TCP - Transmission Control Protocol

pcapkit.protocols.transport.tcp contains TCP only, which implements extractor for Transmission Control Protocol (TCP) *, whose structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.srcport

Source Port

2

16

tcp.dstport

Destination Port

4

32

tcp.seq

Sequence Number

8

64

tcp.ack

Acknowledgement Number (if ACK set)

12

96

tcp.hdr_len

Data Offset

12

100

Reserved (must be \x00)

12

103

tcp.flags.ns

ECN Concealment Protection (NS)

13

104

tcp.flags.cwr

Congestion Window Reduced (CWR)

13

105

tcp.flags.ece

ECN-Echo (ECE)

13

106

tcp.flags.urg

Urgent (URG)

13

107

tcp.flags.ack

Acknowledgement (ACK)

13

108

tcp.flags.psh

Push Function (PSH)

13

109

tcp.flags.rst

Reset Connection (RST)

13

110

tcp.flags.syn

Synchronize Sequence Numbers (SYN)

13

111

tcp.flags.fin

Last Packet from Sender (FIN)

14

112

tcp.window_size

Size of Receive Window

16

128

tcp.checksum

Checksum

18

144

tcp.urgent_pointer

Urgent Pointer (if URG set)

20

160

tcp.opt

TCP Options (if data offset > 5)


class pcapkit.protocols.transport.tcp.TCP(file=None, length=None, **kwargs)[source]

Bases: pcapkit.protocols.transport.transport.Transport

This class implements Transmission Control Protocol.

_syn: bool

SYN flag.

_ack: bool

ACK flag.

classmethod __index__()[source]

Numeral registry index of the protocol.

Returns

Numeral registry index of the protocol in IANA.

Return type

pcapkit.const.reg.transtype.TransType

__length_hint__()[source]

Return an estimated length for the object.

Return type

Literal[20]

_read_join_ack(bits, size, kind)[source]

Read Join Connection option for Third ACK.

Structure of MP_JOIN-ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |  Length = 24  |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                                                               |
|                                                               |
|                   Sender's HMAC (160 bits)                    |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-ACK) option for Third ACK

Return type

DataType_TCP_Opt_MP_JOIN_ACK

_read_join_syn(bits, size, kind)[source]

Read Join Connection option for Initial SYN.

Structure of MP_JOIN-SYN [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 12  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                   Receiver's Token (32 bits)                  |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-SYN) option for Initial SYN

Return type

DataType_TCP_Opt_MP_JOIN_SYN

_read_join_synack(bits, size, kind)[source]

Read Join Connection option for Responding SYN/ACK.

Structure of MP_JOIN-SYN/ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 16  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                                                               |
|                Sender's Truncated HMAC (64 bits)              |
|                                                               |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-SYN/ACK) option for Responding SYN/ACK

Return type

DataType_TCP_Opt_MP_JOIN_SYNACK

_read_mode_acopt(size, kind)[source]

Read Alternate Checksum Request option.

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247]:

+----------+----------+----------+
|  Kind=14 | Length=3 |  chksum  |
+----------+----------+----------+
Parameters
  • size (int) – length of option

  • kind (Literal[14]) – option kind value (Alt-Chksum Request)

Returns

extracted Alternate Checksum Request (CHKSUM-REQ) option

Return type

DataType_TCP_Opt_ACOPT

_read_mode_donone(size, kind)[source]

Read options request no process.

Parameters
  • size (int) – length of option

  • kind (int) – option kind value

Returns

Extracted option with no operation.

Return type

DataType_TCP_Opt_DONONE

_read_mode_mptcp(size, kind)[source]

Read Multipath TCP option.

Structure of MP-TCP [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|                       |
+---------------+---------------+-------+                       |
|                     Subtype-specific data                     |
|                       (variable length)                       |
+---------------------------------------------------------------+
Parameters
  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Multipath TCP (MP-TCP) option

Return type

DataType_TCP_Opt_MPTCP

_read_mode_pocsp(size, kind)[source]

Read Partial Order Connection Service Profile option.

Structure of TCP POC-SP Option [RFC 1693][RFC 6247]:

                          1 bit        1 bit    6 bits
+----------+----------+------------+----------+--------+
|  Kind=10 | Length=3 | Start_flag | End_flag | Filler |
+----------+----------+------------+----------+--------+
Parameters
  • size (int) – length of option

  • kind (Literal[10]) – option kind value (POC-Serv Profile)

Returns

extracted Partial Order Connection Service Profile (POC-SP) option

Return type

DataType_TCP_Opt_POCSP

_read_mode_qsopt(size, kind)[source]

Read Quick-Start Response option.

Structure of TCP QSopt [RFC 4782]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Kind      |  Length=8     | Resv. | Rate  |   TTL Diff    |
|               |               |       |Request|               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   QS Nonce                                | R |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters
  • size (int) – length of option

  • kind (Literal[27]) – option kind value (Quick-Start Response)

Returns

extracted Quick-Start Response (QS) option

Return type

DataType_TCP_Opt_QSOPT

_read_mode_tcpao(size, kind)[source]

Read Authentication option.

Structure of TCP AOopt [RFC 5925]:

+------------+------------+------------+------------+
|  Kind=29   |   Length   |   KeyID    | RNextKeyID |
+------------+------------+------------+------------+
|                     MAC           ...
+-----------------------------------...

...-----------------+
...  MAC (con't)    |
...-----------------+
Parameters
  • size (int) – length of option

  • kind (Literal[29]) – option kind value (TCP Authentication Option)

Returns

extracted Authentication (AO) option

Return type

DataType_TCP_Opt_TCPAO

_read_mode_tsopt(size, kind)[source]

Read Timestamps option.

Structure of TCP TSopt [RFC 7323]:

+-------+-------+---------------------+---------------------+
|Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
+-------+-------+---------------------+---------------------+
    1       1              4                     4
Parameters
  • size (int) – length of option

  • kind (Literal[8]) – option kind value (Timestamps)

Returns

extracted Timestamps (TS) option

Return type

DataType_TCP_Opt_TS

_read_mode_unpack(size, kind)[source]

Read options request unpack process.

Parameters
  • size (int) – length of option

  • kind (int) – option kind value

Returns

Extracted option which unpacked.

Return type

DataType_TCP_Opt_UNPACK

_read_mode_utopt(size, kind)[source]

Read User Timeout option.

Structure of TCP TIMEOUT [RFC 5482]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Kind = 28   |   Length = 4  |G|        User Timeout         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters
  • size (int) – length of option

  • kind (Literal[28]) – option kind value (User Timeout Option)

Returns

extracted User Timeout (TIMEOUT) option

Return type

DataType_TCP_Opt_UTOPT

_read_mptcp_add(bits, size, kind)[source]

Read Add Address option.

Structure of ADD_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |     Length    |Subtype| IPVer |  Address ID   |
+---------------+---------------+-------+-------+---------------+
|          Address (IPv4 - 4 octets / IPv6 - 16 octets)         |
+-------------------------------+-------------------------------+
|   Port (2 octets, optional)   |
+-------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Add Address (ADD_ADDR) option

Return type

DataType_TCP_Opt_ADD_ADDR

Raises

ProtocolError – If the option is malformed.

_read_mptcp_capable(bits, size, kind)[source]

Read Multipath Capable option.

Structure of MP_CAPABLE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |    Length     |Subtype|Version|A|B|C|D|E|F|G|H|
+---------------+---------------+-------+-------+---------------+
|                   Option Sender's Key (64 bits)               |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
|                  Option Receiver's Key (64 bits)              |
|                     (if option Length == 20)                  |
|                                                               |
+---------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Multipath Capable (MP_CAPABLE) option

Return type

DataType_TCP_Opt_MP_CAPABLE

_read_mptcp_dss(bits, size, kind)[source]

Read Data Sequence Signal (Data ACK and Data Sequence Mapping) option.

Structure of DSS [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |    Length     |Subtype| (reserved) |F|m|M|a|A|
+---------------+---------------+-------+----------------------+
|                                                              |
|           Data ACK (4 or 8 octets, depending on flags)       |
|                                                              |
+--------------------------------------------------------------+
|                                                              |
|   Data sequence number (4 or 8 octets, depending on flags)   |
|                                                              |
+--------------------------------------------------------------+
|              Subflow Sequence Number (4 octets)              |
+-------------------------------+------------------------------+
|  Data-Level Length (2 octets) |      Checksum (2 octets)     |
+-------------------------------+------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Data Sequence Signal (DSS) option

Return type

DataType_TCP_Opt_DSS

_read_mptcp_fail(bits, size, kind)[source]

Read Fallback option.

Structure of MP_FAIL [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |   Length=12   |Subtype|      (reserved)      |
+---------------+---------------+-------+----------------------+
|                                                              |
|                 Data Sequence Number (8 octets)              |
|                                                              |
+--------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Fallback (MP_FAIL) option

Return type

DataType_TCP_Opt_MP_FAIL

_read_mptcp_fastclose(bits, size, kind)[source]

Read Fast Close option.

Structure of MP_FASTCLOSE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                      Option Receiver's Key                    |
|                            (64 bits)                          |
|                                                               |
+---------------------------------------------------------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Fast Close (MP_FASTCLOSE) option

Return type

DataType_TCP_Opt_MP_FAIL

_read_mptcp_join(bits, size, kind)[source]

Read Join Connection option.

Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN) option

Return type

DataType_TCP_Opt_MP_JOIN

_read_mptcp_prio(bits, size, kind)[source]

Read Change Subflow Priority option.

Structure of MP_PRIO [RFC 6824]:

                      1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+--------------+
|     Kind      |     Length    |Subtype|     |B| AddrID (opt) |
+---------------+---------------+-------+-----+-+--------------+
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Change Subflow Priority (MP_PRIO) option

Return type

DataType_TCP_Opt_REMOVE_ADDR

_read_mptcp_remove(bits, size, kind)[source]

Read Remove Address option.

Structure of REMOVE_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |  Length = 3+n |Subtype|(resvd)|   Address ID  | ...
+---------------+---------------+-------+-------+---------------+
                           (followed by n-1 Address IDs, if required)
Parameters
  • bits (str) – 4-bit data (after subtype)

  • size (int) – length of option

  • kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Remove Address (REMOVE_ADDR) option

Return type

DataType_TCP_Opt_REMOVE_ADDR

_read_tcp_options(size)[source]

Read TCP option list.

Parameters

size (int) – length of option list

Returns

Tuple of TCP option list and extracted TCP options.

Return type

Tuple[Tuple[pcapkit.const.tcp.option.Option], DataType_TCP_Opt]

make(**kwargs)[source]

Make (construct) packet data.

Keyword Arguments

**kwargs – Arbitrary keyword arguments.

Returns

Constructed packet data.

Return type

bytes

read(length=None, **kwargs)[source]

Read Transmission Control Protocol (TCP).

Structure of TCP header [RFC 793]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Acknowledgement Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |           |U|A|P|R|S|F|                               |
| Offset| Reserved  |R|C|S|S|Y|I|            Window             |
|       |           |G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters

length (Optional[int]) – Length of packet data.

Keyword Arguments

**kwargs – Arbitrary keyword arguments.

Returns

Parsed packet data.

Return type

DataType_TCP

property dst

Destination port.

Return type

int

property length

Header length of current protocol.

Return type

int

property name

Name of current protocol.

Return type

Literal[‘Transmission Control Protocol’]

property src

Source port.

Return type

int

pcapkit.protocols.transport.tcp.TCP_OPT: DataType_TCP_OPT

TCP option dict parsing mapping.

kind

length

type

process

comment

name

0

[RFC 793] End of Option List

1

[RFC 793] No-Operation

2

4

H

1

[RFC 793] Maximum Segment Size

3

3

B

1

[RFC 7323] Window Scale

4

2

?

True

[RFC 2018] SACK Permitted

5

?

P

0

2+8*N

[RFC 2018] SACK

6

6

P

0

[RFC 1072][RFC 6247] Echo

7

6

P

0

[RFC 1072][RFC 6247] Echo Reply

8

10

II

2

[RFC 7323] Timestamps

9

2

?

True

[RFC 1693][RFC 6247] POC Permitted

10

3

??P

3

[RFC 1693][RFC 6247] POC-Serv Profile

11

6

P

0

[RFC 1693][RFC 6247] Connection Count

12

6

P

0

[RFC 1693][RFC 6247] CC.NEW

13

6

P

0

[RFC 1693][RFC 6247] CC.ECHO

14

3

B

4

[RFC 1146][RFC 6247] Alt-Chksum Request

15

?

