TCP - Transmission Control Protocol

pcapkit.protocols.transport.tcp contains TCP only, which implements extractor for Transmission Control Protocol (TCP) *, whose structure is described as below:

Octets	Bits	Name	Description
0	0	tcp.srcport	Source Port
2	16	tcp.dstport	Destination Port
4	32	tcp.seq	Sequence Number
8	64	tcp.ack	Acknowledgement Number (if ACK set)
12	96	tcp.hdr_len	Data Offset
12	100		Reserved (must be \x00)
12	103	tcp.flags.ns	ECN Concealment Protection (NS)
13	104	tcp.flags.cwr	Congestion Window Reduced (CWR)
13	105	tcp.flags.ece	ECN-Echo (ECE)
13	106	tcp.flags.urg	Urgent (URG)
13	107	tcp.flags.ack	Acknowledgement (ACK)
13	108	tcp.flags.psh	Push Function (PSH)
13	109	tcp.flags.rst	Reset Connection (RST)
13	110	tcp.flags.syn	Synchronize Sequence Numbers (SYN)
13	111	tcp.flags.fin	Last Packet from Sender (FIN)
14	112	tcp.window_size	Size of Receive Window
16	128	tcp.checksum	Checksum
18	144	tcp.urgent_pointer	Urgent Pointer (if URG set)
20	160	tcp.opt	TCP Options (if data offset > 5)

class pcapkit.protocols.transport.tcp.TCP(file=None, length=None, **kwargs)

Bases: Transport[TCP]

This class implements Transmission Control Protocol.

This class currently supports parsing of the following protocols, which are registered in the self.__proto__ attribute:

Port Number	Protocol
21	pcapkit.protocols.application.ftp.FTP
80	pcapkit.protocols.application.http.HTTP

This class currently supports parsing of the following TCP options, which are directly mapped to the pcapkit.const.tcp.option.Option enumeration:

Option Code	Option Parser
End_of_Option_List	_read_mode_eool()
No_Operation	_read_mode_nop()
Maximum_Segment_Size	_read_mode_mss()
Window_Scale	_read_mode_ws()
SACK_Permitted	_read_mode_sackpmt()
SACK	_read_mode_sack()
Echo	_read_mode_echo()
Echo_Reply	_read_mode_echore()
Timestamps	_read_mode_ts()
Partial_Order_Connection_Permitted	_read_mode_poc()
Partial_Order_Service_Profile	_read_mode_pocsp()
CC	_read_mode_cc()
CC_NEW	_read_mode_ccnew()
CC_ECHO	_read_mode_ccecho()
TCP_Alternate_Checksum_Request	_read_mode_chkreq()
TCP_Alternate_Checksum_Data	_read_mode_chksum()
MD5_Signature_Option	_read_mode_sig()
Quick_Start_Response	_read_mode_qs()
User_Timeout_Option	_read_mode_timeout()
TCP_Authentication_Option	_read_mode_ao()
Multipath_TCP	_read_mode_mp()
TCP_Fast_Open_Cookie	_read_mode_fastopen()

This class currently supports parsing of the following Multipath TCP options, which are directly mapped to the pcapkit.const.tcp.mp_tcp_option.MPTCPOption enumeration:

Option Code	Option Parser
MP_CAPABLE	_read_mptcp_capable()
MP_JOIN	_read_mptcp_join()
DSS	_read_mptcp_dss()
ADD_ADDR	_read_mptcp_addaddr()
REMOVE_ADDR	_read_mptcp_remove()
MP_PRIO	_read_mptcp_prio()
MP_FAIL	_read_mptcp_fail()
MP_FASTCLOSE	_read_mptcp_fastclose()

Parameters

• *args (Any) – Arbitrary positional arguments.

• **kwargs (Any) – Arbitrary keyword arguments.

Return type

Protocol[PT]

classmethod __index__()

Numeral registry index of the protocol.

Return type

TransType

Returns

Numeral registry index of the protocol in IANA.

property name: Literal['Transmission Control Protocol']

Name of current protocol.

