You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(dumpkit): pcap output drops the input's snaplen, thiszone and sigfigs #1165
Describe the bug
With format='pcap' (after #1164), the written global header keeps the input's magic, byte order, nanosecond flag and link type, but not its snaplen, thiszone or sigfigs. Every output file carries snaplen 262144, the Header default.
To Reproduce
On the #1164 branch, extract any examples/captures/*.pcap except in.pcap with format='pcap' and compare header bytes 16–19. For example, http.pcap has ffff0000 (65535) and its output has 00000400. 16 captures differ only there, and the records are identical.
Expected behavior
The output header should carry the input header's snaplen, thiszone and sigfigs.
Additional context PCAPIO._dump_header (pcapkit/dumpkit/pcap.py:~129-142) builds Header from byteorder and nanosecond only, and Extractor._open_output forwards only protocol/byteorder/nanosecond. Found by the #1164 cross-review. The new tests only use in.pcap, whose snaplen happens to be the default.
Blocked until#1164 merges: the pcap output path this fixes only exists on that branch, and the fix would touch pcapkit/foundation/extraction.py and pcapkit/dumpkit/pcap.py alongside it.
Activity
JarryShaw commentedon Oct 6, 2026
Blocked until #1164 merges: the pcap output path this fixes only exists on that branch, and the fix would touch
pcapkit/foundation/extraction.pyandpcapkit/dumpkit/pcap.pyalongside it.JarryShaw commentedon Oct 7, 2026
Unblocked: #1164 merged at 01:45Z. A worker is on it now.
fix(dumpkit): pcap output drops the input's snaplen, thiszone and sig…