You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(toolkit): pyshark's fallback ends the extraction when tshark reports no ip.dst, and keys a source-routed segment by the route's last hop #1671
Describe the bug
With engine='pyshark', _from_layers (pcapkit/toolkit/pyshark.py:601-625 at #1670's head 6890f38f6) keys a TCP segment by tshark's ip.dst, without a guard (:622). Two consequences:
The extraction ends. When tshark reports no ip.dst, a bare AttributeError escapes extract(). Measured on main (6c17c7e1b), 3.11 with tshark 4.6.9: TCP behind an LSRR or SSRR option of length 9, where tshark reports "Suboption would go past end of option". 12 such captures raised.
Wrong destination. While an LSRR or SSRR route is still live, tshark moves ip.dst to the route's last address, so a source-routed segment is keyed by the last hop. The default engine keys it by the header's destination.
#1670 avoids both whenever it reads the frame's octets (_network, :827-836). _from_layers is still the fallback where the frame cannot be had (:955-963), and there both remain.
Expected behavior
The fallback never raises on a missing field, and it keys a source-routed segment by the header's destination (tshark's ip.cur_rt, or the octets at ip.version.pos), as the default engine does.
Blocked until #1670 merges, because it rewrites this file. The pyshark part of #1609 waits on the same PR.
Unblocked: #1670 has merged. A worker has this, together with the pyshark part of #1609. It will re-measure the layer-bound cells on main, since #1670's octet walk may already fix some of them, and fix the rest.
Activity
JarryShaw commentedon Oct 13, 2026
Unblocked: #1670 has merged. A worker has this, together with the pyshark part of #1609. It will re-measure the layer-bound cells on
main, since #1670's octet walk may already fix some of them, and fix the rest.fix(toolkit): pyshark reads frames to the 64-layer bound and past tsh…
refactor(toolkit): revert pyshark's agreement-only code (#1708)