Return type

Literal[“Transmission Control Protocol”]

property length: int

Header length of current protocol.

Return type

int

property src: int

Source port.

Return type

int

property dst: int

Destination port.

Return type

int

read(length=None, **kwargs)

Read Transmission Control Protocol (TCP).

Structure of TCP header [RFC 793]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Acknowledgement Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |           |U|A|P|R|S|F|                               |
| Offset| Reserved  |R|C|S|S|Y|I|            Window             |
|       |           |G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

• length (Optional[int]) – Length of packet data.

• **kwargs (Any) – Arbitrary keyword arguments.

Return type

TCP

Returns

Parsed packet data.

make(**kwargs)

Make (construct) packet data.

Parameters

**kwargs (Any) – Arbitrary keyword arguments.

Return type

NoReturn

Returns

Constructed packet data.

classmethod register_option(code, meth)

Register an option parser.

Parameters

• code (RegType_Option) – TCP option code.

• meth (str | OptionParser) – Method name or callable to parse the option.

Return type

None

classmethod register_mp_option(code, meth)

Register an MPTCP option parser.

Parameters

• code (RegType_MPTCPOption) – MPTCP option code.

• meth (str | MPOptionParser) – Method name or callable to parse the option.

Return type

None

_read_tcp_options(size)

Read TCP option list.

Parameters

size (int) – length of option list

Return type

Option

Returns

Extracted TCP options.

Raises

ProtocolError – If the threshold is NOT matching.

_read_mode_donone(kind, *, options)

Read options request no process.

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_UnassignedOption

Returns

Parsed option data.

_read_mode_eool(kind, *, options)

Read TCP End of Option List option.

Structure of TCP end of option list option [RFC 793]:

+--------+
|00000000|
+--------+
 Kind=0

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_EndOfOptionList

Returns

Parsed option data.

_read_mode_nop(kind, *, options)

Read TCP No Operation option.

Structure of TCP maximum segment size option [RFC 793]:

+--------+
|00000001|
+--------+
 Kind=1

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_NoOperation

Returns

Parsed option data.

_read_mode_mss(kind, *, options)

Read TCP max segment size option.

Structure of TCP maximum segment size option [RFC 793]:

+--------+--------+---------+--------+
|00000010|00000100|   max seg size   |
+--------+--------+---------+--------+
 Kind=2   Length=4

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_MaximumSegmentSize

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 4.

_read_mode_ws(kind, *, options)

Read TCP windows scale option.

Structure of TCP window scale option [RFC 7323]:

+---------+---------+---------+
| Kind=3  |Length=3 |shift.cnt|
+---------+---------+---------+
     1         1         1

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_WindowScale

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 3.

_read_mode_sackpmt(kind, *, options)

Read TCP SACK permitted option.

Structure of TCP SACK permitted option [RFC 2018]:

+---------+---------+
| Kind=4  | Length=2|
+---------+---------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_SACKPermitted

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 2.

_read_mode_sack(kind, *, options)

Read TCP SACK option.

Structure of TCP SACK option [RFC 2018]:

                  +--------+--------+
                  | Kind=5 | Length |
+--------+--------+--------+--------+
|      Left Edge of 1st Block       |
+--------+--------+--------+--------+
|      Right Edge of 1st Block      |
+--------+--------+--------+--------+
|                                   |
/            . . .                  /
|                                   |
+--------+--------+--------+--------+
|      Left Edge of nth Block       |
+--------+--------+--------+--------+
|      Right Edge of nth Block      |
+--------+--------+--------+--------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_SACK

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 8.

_read_mode_echo(kind, *, options)

Read TCP echo option.

Structure of TCP echo option [RFC 1072]:

+--------+--------+--------+--------+--------+--------+
| Kind=6 | Length |   4 bytes of info to be echoed    |
+--------+--------+--------+--------+--------+--------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_Echo

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 6.

_read_mode_echore(kind, *, options)

Read TCP echo reply option.

Structure of TCP echo reply option [RFC 1072]:

+--------+--------+--------+--------+--------+--------+
| Kind=7 | Length |    4 bytes of echoed info         |
+--------+--------+--------+--------+--------+--------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_EchoReply

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 6.

_read_mode_ts(kind, *, options)

Read TCP timestamps option.

Structure of TCP timestamp option [RFC 7323]:

+-------+-------+---------------------+---------------------+
|Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
+-------+-------+---------------------+---------------------+
    1       1              4                     4

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_Timestamp

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 10.

_read_mode_poc(kind, *, options)

Read TCP partial order connection service profile option.

Structure of TCP POC-Permitted option [RFC 1693][RFC 6247]:

+-----------+-------------+
|  Kind=9   |  Length=2   |
+-----------+-------------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_PartialOrderConnectionPermitted

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 2.

_read_mode_pocsp(kind, *, options)

Read TCP partial order connection service profile option.

Structure of TCP POC-SP option [RFC 1693][RFC 6247]:

                          1 bit        1 bit    6 bits
+----------+----------+------------+----------+--------+
|  Kind=10 | Length=3 | Start_flag | End_flag | Filler |
+----------+----------+------------+----------+--------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_PartialOrderConnectionProfile

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 3.

_read_mode_cc(kind, *, options)

Read TCP connection count option.

Structure of TCP CC option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001011|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=11  Length=6

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_CC

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 6.

_read_mode_ccnew(kind, *, options)

Read TCP connection count (new) option.

Structure of TCP CC.NEW option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001100|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=12  Length=6

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_CCNew

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 6.

_read_mode_ccecho(kind, *, options)

Read TCP connection count (echo) option.

Structure of TCP CC.ECHO option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001101|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=13  Length=6

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_CCEcho

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 6.

_read_mode_chkreq(kind, *, options)

Read Alternate Checksum Request option.

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247]:

+----------+----------+----------+
|  Kind=14 | Length=3 |  chksum  |
+----------+----------+----------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_AlternateChecksumRequest

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 3.

_read_mode_chksum(kind, *, options)

Read Alternate Checksum Data option.

Structure of TCP CHKSUM [RFC 1146][RFC 6247]:

+---------+---------+---------+     +---------+
| Kind=15 |Length=N |  data   | ... |  data   |
+---------+---------+---------+     +---------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_AlternateChecksumData

Returns

Parsed option data.

_read_mode_sig(kind, *, options)

Read MD5 Signature option.

Structure of TCP SIG option [RFC 2385]:

+---------+---------+-------------------+
| Kind=19 |Length=18|   MD5 digest...   |
+---------+---------+-------------------+
|                                       |
+---------------------------------------+
|                                       |
+---------------------------------------+
|                                       |
+-------------------+-------------------+
|                   |
+-------------------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_MD5Signature

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 18.

_read_mode_qs(kind, *, options)

Read Quick-Start Response option.

Structure of TCP QSopt [RFC 4782]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Kind      |  Length=8     | Resv. | Rate  |   TTL Diff    |
|               |               |       |Request|               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   QS Nonce                                | R |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_QuickStartResponse

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 8.

_read_mode_timeout(kind, *, options)

Read User Timeout option.

Structure of TCP TIMEOUT [RFC 5482]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Kind = 28   |   Length = 4  |G|        User Timeout         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_UserTimeout

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 4.

_read_mode_ao(kind, *, options)

Read Authentication option.

Structure of TCP AOopt [RFC 5925]:

+------------+------------+------------+------------+
|  Kind=29   |   Length   |   KeyID    | RNextKeyID |
+------------+------------+------------+------------+
|                     MAC           ...
+-----------------------------------...

...-----------------+
...  MAC (con't)    |
...-----------------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_Authentication

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT larger than or equal to 4.

_read_mode_mp(kind, *, options)

Read Multipath TCP option.

Structure of MP-TCP [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|                       |
+---------------+---------------+-------+                       |
|                     Subtype-specific data                     |
|                       (variable length)                       |
+---------------------------------------------------------------+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_MPTCP

Returns

Parsed option data.

_read_mode_fastopen(kind, *, options)

Read Fast Open option.

Structure of TCP FASTOPEN [RFC 7413]:

                                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                |      Kind     |    Length     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
~                            Cookie                             ~
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

• kind (RegType_Option) – option kind value

• options (Option) – extracted TCP options

Return type

DataType_FastOpenCookie

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT valid.

_read_mptcp_unknown(kind, dlen, bits, *, options)

Read unknown MPTCP subtype.

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPUnknown

Returns

Parsed option data.

_read_mptcp_capable(kind, dlen, bits, *, options)

Read Multipath Capable option.

Structure of MP_CAPABLE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |    Length     |Subtype|Version|A|B|C|D|E|F|G|H|
+---------------+---------------+-------+-------+---------------+
|                   Option Sender's Key (64 bits)               |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
|                  Option Receiver's Key (64 bits)              |
|                     (if option Length == 20)                  |
|                                                               |
+---------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPCapable

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 20 or 32.

_read_mptcp_join(kind, dlen, bits, *, options)

Read Join Connection option.

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPJoin

Returns

Parsed option data.

Raises

ProtocolError – If the option is not given on a valid SYN/ACK packet.

_read_mptcp_dss(kind, dlen, bits, *, options)

Read Data Sequence Signal (Data ACK and Data Sequence Mapping) option.

Structure of DSS [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |    Length     |Subtype| (reserved) |F|m|M|a|A|
+---------------+---------------+-------+----------------------+
|                                                              |
|           Data ACK (4 or 8 octets, depending on flags)       |
|                                                              |
+--------------------------------------------------------------+
|                                                              |
|   Data sequence number (4 or 8 octets, depending on flags)   |
|                                                              |
+--------------------------------------------------------------+
|              Subflow Sequence Number (4 octets)              |
+-------------------------------+------------------------------+
|  Data-Level Length (2 octets) |      Checksum (2 octets)     |
+-------------------------------+------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPDSS

Returns

Parsed option data.

_read_mptcp_addaddr(kind, dlen, bits, *, options)

Read Add Address option.

Structure of ADD_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |     Length    |Subtype| IPVer |  Address ID   |
+---------------+---------------+-------+-------+---------------+
|          Address (IPv4 - 4 octets / IPv6 - 16 octets)         |
+-------------------------------+-------------------------------+
|   Port (2 octets, optional)   |
+-------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPAddAddress

Returns

Parsed option data.

Raises

ProtocolError – Invalid IP version and/or addresses.

_read_mptcp_remove(kind, dlen, bits, *, options)

Read Remove Address option.

Structure of REMOVE_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |  Length = 3+n |Subtype|(resvd)|   Address ID  | ...
+---------------+---------------+-------+-------+---------------+
                           (followed by n-1 Address IDs, if required)

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPRemoveAddress

Returns

Parsed option data.

Raises

ProtocolError – If the length is smaller than 3.

_read_mptcp_prio(kind, dlen, bits, *, options)

Read Change Subflow Priority option.

Structure of MP_PRIO [RFC 6824]:

                      1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+--------------+
|     Kind      |     Length    |Subtype|     |B| AddrID (opt) |
+---------------+---------------+-------+-----+-+--------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPPriority

Returns

Parsed option data.

Raises

ProtocolError – If the length is smaller than 3.

_read_mptcp_fail(kind, dlen, bits, *, options)

Read Fallback option.

Structure of MP_FAIL [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |   Length=12   |Subtype|      (reserved)      |
+---------------+---------------+-------+----------------------+
|                                                              |
|                 Data Sequence Number (8 octets)              |
|                                                              |
+--------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPFallback

Returns

Parsed option data.

Raises

ProtocolError – If the length is NOT 12.

_read_mptcp_fastclose(kind, dlen, bits, *, options)

Read Fast Close option.

Structure of MP_FASTCLOSE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                      Option Receiver's Key                    |
|                            (64 bits)                          |
|                                                               |
+---------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPFastclose

Returns

Parsed option data.

