Repository navigation
fix(engines): the scapy engine ignores a PCAP-NG interface's if_tsoffset #1549
Description
Describe the bug
The scapy engine ignores a PCAP-NG interface's if_tsoffset (option 14), so its timestamps are short by the offset.
Reproduction
tests/foundation/engines/test_dpkt_pcapng_interfaces_unit._capture() has a second section whose interface carries tsoffset=100. For that section's frame, the default engine gives 1464843750100.1201171875. With #1546's section fix, the PR's author measured 1464843750000.1201171875 from the scapy engine, which is 100 s short.
Expected behavior
Add the interface's if_tsoffset, as the default engine and the dpkt engine (pcapkit/foundation/engines/dpkt.py:166-168) do.
System information
Linux, CPython 3.14.7, scapy 2.7.0, main at 16fbea054.
Additional context
scapy/utils.py 2.7.0 has no tsoffset handling at all, and neither does pcapkit/foundation/engines/scapy.py. The fix belongs where #1546 resets the interface table, so this is blocked until #1546 merges.
Found by the #1546 author.
Activity
JarryShaw commentedon Oct 10, 2026
Unblocked: #1546 has merged, so the scapy reader now resets its interfaces per section. A worker is fixing #1503, #1517 and #1549 together in one PR, because all three need
_reader_type()inpcapkit/foundation/engines/scapy.py.fix(engines): take a scapy packet's link type and clock from its inte…
fix(engines): take a scapy packet's link type and clock from its inte…