Frame Header

pcapkit.protocols.misc.pcap.frame contains Frame only, which implements extractor for frame headers * of PCAP, whose structure is described as below:

typedef struct pcaprec_hdr_s {
    guint32 ts_sec;     /* timestamp seconds */
    guint32 ts_usec;    /* timestamp microseconds */
    guint32 incl_len;   /* number of octets of packet saved in file */
    guint32 orig_len;   /* actual length of packet */
} pcaprec_hdr_t;

class pcapkit.protocols.misc.pcap.frame.Frame(file=None, length=None, **kwargs)[source]

Bases: Protocol[Frame]

Per packet frame header extractor.

This class currently supports parsing of the following protocols, which are registered in the self.__proto__ attribute:

Index

Protocol

pcapkit.const.reg.linktype.LinkType.ETHERNET

pcapkit.protocols.link.ethernet.Ethernet

pcapkit.const.reg.linktype.LinkType.IPV4

pcapkit.protocols.internet.ipv4.IPv4

pcapkit.const.reg.linktype.LinkType.IPV6

pcapkit.protocols.internet.ipv6.IPv6
Parameters

  • *args (Any) – Arbitrary positional arguments.

  • **kwargs (Any) – Arbitrary keyword arguments.

Return type

Protocol[PT]

__post_init__(file: BinaryIO, length: Optional[int] = None, *, num: int, header: DataType_Header, **kwargs: Any) → None[source]
__post_init__(*, num: int, header: DataType_Header, **kwargs: Any) → None

Initialisation.

Parameters

  • file (Optional[BinaryIO]) – Source packet stream.

  • length (Optional[int]) – Length of packet data.

  • num (int) – Frame index number.

  • header (Header) – Global header of the PCAP file.

  • **kwargs (Any) – Arbitrary keyword arguments.

See also

For construction argument, please refer to make().

Return type

None

__index__()[source]

Index of the frame.

Parameters

self (Optional[Frame]) – Frame object or None.

Return type

int

Returns

If the object is initiated, i.e. self._fnum exists, returns the frame index number of itself; else raises UnsupportedCall.

Raises

UnsupportedCall – This protocol has no registry entry.

property name: str

Name of corresponding protocol.

Return type

str

property length: Literal[16]

Header length of corresponding protocol.

Return type

Literal[16]

property header: Header

Global header of the PCAP file.

Return type

Header

classmethod register(code, module, class_)[source]

Register a new protocol class.

Notes

The full qualified class name of the new protocol class should be as {module}.{class_}.

Parameters
Return type

None

index(name)[source]

Call ProtoChain.index.

Parameters

name (str | Protocol | Type[Protocol]) – name to be searched

Returns

First index of name.

Raises

IndexNotFound – if name is not present

Return type

int

read(length=None, *, _read=True, **kwargs)[source]

Read each block after global header.

Parameters

  • length (Optional[int]) – Length of packet data.

  • _read (bool) – If the class is called in a parsing scenario.

  • **kwargs (Any) – Arbitrary keyword arguments.

Returns

Parsed packet data.

Return type

DataType_Frame

Raises

EOFError – If self._file reaches EOF.

make(*, timestamp=None, ts_sec=None, ts_usec=None, incl_len=None, orig_len=None, packet, nanosecond=False, **kwargs)[source]

Make frame packet data.

Parameters

  • timestamp (Optional[float | Decimal]) – UNIX-Epoch timestamp

  • ts_sec (Optional[int]) – timestamp seconds

  • ts_usec (Optional[int]) – timestamp microseconds

  • incl_len (Optional[int]) – number of octets of packet saved in file

  • orig_len (Optional[int]) – actual length of packet

  • packet (bytes) – raw packet data

  • nanosecond (bool) – nanosecond-resolution file flag

  • **kwargs (Any) – Arbitrary keyword arguments.

Returns

Constructed packet data.

Return type

bytes

_decode_next_layer(dict_, proto=None, length=None)[source]

Decode next layer protocol.

Parameters

  • dict_ (Frame) – info buffer

  • proto (Optional[int]) – next layer protocol index

  • length (Optional[int]) – valid (non-padding) length

Returns

current protocol with packet extracted

Return type

dict

__proto__: DefaultDict[int, tuple[str, str]]

Protocol index mapping for decoding next layer, c.f. self._decode_next_layer & self._import_next_layer. The values should be a tuple representing the module name and class name.

Type

DefaultDict[int, tuple[str, str]]

Data Structures

class pcapkit.protocols.data.misc.pcap.frame.Frame(frame_info, time, number, time_epoch, time_delta, len, cap_len)[source]

Bases: Info

Frame header of PCAP file.

Parameters

  • *args (VT) – Arbitrary positional arguments.

  • **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

frame_info: FrameInfo

Metadata information.

time: datetime

Timestamp instance.

number: int

Frame index.

time_epoch: Decimal

UNIX timestamp.

len: int

Number of octets of packet saved in file.

cap_len: int

Actual length of packet.

protocols: str

Protocol chain.

class pcapkit.protocols.data.misc.pcap.frame.FrameInfo(ts_sec, ts_usec, incl_len, orig_len)[source]

Bases: Info

Frame metadata information.

Parameters

  • *args (VT) – Arbitrary positional arguments.

  • **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

ts_sec: int

Timestamp seconds.

ts_usec: int

Timestamp microseconds.

incl_len: int

Number of octets of packet saved in file.

orig_len: int

Actual length of packet.

*

https://wiki.wireshark.org/Development/LibpcapFileFormat#Record_.28Packet.29_Header