Skip to content

docs(engines): the dpkt engine silently drops PCAP-NG Simple Packet Blocks - #1370

Merged
JarryShaw merged 1 commit into
mainfrom
docs/1361-dpkt-spb
Oct 8, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
docs/1361-dpkt-spb

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner
  • Searched for similar pull requests
  • Followed the coding style (make pylint, make mypy, make isort) — not run; docs and a docstring only
  • make test passes, and a test case covers the change — tests/project only (389 passed, 1 skipped); docs-only, so no new test
  • Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A, added centrally

What is the purpose of your pull request?

  • docs — documentation only

Description of your pull request and other information

Closes #1361

dpkt.pcapng.Reader.__iter__ (dpkt 1.9.8, dpkt/pcapng.py:685-703) yields only EPB (:694) and PB (:698) blocks; everything else falls through to # just ignore other blocks (:703), the Simple Packet Block included. Measured on examples/captures/test.pcapng (4 EPB + 1 SPB, 2 sections): default 5 frames, scapy 5, dpkt 4.

The new rst block and the napoleon-rendered docstring both parse under docutils with halt_level=2; a full Sphinx build was not run.

…locks

dpkt.pcapng.Reader yields only Enhanced and (obsolete) Packet Blocks and
skips every other block, Simple Packet Blocks included. Document that limit
in the DPKT section of 3rdparty.rst and in the DPKT class docstring.

Closes #1361
@JarryShaw JarryShaw added docs Pull requests that change documentation only (docs: subject prefix) review: pending No verdict for the current head - never reviewed, or the head moved since the last one review: running A cross-review is in flight against the current head - no verdict yet and removed review: pending No verdict for the current head - never reviewed, or the head moved since the last one labels Oct 7, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

Cross-review verdict on 36b8a346f: GOOD TO GO (Sonnet reviewed; author Opus).

  • Every claim checks out against the installed dpkt 1.9.8. Reader.__iter__ (pcapng.py:685-703) yields only PCAPNG_BT_EPB (:694) and PCAPNG_BT_PB (:698), and falls through to # just ignore other blocks (:703) without a warning.
  • The frame counts reproduce. test.pcapng is SHB, 2×IDB, 3×EPB, SPB (342 octets) and 4 non-packet blocks, then a second section of SHB, IDB and EPB. dpkt yields [314, 328, 32, 314] and drops the SPB at frame 4. The default engine and scapy both give 5. The second SHB is not the cause, since the EPB after it is read.
  • The docstring change is code-free. engines/dpkt.py gains +7/−0, all inside the DPKT docstring. The duplicate .. _DPKT: target produces no Sphinx warning.
  • Tests and build. tests/project gives 389 passed. A dummy Sphinx build raises no warning on 3rdparty.rst.

A related limitation, which this PR rightly leaves alone and I am filing separately: Reader reads only the first Interface Description Block (pcapng.py:589-603). Every later interface's linktype and timestamp resolution is therefore ignored.

@JarryShaw JarryShaw added review: good-to-go Cross-review at the current head says ready; CI state is separate and removed review: running A cross-review is in flight against the current head - no verdict yet labels Oct 7, 2026
@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Coverage: 88.97% (unit tier, Python 3.14, 36b8a346f, Unit Tests run success)

Package Statements Missed Branches Partial Cover
pcapkit (top level) 104 4 20 4 93.55%
pcapkit/const 18777 1032 2348 843 90.27%
pcapkit/corekit 1949 84 606 20 94.91%
pcapkit/dumpkit 189 1 68 1 99.22%
pcapkit/foundation 2443 102 852 39 94.39%
pcapkit/interface 112 7 40 5 92.11%
pcapkit/protocols 16013 206 4178 177 98.06%
pcapkit/toolkit 539 74 168 3 84.58%
pcapkit/utilities 429 4 122 4 98.55%
pcapkit/vendor 4409 2359 1006 158 42.84%

Per-file detail: the coverage-html artifact of this run.

@JarryShaw
JarryShaw merged commit bb4fb6f into main Oct 8, 2026
43 checks passed
@JarryShaw
JarryShaw deleted the docs/1361-dpkt-spb branch October 8, 2026 00:54
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Oct 8, 2026
@JarryShaw JarryShaw added this to the PyPCAPKit v1.5 milestone Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs Pull requests that change documentation only (docs: subject prefix)

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

docs(engines): the dpkt engine silently drops PCAP-NG Simple Packet Blocks

1 participant