw.
LinkType.NULL is missing from PCAPNG.__proto__, whose keys are only 1, 228 and 229.
pcapkit/protocols/link/ has no loopback protocol.
Cause of a misfiled gap:#1502 blamed the missing datagrams in many_interfaces.pcapng (34 against scapy's 36) on LINKTYPE_RAW. The #1573 worker found that this capture has no type-101 frames; the gap is these two NULL frames. So the many_interfaces labels in the Gap(1502) row belong to this issue.
Expected: a BSD loopback link layer. It is a 4-octet address-family header in the capturing host's byte order, with 2 = IPv4 and 24/28/30 = IPv6. It dispatches to IPv4/IPv6 and is registered for LINKTYPE_NULL in the PCAP frame and PCAP-NG dispatch tables, so the many_interfaces datagrams match scapy's.
Blocked: this waits until #1550, #1563 and #1573 merge. It edits the same dispatch tables (protocols/misc/pcap/frame.py, protocols/misc/pcapng.py) and Gap rows as #1502, and it will land together with #1502.
Unblocked: #1550, #1563 and #1573 have all merged (e9f3340f7). One worker is doing this in a single PR with #1502, which handles LINKTYPE_RAW. This issue adds a BSD loopback layer for LINKTYPE_NULL and registers it in the PCAP and PCAP-NG dispatch tables.
Activity
JarryShaw commentedon Oct 10, 2026
Unblocked: #1550, #1563 and #1573 have all merged (
e9f3340f7). One worker is doing this in a single PR with #1502, which handles LINKTYPE_RAW. This issue adds a BSD loopback layer for LINKTYPE_NULL and registers it in the PCAP and PCAP-NG dispatch tables.fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…
fix(protocols): dissect LINKTYPE_RAW by version nibble; add the BSD l…