Skip to content

fix(toolkit): dpkt hands over nothing behind a VLAN tag stack it does not finish decoding in two passes #1654

Closed

Description

@JarryShaw

Describe the bug
With engine='dpkt', an Ethernet frame whose VLAN tag stack dpkt 1.9.8 does not finish decoding in two passes gets no TCP reassembly, trace or IPv4 reassembly input. Examples are three 802.1ad tags, five 802.1Q tags, and 802.1ad followed by four 802.1Q. The default engine and scapy read the IPv4/TCP behind the tags.

Ethernet._unpack_data (dpkt/ethernet.py:90) reads at most two tags per pass. __init__ runs one more pass when the first finds no decoder, and then stops, so dpkt never decodes the payload.

Reproduction on main (b375656e1), Python 3.14.8, dpkt 1.9.8, scapy 2.7.0. Each frame is Ethernet, then the tags (first TPID as the Ethernet type, each tag's next type the following TPID), then IPv4 and a TCP segment with 4 octets of data. Cells are TCP reassembly / trace / IPv4 reassembly inputs:

tags default dpkt scapy
802.1ad ×3 1 / 1 / 1 0 / 0 / 0 1 / 1 / 1
802.1Q ×5 1 / 1 / 1 0 / 0 / 0 1 / 1 / 1
802.1ad, 802.1Q ×4 1 / 1 / 1 0 / 0 / 0 1 / 1 / 1

Three 802.1Q tags raise ProtocolError on main. That is #1646, and its fix leaves these rows as they are.

Expected behavior
dpkt hands over the default engine's inputs for any tag stack the default engine reads. If dpkt cannot decode the payload itself, the toolkit has to walk the remaining tags off the captured octets.

Activity

  1. JarryShaw commented on Oct 13, 2026

    @JarryShaw
    OwnerAuthor

    Blocked until the #1637/#1638 dpkt PR merges, which edits the same tag handling (_wire_hdr_len, _vlan_tpids).

  2. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 13, 2026
  3. moved this to Blocked in PyPCAPKiton Oct 13, 2026
  4. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 13, 2026
  5. JarryShaw commented on Oct 13, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1655 has merged. A worker has this, in a single dpkt PR that also covers #1651 and the dpkt parts of #1609 and #1626.

  6. moved this from Blocked to WIP in PyPCAPKiton Oct 13, 2026
  7. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions