Repository navigation
fix(toolkit): scapy reads TCP inside an ICMP-quoted 6in4 datagram #1627
Description
With engine='scapy', a TCP segment inside an ICMP error's quoted datagram is handed to TCP reassembly and tracing when the quoted datagram is 6in4. The default engine and dpkt do not read TCP out of a quoted datagram.
Repro on main (ee324e1dc). The capture is Ethernet, then IPv4 (protocol 1), then ICMP Destination Unreachable quoting IPv4 (protocol 41) carrying IPv6 and then TCP. The cells show TCP reassembly inputs / trace inputs.
| Quoted datagram | default | dpkt | scapy |
|---|---|---|---|
| 6in4, then TCP | 0/0 | 0/0 | 1/1 |
| 4in4, then TCP (control) | 0/0 | 0/0 | 0/0 |
| TCP (control) | 0/0 | 0/0 | 0/0 |
Scapy dissects the quote as IPerror, and IPerror with protocol 41 binds a full IPv6 layer, which then carries a real TCP.
Expected: scapy reads no TCP inside an ICMP-quoted datagram, as the default engine does.
The #1624 cross-review found this; I reproduced it. #1624 does not change it.
Blocked until #1624 merges, because #1624 rewrites scapy's _tcp_carrier.
Activity
JarryShaw commentedon Oct 12, 2026
Unblocked: #1624 merged. A worker is on it together with #1623, since both edit
pcapkit/toolkit/scapy.py.fix(toolkit): scapy cuts 4in6 at each Payload Length and skips ICMP q…