Repository navigation
fix(toolkit): dpkt misreads SYN/FIN/RST when the TCP NS bit is set #1618
Description
With engine='dpkt', a TCP segment with the NS bit set has its flags misread: a SYN reads as a FIN.
Repro on main (d6f627481): one valid SYN, data offset 5.
| Engine | NS set | NS clear |
|---|---|---|
| default | syn=1 fin=0 | syn=1 fin=0 |
| dpkt | syn=0 fin=1 | syn=1 fin=0 |
| scapy | syn=1 fin=0 | syn=1 fin=0 |
Cause:
pcapkit/toolkit/dpkt.py:742(and:807) doesflags = bin(tcp.flags)[2:].zfill(8), then readsflags[5],[6]and[7].- In dpkt 1.9.8,
tcp.flagsis 9 bits wide, with NS as bit 8. - With NS set the string has 9 characters, so every index lands one bit low.
Expected: RST, SYN and FIN are read from the low octet, e.g. with tcp.flags & 0xFF or dpkt's TH_* constants. The result must not depend on NS or the reserved bits.
Found by the #1614 cross-review; I reproduced it. Blocked until #1614 merges, because it edits pcapkit/toolkit/dpkt.py.
Activity
JarryShaw commentedon Oct 10, 2026
Blocked until #1614 merges, because it edits
pcapkit/toolkit/dpkt.py.JarryShaw commentedon Oct 10, 2026
Unblocked: #1614 merged. A worker is on it.
fix(toolkit): dpkt reads SYN, FIN and RST from the flags octet whatev…