Raises

ProtocolError – If the length is NOT 16.

_read_join_syn(kind, dlen, bits, *, options)

Read Join Connection option for Initial SYN.

Structure of MP_JOIN-SYN [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 12  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                   Receiver's Token (32 bits)                  |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPJoinSYN

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 12.

_read_join_synack(kind, dlen, bits, *, options)

Read Join Connection option for Responding SYN/ACK.

Structure of MP_JOIN-SYN/ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 16  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                                                               |
|                Sender's Truncated HMAC (64 bits)              |
|                                                               |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPJoinSYNACK

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 20.

_read_join_ack(kind, dlen, bits, *, options)

Read Join Connection option for Third ACK.

Structure of MP_JOIN-ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |  Length = 24  |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                                                               |
|                                                               |
|                   Sender's HMAC (160 bits)                    |
|                                                               |
|                                                               |
+---------------------------------------------------------------+

Parameters

• kind (RegType_MPTCPOption) – option kind value

• dlen (int) – length of remaining data

• bits (str) – 4-bit data

• options (Option) – extracted TCP options

Return type

DataType_MPTCPJoinACK

Returns

Parsed option data.

Raises

ProtocolError – If length is NOT 24.

__proto__: DefaultDict[int, tuple[str, str]]

Protocol index mapping for decoding next layer, c.f. self._decode_next_layer & self._import_next_layer.

Type

DefaultDict[int, tuple[str, str]]

__option__: DefaultDict[int, str | OptionParser]

Option code to method mapping, c.f. _read_tcp_options(). Method names are expected to be referred to the class by _read_mode_${name}, and if such name not found, the value should then be a method that can parse the option by itself.

Type

DefaultDict[RegType_Option, str | OptionParser]

__mp_option__: DefaultDict[int, str | MPOptionParser]

Option code to length mapping,

Type

DefaultDict[RegType_MPTCPOption, str | MPOptionParser]

Data Structures

class pcapkit.protocols.data.transport.tcp.TCP(srcport, dstport, seq, ack, hdr_len, flags, window_size, checksum, urgent_pointer)

Bases: Info

Data model for TCP packet.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

srcport: int

Source port.

dstport: int

Destination port.

seq: int

Sequence number.

ack: int

Acknowledgment number.

hdr_len: int

Data offset.

flags: Flags

Flags.

window_size: int

Window size.

checksum: bytes

Checksum.

urgent_pointer: int

Urgent pointer.

options: OrderedMultiDict[OptionNumber, Option]

class pcapkit.protocols.data.transport.tcp.Flags(ns, cwr, ece, urg, ack, psh, rst, syn, fin)

Bases: Info

Data model for TCP flags.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

ns: bool

ECN-nonce concealment protection.

cwr: bool

Congestion window reduced.

ece: bool

ECN-Echo.

urg: bool

Urgent.

ack: bool

Acknowledgment.

psh: bool

Push function.

rst: bool

Reset connection.

syn: bool

Synchronize sequence numbers.

fin: bool

Last packet from sender.

class pcapkit.protocols.data.transport.tcp.Option(kind, length)

Bases: Info

Data model for TCP options.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

kind: OptionNumber

Option kind.

length: int

Option length.

class pcapkit.protocols.data.transport.tcp.UnassignedOption(kind, length, data)

Bases: Option

Data model for unassigned TCP option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data: bytes

Option data.

class pcapkit.protocols.data.transport.tcp.EndOfOptionList(kind, length)

Bases: Option

Data model for TCP end of option list option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

class pcapkit.protocols.data.transport.tcp.NoOperation(kind, length)

Bases: Option

Data model for TCP no operation option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

class pcapkit.protocols.data.transport.tcp.MaximumSegmentSize(kind, length, mss)

Bases: Option

Data model for TCP maximum segment size option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

mss: int

Maximum segment size.

class pcapkit.protocols.data.transport.tcp.WindowScale(kind, length, shift)

Bases: Option

Data model for TCP window scale option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

shift: int

Window scale.

class pcapkit.protocols.data.transport.tcp.SACKPermitted(kind, length)

Bases: Option

Data model for TCP SACK permitted option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

class pcapkit.protocols.data.transport.tcp.SACK(kind, length, sack)

Bases: Option

Data model for TCP SACK option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

sack: tuple[int, ...]

SACK blocks.

class pcapkit.protocols.data.transport.tcp.Echo(kind, length, data)

Bases: Option

Data model for TCP echo option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data: bytes

Echo data.

class pcapkit.protocols.data.transport.tcp.EchoReply(kind, length, data)

Bases: Option

Data model for TCP echo reply option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data: bytes

Echo data.

class pcapkit.protocols.data.transport.tcp.Timestamp(kind, length, timestamp, echo)

Bases: Option

Data model for TCP timestamp option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

timestamp: int

Timestamp .

echo: bytes

Echo data.

class pcapkit.protocols.data.transport.tcp.PartialOrderConnectionPermitted(kind, length)

Bases: Option

Data model for TCP partial order connection permitted option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

class pcapkit.protocols.data.transport.tcp.PartialOrderConnectionProfile(kind, length, start, end)

Bases: Option

Data model for TCP partial order connection profile option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

start: bool

Start flag.

end: bool

End flag.

class pcapkit.protocols.data.transport.tcp.CC(kind, length, cc)

Bases: Option

Data model for TCP CC option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.CCNew(kind, length, cc)

Bases: Option

Data model for TCP CC.NEW option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.CCEcho(kind, length, cc)

Bases: Option

Data model for TCP CC.ECHO option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.AlternateChecksumRequest(kind, length, chksum)

Bases: Option

Data model for TCP alternate checksum request option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

chksum: Checksum

Checksum algorithm.

class pcapkit.protocols.data.transport.tcp.AlternateChecksumData(kind, length, data)

Bases: Option

Data model for TCP alternate checksum data option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data: bytes

Checksum data.

class pcapkit.protocols.data.transport.tcp.MD5Signature(kind, length, digest)

Bases: Option

Data model for TCP MD5 signature option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

digest: bytes

MD5 signature.

class pcapkit.protocols.data.transport.tcp.QuickStartResponse(kind, length, req_rate, ttl_diff, nounce)

Bases: Option

Data model for TCP quick start response option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

req_rate: int

Rate request.

ttl_diff: int

TTL difference.

nounce: int

QS nounce.

class pcapkit.protocols.data.transport.tcp.UserTimeout(kind, length, timeout)

Bases: Option

Data model for TCP user timeout option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

timeout: timedelta

User timeout.

class pcapkit.protocols.data.transport.tcp.Authentication(kind, length, key_id, next_key_id, mac)

Bases: Option

Data model for TCP authentication option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

key_id: int

Key ID.

next_key_id: int

Receive next key ID.

mac: bytes

MAC.

class pcapkit.protocols.data.transport.tcp.FastOpenCookie(kind, length, cookie)

Bases: Option

Data model for TCP fast open cookie option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

cookie: bytes

Cookie.

class pcapkit.protocols.data.transport.tcp.MPTCP(kind, length, subtype)

Bases: Option

Data model for TCP MPTCP option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

subtype: MPTCPOption

Subtype.

class pcapkit.protocols.data.transport.tcp.MPTCPUnknown(kind, length, subtype, data)

Bases: MPTCP

Data model for TCP unknown MPTCP option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data: bytes

Data.

class pcapkit.protocols.data.transport.tcp.MPTCPCapable(kind, length, subtype, version, flags, skey, rkey)

Bases: MPTCP

Data model for TCP MP_CAPABLE option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

version: int

Version.

flags: MPTCPCapableFlag

Flags.

skey: int

Option sender’s key.

rkey: Optional[int]

Option receiver’s key.

class pcapkit.protocols.data.transport.tcp.MPTCPCapableFlag(req, ext, hsa)

Bases: Info

Data model for TCP MPTCP capable option flags.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

req: bool

Checksum require flag.

ext: bool

Extensibility flag.

hsa: bool

HMAC-SHA1 flag.

class pcapkit.protocols.data.transport.tcp.MPTCPJoin(kind, length, subtype)

Bases: MPTCP

Data model for TCP MP_JOIN option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

class pcapkit.protocols.data.transport.tcp.MPTCPJoinSYN(kind, length, subtype, connection, backup, addr_id, token, nounce)

Bases: MPTCPJoin

Data model for TCP MP_JOIN-SYN option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

connection: Literal['SYN']

Connection type.

backup: bool

Backup path flag.

addr_id: int

Address ID.

token: bytes

Receiver’s token.

nounce: int

Sendder’s random number.

class pcapkit.protocols.data.transport.tcp.MPTCPJoinSYNACK(kind, length, subtype, connection, backup, addr_id, hmac, nounce)

Bases: MPTCPJoin

Data model for TCP MP_JOIN-SYNACK option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

connection: Literal['SYN/ACK']

Connection type.

backup: bool

Backup path flag.

addr_id: int

Address ID.

hmac: bytes

Sender’s truncated HMAC.

nounce: int

Sendder’s random number.

class pcapkit.protocols.data.transport.tcp.MPTCPJoinACK(kind, length, subtype, connection, hmac)

Bases: MPTCPJoin

Data model for TCP MP_JOIN-ACK option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

connection: Literal['ACK']

Connection type.

hmac: bytes

class pcapkit.protocols.data.transport.tcp.MPTCPDSS(kind, length, subtype, flags, ack, dsn, ssn, dl_len, checksum)

Bases: MPTCP

Data model for TCP DSS option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

flags: MPTCPDSSFlag

Flags.

ack: Optional[int]

Data ACK.

dsn: Optional[int]

Data sequence number.

ssn: Optional[int]

Subflow sequence number.

dl_len: Optional[int]

Data-level length.

checksum: Optional[bytes]

Checksum.

class pcapkit.protocols.data.transport.tcp.MPTCPDSSFlag(data_fin, dsn_oct, data_pre, ack_oct, ack_pre)

Bases: Info

Data model for TCP DSS option flags.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

data_fin: bool

DATA_FIN flag.

dsn_oct: bool

Data sequence number is 8 octets (if not set, DSN is 4 octets).

data_pre: bool

Data Sequence Number (DSN), Subflow Sequence Number (SSN), Data-Level Length, and Checksum present.

ack_oct: bool

Data ACK is 8 octets (if not set, Data ACK is 4 octets).

ack_pre: bool

Data ACK present.

class pcapkit.protocols.data.transport.tcp.MPTCPAddAddress(kind, length, subtype, version, addr_id, addr, port)

Bases: MPTCP

Data model for TCP ADD_ADDR option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

version: int

IP version.

addr_id: int

Address ID.

addr: IPAddress

Address.

port: Optional[int]

Port number.

class pcapkit.protocols.data.transport.tcp.MPTCPRemoveAddress(kind, length, subtype, addr_id)

Bases: MPTCP

Data model for TCP REMOVE_ADDR option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

addr_id: tuple[int, ...]

Address ID.

class pcapkit.protocols.data.transport.tcp.MPTCPPriority(kind, length, subtype, backup, addr_id)

Bases: MPTCP

Data model for TCP MP_PRIO option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

backup: bool

Backup path flag.

addr_id: Optional[int]

Address ID.

class pcapkit.protocols.data.transport.tcp.MPTCPFallback(kind, length, subtype, dsn)

Bases: MPTCP

Data model for TCP MP_FAIL option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

dsn: int

Data sequence number.

class pcapkit.protocols.data.transport.tcp.MPTCPFastclose(kind, length, subtype, rkey)

Bases: MPTCP

Data model for TCP MP_FASTCLOSE option.

Parameters

• *args (VT) – Arbitrary positional arguments.

• **kwargs (VT) – Arbitrary keyword arguments.

Return type

Info

rkey: bytes

Option receiver’s key.

---

*

https://en.wikipedia.org/wiki/Transmission_Control_Protocol