You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(toolkit): the pypcapfile engine silently drops TCP behind an IPv4 AH header #1593
With engine='pypcapfile', TCP carried behind an IPsec AH header over IPv4 (protocol 51) is dropped from TCP reassembly and tracing. No warning is given.
Default engine: one TCP datagram with payload b'data'. pcapkit/protocols/internet/internet.py:102 dissects AH.
pypcapfile: no TCP datagram, and no warning.
Cause:_transport (pcapkit/toolkit/pypcapfile.py:459) returns None unless the protocol is 6, and nothing steps over AH. AH over IPv6 is already covered by #1535's warning.
Expected: step over AH, using its Payload Length, to reach the TCP, as the default engine does. Failing that, warn once per capture.
Found by the #1575 worker and its cross-review; I reproduced it independently. Blocked until #1575 merges.
Work has started ahead of #1575 merging, together with #1590–#1593 and #1596 because all five are in the same pypcapfile.py header walk. It is on a branch built on #1575's head 1de91947b. The PR opens, rebased onto main, once #1575 merges.
Activity
JarryShaw commentedon Oct 10, 2026
Work has started ahead of #1575 merging, together with #1590–#1593 and #1596 because all five are in the same
pypcapfile.pyheader walk. It is on a branch built on #1575's head1de91947b. The PR opens, rebased ontomain, once #1575 merges.fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…