Skip to content

fix(toolkit): pyshark's fallback ends the extraction when tshark reports no ip.dst, and keys a source-routed segment by the route's last hop #1671

Closed

Description

@JarryShaw

Describe the bug
With engine='pyshark', _from_layers (pcapkit/toolkit/pyshark.py:601-625 at #1670's head 6890f38f6) keys a TCP segment by tshark's ip.dst, without a guard (:622). Two consequences:

  • The extraction ends. When tshark reports no ip.dst, a bare AttributeError escapes extract(). Measured on main (6c17c7e1b), 3.11 with tshark 4.6.9: TCP behind an LSRR or SSRR option of length 9, where tshark reports "Suboption would go past end of option". 12 such captures raised.
  • Wrong destination. While an LSRR or SSRR route is still live, tshark moves ip.dst to the route's last address, so a source-routed segment is keyed by the last hop. The default engine keys it by the header's destination.

#1670 avoids both whenever it reads the frame's octets (_network, :827-836). _from_layers is still the fallback where the frame cannot be had (:955-963), and there both remain.

Expected behavior
The fallback never raises on a missing field, and it keys a source-routed segment by the header's destination (tshark's ip.cur_rt, or the octets at ip.version.pos), as the default engine does.

Blocked until #1670 merges, because it rewrites this file. The pyshark part of #1609 waits on the same PR.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 13, 2026
  2. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 13, 2026
  3. JarryShaw commented on Oct 13, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1670 has merged. A worker has this, together with the pyshark part of #1609. It will re-measure the layer-bound cells on main, since #1670's octet walk may already fix some of them, and fix the rest.

  4. moved this from Blocked to WIP in PyPCAPKiton Oct 13, 2026
  5. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions