Repository navigation
fix(toolkit): one undissectable TCP header aborts a whole pyshark extraction #1611
Description
With engine='pyshark', one TCP header that tshark cannot fully dissect aborts the whole extraction with a bare AttributeError. Every other flow in the capture is lost with it.
Repro on main (c43e9318c), Python 3.11, tshark 4.6.9. A capture holds one good flow (SYN, data, FIN) plus one extra frame, and is run with TCP flow tracing on:
| Extra frame | default | pyshark |
|---|---|---|
| none | 1 flow | 1 flow |
| TCP with data offset 0 | 1 flow | AttributeError (pyshark xml_layer.py:79) |
| frame cut inside the TCP header | 1 flow | AttributeError (pyshark xml_layer.py:79) |
Expected: pyshark skips the frame that has no usable TCP header, as the default engine does, and traces the rest. The error comes from reading a field tshark did not emit, in tcp_traceflow (pcapkit/toolkit/pyshark.py).
Found by the #1605 cross-review; I reproduced it. Blocked until #1605 merges, because it rewrites tcp_traceflow.
Activity
JarryShaw commentedon Oct 10, 2026
Blocked until #1605 merges, because it rewrites
pcapkit/toolkit/pyshark.py.JarryShaw commentedon Oct 10, 2026
Unblocked: #1605 merged as
d6f627481. One worker is now fixing this together with #1612, since both are in the pyshark engine.fix(toolkit): pyshark skips partial TCP headers and traces first frag…
fix(toolkit): pyshark skips partial TCP headers and traces first frag…
refactor(toolkit): revert pyshark's agreement-only code (#1708)