P

0

[RFC 1146][RFC 6247] Alt-Chksum Data

19

18

P

0

[RFC 2385] MD5 Signature Option

27

8

P

5

[RFC 4782] Quick-Start Response

28

4

P

6

[RFC 5482] User Timeout Option

29

?

P

7

[RFC 5925] TCP Authentication Option

30

?

P

8

[RFC 6824] Multipath TCP

34

?

P

0

[RFC 7413] Fast Open

pcapkit.protocols.transport.tcp.process_opt: Dict[int, Callable[[pcapkit.protocols.transport.tcp.TCP, int, int], DataType_TCP_Opt]]

Process method for TCP options.

Code

Method

Description

0

_read_mode_donone()

do nothing

1

_read_mode_unpack()

unpack according to size

2

_read_mode_tsopt()

timestamps

3

_read_mode_pocsp()

POC service profile

4

_read_mode_acopt()

alternate checksum request

5

_read_mode_qsopt()

Quick-Start response

6

_read_mode_utopt()

user timeout option

7

_read_mode_tcpao()

TCP authentication option

8

_read_mode_mptcp()

multipath TCP

pcapkit.protocols.transport.tcp.mptcp_opt: Dict[int, Callable[[pcapkit.protocols.transport.tcp.TCP, str, int, int], DataType_TCP_MP_Opt]]

Process method for multipath TCP options [RFC 6824].

Code

Method

Description

0

_read_mptcp_capable()

MP_CAPABLE

1

_read_mptcp_join()

MP_JOIN

2

_read_mptcp_dss()

DSS

3

_read_mptcp_add()

ADD_ADDR

4

_read_mptcp_remove()

REMOVE_ADDR

5

_read_mptcp_prio()

MP_PRIO

6

_read_mptcp_fail()

MP_FAIL

7

_read_mptcp_fastclose()

MP_FASTCLOSE

Data Structure

Important

Following classes are only for documentation purpose. They do NOT exist in the pcapkit module.

class pcapkit.protocols.transport.tcp.DataType_TCP
Bases

TypedDict

Structure of TCP header [RFC 793].

srcport: int

Source port.

dstport: int

Description port.

seq: int

Sequence number.

ack: int

Acknowledgement number.

hdr_len: int

Data offset.

flags: DataType_TCP_Flags

Flags.

window_size: int

Size of receive window.

checksum: bytes

Checksum.

urgent_pointer: int

Urgent pointer.

opt: Tuple[pcapkit.const.tcp.option.Option]

Array of TCP options.

packet: bytes

Raw packet data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Flags
Bases

TypedDict

Flags.

ns: bool

ECN concealment protection.

cwr: bool

Congestion window reduced.

ece: bool

ECN-Echo.

urg: bool

Urgent.

ack: bool

Acknowledgement.

psh: bool

Push function.

rst: bool

Reset connection.

syn: bool

Synchronize sequence numbers.

fin: bool

Last packet from sender.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt
Bases

TypedDict

Structure of TCP options.

kind: int

Option kind value.

length: int

Length of option.

class pcapkit.protocols.transport.tcp.DataType_TCP_OPT
Bases

TypedDict

TCP option dict parsing mapping.

flag: bool

If the length of option is GREATER THAN 1.

desc: str

Description string, also attribute name.

func: Optional[Callable[[int], int]]

Function, length of data bytes.

proc: Optional[int]

Process method that data bytes need (when flag is True).

TCP Miscellaneous Options

No Process Options

For TCP options require no process, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.opt.kind

Kind

1

8

tcp.opt.length

Length

2

16

tcp.opt.data

Kind-specific Data


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DONONE
Bases

DataType_TCP_Opt

Structure of TCP options.

data: bytes

Kind-specific data.

Unpack Process Options

For TCP options require unpack process, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.opt.kind

Kind

1

8

tcp.opt.length

Length

2

16

tcp.opt.data

Kind-specific Data


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_UNPACK
Bases

DataType_TCP_Opt

Structure of TCP options.

data: bytes

Kind-specific data.

Timestamps Option

For TCP Timestamps (TS) option as described in RFC 7323, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.ts.kind

Kind (8)

1

8

tcp.ts.length

Length (10)

2

16

tcp.ts.val

Timestamp Value

6

48

tcp.ts.ecr

Timestamps Echo Reply


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_TS
Bases

DataType_TCP_Opt

Structure of TCP TSopt [RFC 7323].

val: int

Timestamp value.

ecr: int

Timestamps echo reply.

Partial Order Connection Service Profile Option

For TCP Partial Order Connection Service Profile (POC-SP) option as described in RFC 1693 and RFC 6247, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.pocsp.kind

Kind (10)

1

8

tcp.pocsp.length

Length (3)

2

16

tcp.pocsp.start

Start Flag

2

17

tcp.pocsp.end

End Flag

2

18

tcp.pocsp.filler

Filler


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_POCSP
Bases

DataType_TCP_Opt

Structure of TCP POC-SP Option [RFC 1693][RFC 6247].

start: bool

Start flag.

end: bool

End flag.

filler: bytes

Filler.

Alternate Checksum Request Option

For TCP Alternate Checksum Request (CHKSUM-REQ) option as described in RFC 1146 and RFC 6247, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.chksumreq.kind

Kind (14)

1

8

tcp.chksumreq.length

Length (3)

2

16

tcp.chksumreq.ac

Checksum Algorithm


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ACOPT
Bases

DataType_TCP_Opt

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247].

ac: pcapkit.const.tcp.checksum.Checksum

Checksum algorithm.

Quick-Start Response Option

For TCP Quick-Start Response (QS) option as described in RFC 4782, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.qs.kind

Kind (27)

1

8

tcp.qs.length

Length (8)

2

16

Reserved (must be \x00)

2

20

tcp.qs.req_rate

Request Rate

3

24

tcp.qs.ttl_diff

TTL Difference

4

32

tcp.qs.nounce

QS Nounce

7

62

Reserved (must be \x00)


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_QSOPT
Bases

DataType_TCP_Opt

Structure of TCP QSopt [RFC 4782].

req_rate: int

Request rate.

ttl_diff: int

TTL difference.

nounce: int

QS nounce.

User Timeout Option

For TCP User Timeout (TIMEOUT) option as described in RFC 5482, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.timeout.kind

Kind (28)

1

8

tcp.timeout.length

Length (4)

2

16

tcp.timeout.granularity

Granularity

2

17

tcp.timeout.timeout

User Timeout


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_UTOPT
Bases

DataType_TCP_Opt

Structure of TCP TIMEOUT [RFC 5482].

granularity: Literal['minutes', 'seconds']

Granularity.

timeout: datetime.timedelta

User timeout.

Authentication Option

For Authentication (AO) option as described in RFC 5925, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.ao.kind

Kind (29)

1

8

tcp.ao.length

Length

2

16

tcp.ao.key_id

KeyID

3

24

tcp.ao.r_next_key_id

RNextKeyID

4

32

tcp.ao.mac

Message Authentication Code


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_TCPAO
Bases

DataType_TCP_Opt

Structure of TCP AOopt [RFC 5925].

key_id: int

KeyID.

r_next_key_id: int

RNextKeyID.

mac: bytes

Message authentication code.

Multipath TCP Options

For Multipath TCP (MP-TCP) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype

2

20

tcp.mp.data

Subtype-specific Data


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MPTCP
Bases

DataType_TCP_Opt

Structure of MP-TCP [RFC 6824].

subtype: pcapkit.const.tcp.mp_tcp_option.MPTCPOption

Subtype.

data: Optional[bytes]

Subtype-specific data.

Multipath Capable Option

For Multipath Capable (MP_CAPABLE) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length (12/20)

2

16

tcp.mp.subtype

Subtype (0)

2

20

tcp.mp.capable.version

Version

3

24

tcp.mp.capable.flags.req

Checksum Require Flag (A)

3

25

tcp.mp.capable.flags.ext

Extensibility Flag (B)

3

26

tcp.mp.capable.flags.res

Unassigned (C - G)

3

31

tcp.mp.capable.flags.hsa

HMAC-SHA1 Flag (H)

4

32

tcp.mp.capable.skey

Option Sender’s Key

12

96

tcp.mp.capable.rkey

Option Receiver’s Key (only if option length is 20)


