[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Closes #1611
Closes #1612

#1611. tcp_traceflow now traces a pyshark TCP layer only if it has tcp.urgent_pointer. Octets 18–19 hold the last field of the fixed header. I checked dissect_tcp in epan/dissectors/packet-tcp.c for Wireshark 2.6.0, 3.0.0 and 4.6.0. In all three, tshark adds that field whenever the Data Offset is at least 5 and all 20 octets were captured. It is added after every field tcp_traceflow reads.

• Data Offset 0–4 or a header cut inside its first 14 octets no longer raises AttributeError.
• A frame cut at 14–19 TCP octets used to be traced. It is now skipped, as in the default engine.

#1612. FileCapture now runs tshark with ip.defragment and ipv6.defragment set to FALSE (PyShark.OVERRIDE_PREFS). As a result, TCP in a fragmented datagram is traced at its first fragment, both IPv4 and IPv6: (1, 2)/(6, 7), no longer (1, 5)/(6, 10).

• Side effect in tshark's TCP analysis. With reassembly off, tshark sizes a fragmented segment from its first fragment alone, so it sees a gap in the sequence. Later frames of that stream, fragments or not, then gain tcp.analysis.lost_segment, and their tcp.completeness changes. Those fields reach the frame records packet2dict builds. tcp_traceflow reads none of them, so tracing is unaffected, and a new test checks this on such a stream.
• Fixtures. The 23 fixture captures carry no fragmented TCP. On them, every field of every frame is the same with reassembly on and off, except the first and last fragments in ipv6.pcap.

Tests. tests/toolkit/test_pyshark_unit.py:

• adds fake-based tests that run on 3.14;
• adds real-tshark tests that compare against the default engine frame by frame, and skip unless pyshark runs.

The first-fragment test from #1605 no longer excludes pyshark. test_runtime_engines.py now asserts the FileCapture call with override_prefs=PyShark.OVERRIDE_PREFS. Every new test fails with its fix reverted, except one guard: PySharkFixedHeaderTests::test_a_whole_header_is_traced passes on main too. The engine gap table in the docs is updated.

[github-actions]

Coverage: 89.72% (unit tier, Python 3.14, 396140c88, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18858	956	2366	870	91.04%
pcapkit/corekit	2366	67	760	35	96.48%
pcapkit/dumpkit	275	3	100	3	98.40%
pcapkit/foundation	2884	147	1010	36	94.07%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17089	227	4566	192	98.05%
pcapkit/toolkit	903	123	320	6	85.36%
pcapkit/utilities	494	4	146	4	98.75%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: NEEDS CHANGES at c9b32c05c. This was a Sonnet cross-review; the author ran on Opus. Only the wording needs to change; the code holds.

What the review confirmed:

• fix(toolkit): one undissectable TCP header aborts a whole pyshark extraction #1611: on 122 malformed frames and 354 snaplen-cut frames, IPv4 and IPv6, pyshark now traces exactly the frames the default engine traces, with 0 field differences. main aborts with AttributeError.
• The tcp.urgent_pointer heuristic: it held on 464 well-formed frames (every flag byte, options, data offsets 5–15, tunnels, VLAN, extension headers). Wireshark's dissect_tcp has no early return after the data-offset check.
• fix(toolkit): the pyshark engine traces fragmented TCP at the last fragment, not the first #1612: on a 158-frame fragment corpus, pyshark equals default.
• No regressions: the toolkit, engine and agreement selections give the same counts as main on Python 3.11 and 3.14.

Two fixes:

1. The OVERRIDE_PREFS comment (pcapkit/foundation/engines/pyshark.py, ~line 110) overstates the change. It says turning tshark's reassembly off changes no frame that is not a fragment. That is false for a stream that carries a fragmented TCP segment. tshark then sizes the segment from the first fragment, so later non-fragment frames gain tcp.analysis.lost_segment and a different tcp.completeness. I re-measured this with tshark 4.6.9 on such a capture. tcp_traceflow reads neither field, so tracing is unaffected, but the comment and the PR body should say so and limit the claim to the fixtures.
2. The body says every new test fails with its fix reverted. PySharkFixedHeaderTests::test_a_whole_header_is_traced passes on main. Name it as a guard.

[JarryShaw]

Verdict: GOOD TO GO at 396140c88. This is the round-2 delta review, by Sonnet; the author ran on Opus.

The product code is unchanged since round 1, which the review already confirmed.

• The reworded OVERRIDE_PREFS comment is accurate. On the new test's stream and on the review's own capture, turning reassembly off changes only tshark's TCP conversation-state fields on non-fragment frames. tcp_traceflow reads none of them.
• The new stream test exercises those frames. It fails for IPv4 and IPv6 with the engine fix reverted.
• The body names the guard correctly.
• test_pyshark_unit.py passes on both Pythons: 38 passed on 3.11 with tshark; 38 passed, 6 skipped on 3.14.

Non-blocking:

• The comment's field list omits tshark's expert annotations (_ws.expert*), which change with tcp.analysis.flags.
• "Later frames gain lost_segment" holds for some of those frames, not all.