Skip to content

fix(engines): dpkt on a nanosecond PCAP and scapy truncate the timestamp under a low decimal precision #1689

Closed as not planned

Description

@JarryShaw

Describe the bug
At a decimal precision below about 16 digits, dpkt on a nanosecond PCAP and scapy on PCAP and PCAP-NG hand reassembly and the tracer a truncated timestamp. The default engine wraps the same arithmetic in localcontext(prec=64) (pcapkit/protocols/misc/pcap/frame.py:263, pcapkit/protocols/misc/pcapng.py:1810), so it is unaffected. The precision is the caller's: decimal.getcontext().prec = 12 set anywhere in the process is enough.

  • dpkt, ns PCAP: pcapkit/foundation/engines/dpkt.py:292, value = hdr.tv_sec + (hdr.tv_usec / self._divisor) with a Decimal divisor. It copies dpkt/pcap.py:399, which the _upstream fallback reaches.
  • scapy: pcapkit runs scapy's readers in the caller's context. PCAP: scapy/utils.py:1586 (2.7.0; :1631 in 2.8.0), EDecimal(pkt_info.sec + power * pkt_info.usec). PCAP-NG: :2072 (:2141), EDecimal((tshigh << 32) + tslow) / tsresol.
  • Probably also pcapkit/foundation/engines/scapy.py:217, packet.time += self._offset, for a PCAP-NG if_tsoffset. This was checked only as an expression: 1500000000.123456 + 1 at prec 12 gives 1500000001.12.
  • Unaffected: default; dpkt on µs PCAP (float arithmetic) and on PCAP-NG (engines/dpkt.py:181); pypcapfile (integer division). pyshark was not measured.

Reproduction
main at f20d0a600; Linux, CPython 3.14.8, dpkt 1.9.8, scapy 2.7.0. Each capture holds one Ethernet/IPv4/TCP frame at ts_sec=1500000000, with frac 123456 µs or 123456789 ns. Each is extracted with trace=True inside decimal.localcontext() at the given prec. In every cell the IPv4 reassembly input, the trace input and the trace file name (…_9-<ts>.json) agree with each other.

capture default, any prec dpkt, prec 12 / 10 scapy, prec 12 / 10
PCAP µs 1500000000.123456 1500000000.123456 1500000000.12 / 1500000000.0
PCAP ns 1500000000.1234567 1500000000.12 / 1500000000.0 1500000000.12 / 1500000000.0
PCAP-NG µs or ns exact exact 1500000000.12 / 1500000000.0

At prec 28 every engine agrees. Found while reviewing the #1668 fix, which wraps dpkt's µs exact (engines/dpkt.py:296) in localcontext(prec=64) for the same reason.

Expected behavior
At any ambient precision, every engine hands over the default engine's value. One approach: compute dpkt's ns timestamp under localcontext(prec=64), and run scapy's readers and the if_tsoffset addition under one too. A stored dpkt frame's value would then change only where it was truncated before.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 14, 2026
  2. moved this to Pending in PyPCAPKiton Oct 14, 2026
  3. JarryShaw commented on Oct 14, 2026

    @JarryShaw
    OwnerAuthor

    Blocked until #1690 merges. Its fix edits the same PCAP reader in pcapkit/foundation/engines/dpkt.py (:296, four lines below this issue's :292).

  4. added
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    and removed
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 14, 2026
  5. moved this from Pending to Blocked in PyPCAPKiton Oct 14, 2026
  6. JarryShaw commented on Oct 14, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1690 merged at 01:19Z (8035434a2). No open PR touches pcapkit/foundation/engines/dpkt.py or pcapkit/foundation/engines/scapy.py. A worker is on it.

  7. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 14, 2026
  8. moved this from Blocked to WIP in PyPCAPKiton Oct 14, 2026
  9. JarryShaw commented on Oct 14, 2026

    @JarryShaw
    OwnerAuthor

    Stopped under the ruling on #1687: third-party engines are best effort, and agreement-only work is being reverted rather than extended. This issue is agreement work, so I recommend closing it as won't-fix. That will be confirmed together with the revert list on #1687.

  10. added
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    and removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 14, 2026
  11. moved this from WIP to Needs decision in PyPCAPKiton Oct 14, 2026
  12. JarryShaw commented on Oct 14, 2026

    @JarryShaw
    OwnerAuthor

    go ahead and close it

  13. JarryShaw commented on Oct 14, 2026

    @JarryShaw
    OwnerAuthor

    Closed as won't-fix, as ruled: under #1687, third-party engines are best effort, and this was agreement-only work.

  14. removed
    needs: decisionWaiting on the maintainer to decide — not blocked by other work
    on Oct 14, 2026
  15. moved this from Needs decision to Done in PyPCAPKiton Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions