Skip to content

fix(toolkit): the pypcapfile engine silently drops TCP behind an IPv4 AH header #1593

Closed

Description

@JarryShaw

With engine='pypcapfile', TCP carried behind an IPsec AH header over IPv4 (protocol 51) is dropped from TCP reassembly and tracing. No warning is given.

Repro on main (e9f3340f7), 3.11, pypcapfile 0.12.0: Ethernet + IPv4 (protocol 51) + AH (next header 6) + TCP carrying data.

  • Default engine: one TCP datagram with payload b'data'. pcapkit/protocols/internet/internet.py:102 dissects AH.
  • pypcapfile: no TCP datagram, and no warning.

Cause: _transport (pcapkit/toolkit/pypcapfile.py:459) returns None unless the protocol is 6, and nothing steps over AH. AH over IPv6 is already covered by #1535's warning.

Expected: step over AH, using its Payload Length, to reach the TCP, as the default engine does. Failing that, warn once per capture.

Found by the #1575 worker and its cross-review; I reproduced it independently. Blocked until #1575 merges.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 10, 2026
  2. JarryShaw commented on Oct 10, 2026

    @JarryShaw
    OwnerAuthor

    Work has started ahead of #1575 merging, together with #1590–#1593 and #1596 because all five are in the same pypcapfile.py header walk. It is on a branch built on #1575's head 1de91947b. The PR opens, rebased onto main, once #1575 merges.

  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 10, 2026
  4. moved this from Blocked to WIP in PyPCAPKiton Oct 10, 2026
  5. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions