Repository navigation
fix(toolkit): pyshark traces TCP inside GRE, VXLAN, MPLS, PPPoE, L2TP, LLC/SNAP and ISL #1639
Description
With engine='pyshark', TCP is traced inside any encapsulation tshark dissects, including GRE, VXLAN, MPLS, PPPoE, L2TP, 802.3 LLC/SNAP and Cisco ISL. The default engine leaves each of these Raw and traces nothing.
Repro on main (b375656e1), Python 3.11 and tshark 4.6.9. Each cell shows TCP reassembly inputs / trace inputs. - means pyshark declines TCP reassembly, which it does on every frame.
| Capture | default | pyshark | pypcapfile |
|---|---|---|---|
| IPv4, TCP (control) | 1/1 | -/1 | 1/1 |
| IPv4, GRE, IPv4, TCP | 0/0 | -/1 | 0/0 |
| IPv4, GRE, IPv4, Hop-by-Hop, TCP | 0/0 | -/1 | 0/0 |
| IPv4, UDP 4789, VXLAN, Ethernet, IPv4, TCP | 0/0 | -/1 | 0/0 |
| IPv4, UDP 4789, VXLAN, Ethernet, IPv4, Hop-by-Hop, TCP | 0/0 | -/1 | 0/0 |
| MPLS, IPv4, TCP | 0/0 | -/1 | 0/0 |
| PPPoE, PPP, IPv4, TCP | 0/0 | -/1 | 0/0 |
| IPv4, UDP 1701, L2TP, PPP, IPv4, TCP | 0/0 | -/1 | 0/0 |
| 802.3, LLC/SNAP, IPv4, TCP | 0/0 | -/1 | 0/0 |
| Cisco ISL, Ethernet, IPv4, TCP | 0/0 | -/1 | 0/0 |
Confirmed in code: _carrier (pcapkit/toolkit/pyshark.py:458) walks every layer tshark dissected up to the first tcp, keeps the nearest ip or ipv6, and stops at nothing. The #1623/#1627 cross-review reported the two Hop-by-Hop rows. The plain rows show the Hop-by-Hop header is not the cause. The #1625 fix, now in review, makes the two Hop-by-Hop rows agree; the plain rows stay.
Expected: pyshark traces no TCP past a layer the default engine leaves raw. tcp_segment (pcapkit/toolkit/pcap.py) reads only the layers that engine's dissector builds.
Blocked until the PR for #1625 merges, because it rewrites pyshark's tcp_traceflow.
Activity
JarryShaw commentedon Oct 13, 2026
Widening to DLT 12 and 14. Over these link types the default engine reads no IP, so plain TCP over raw IP gets 0 reassembly and 0 trace inputs. pyshark still traces it, because tshark maps both link types to raw IP. DLT 101 is the control, and there both engines trace.
Measured on Python 3.11 with tshark 4.6.9, on #1642's head merged into
main. The Sonnet review of #1642 measured these rows unchanged frommain: 171 and 170 of 400 random frames disagree, before and after.JarryShaw commentedon Oct 13, 2026
Unblocked: #1642 merged (
86ff27131). A worker is on it, changingpcapkit/toolkit/pyshark.pyonly, because #1655 and #1652 still own dpkt and scapy.fix(toolkit): pyshark traces no TCP inside encapsulations the default…
fix(toolkit): pyshark traces no TCP inside encapsulations the default…