Skip to content

fix(toolkit): pyshark reads frames to the 64-layer bound and past tshark's 802.1Q limit, and keys its fallback by the header (#1609, #1671) #1686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JarryShaw merged 1 commit into from
Oct 14, 2026
Merged

fix(toolkit): pyshark reads frames to the 64-layer bound and past tshark's 802.1Q limit, and keys its fallback by the header (#1609, #1671) #1686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions pcapkit/foundation/engines/pyshark.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,8 +566,9 @@ def _captured(self, packet: 'PySharkPacket') -> 'Optional[Captured]':

:func:`~pcapkit.toolkit.pyshark.tcp_traceflow` asks for one of a frame
:data:`~pcapkit.toolkit.pyshark.OCTETS_FILTER` matches only: one tshark
dissects TCP in (:issue:`1639`), or one with an AH or IPv6 extension
header in IPv4 (:issue:`1625`).
dissects TCP in (:issue:`1639`), one with an AH or IPv6 extension
header in IPv4 (:issue:`1625`), or one with more 802.1Q tags than
tshark dissects (:issue:`1609`).

Its link type is the one the default engine dissects it by, read from
the capture file (see :func:`_linktypes`) for the frame of this engine's
Expand Down Expand Up @@ -615,15 +616,15 @@ def _captured(self, packet: 'PySharkPacket') -> 'Optional[Captured]':
if self._exraw_failed:
return None
frnum = self._extractor._frnum
source = ('the capture file, read for the link type of a frame with an AH or IPv6 extension '
'header in IPv4, or with TCP,')
frames = ('a frame with an AH or IPv6 extension header in IPv4, with TCP, or with more 802.1Q tags '
'than tshark dissects,')
source = f'the capture file, read for the link type of {frames}'
try:
linktype = self._read_linktype(frnum)
if isinstance(linktype, str):
reason = linktype
else:
source = ('the second tshark pass, which reads the captured octets of a frame with an AH '
'or IPv6 extension header in IPv4, or with TCP,')
source = f'the second tshark pass, which reads the captured octets of {frames}'
octets = self._read_octets(int(packet.number))
if isinstance(octets, bytes):
return Captured(linktype, octets)
Expand Down
Loading
Loading