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE
Bases

DataType_TCP_Opt_MPTCP

Structure of MP_CAPABLE [RFC 6824].

capable: DataType_TCP_Opt_MP_CAPABLE_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE_Data
Bases

TypedDict

Structure of MP_CAPABLE [RFC 6824].

version: int

Version.

flags: DataType_TCP_Opt_MP_CAPABLE_Flags

Flags.

skey: int

Option sender’s key.

rkey: Optional[int]

Option receiver’s key.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE_Flags
Bases

TypedDict

Flags.

req: bool

Checksum require flag.

ext: bool

Extensibility flag.

res: Tuple[bool, bool, bool, bool, bool]

Unassigned flags.

hsa: bool

HMAC-SHA1 flag.

Join Connection Option

For Join Connection (MP_JOIN) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (1)

2

20

tcp.mp.data

Handshake-specific Data


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN
Bases

DataType_TCP_Opt_MPTCP

Structure of MP_JOIN [RFC 6824].

connection: Optional[Literal['SYN/ACK', 'SYN', 'ACK']]

Join connection type.

join: DataType_TCP_Opt_MP_JOIN_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_Data
Bases

TypedDict

Structure of MP_JOIN [RFC 6824].

data: Optional[bytes]

Unknown type data.

MP_JOIN-SYN

For Join Connection (MP_JOIN-SYN) option for Initial SYN as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length (12)

2

16

tcp.mp.subtype

Subtype (1 | SYN)

2

20

Reserved (must be \x00)

2

23

tcp.mp.join.syn.backup

Backup Path (B)

3

24

tcp.mp.join.syn.addr_id

Address ID

4

32

tcp.mp.join.syn.token

Receiver’s Token

8

64

tcp.mp.join.syn.rand_num

Sender’s Random Number


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYN
Bases

DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-SYN [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_SYN_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYN_Data
Bases

TypedDict

Structure of MP_JOIN-SYN [RFC 6824].

backup: bool

Backup path.

addr_id: int

Address ID.

token: int

Receiver’s token.

rand_num: int

Sender’s random number.

MP_JOIN-SYN/ACK

For Join Connection (MP_JOIN-SYN/ACK) option for Responding SYN/ACK as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length (16)

2

16

tcp.mp.subtype

Subtype (1 | SYN/ACK)

2

20

Reserved (must be \x00)

2

23

tcp.mp.join.synack.backup

Backup Path (B)

3

24

tcp.mp.join.synack.addr_id

Address ID

4

32

tcp.mp.join.synack.hmac

Sender’s Truncated HMAC

12

96

tcp.mp.join.synack.rand_num

Sender’s Random Number


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYNACK
Bases

DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-SYN/ACK [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_SYNACK_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYNACK_Data
Bases

TypedDict

Structure of MP_JOIN-SYN/ACK [RFC 6824].

backup: bool

Backup path.

addr_id: int

Address ID.

hmac: bytes

Sender’s truncated HMAC.

rand_num: int

Sender’s random number.

MP_JOIN-ACK

For Join Connection (MP_JOIN-ACK) option for Third ACK as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length (16)

2

16

tcp.mp.subtype

Subtype (1 | ACK)

2

20

Reserved (must be \x00)

4

32

tcp.mp.join.ack.hmac

Sender’s HMAC


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_ACK
Bases

DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-ACK [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_ACK_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_ACK_Data
Bases

TypedDict

Structure of MP_JOIN-ACK [RFC 6824].

hmac: bytes

Sender’s HMAC.

Data Sequence Signal Option

For Data Sequence Signal (DSS) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (2)

2

20

Reserved (must be \x00)

3

27

tcp.mp.dss.flags.fin

DATA_FIN (F)

3

28

tcp.mp.dss.flags.dsn_len

DSN Length (m)

3

29

tcp.mp.dss.flags.data_pre

DSN, SSN, Data-Level Length, CHKSUM Present (M)

3

30

tcp.mp.dss.flags.ack_len

ACK Length (a)

3

31

tcp.mp.dss.flags.ack_pre

Data ACK Present (A)

4

32

tcp.mp.dss.ack

Data ACK (4 / 8 octets)

8/12

64/96

tcp.mp.dss.dsn

DSN (4 / 8 octets)

12/20

48/160

tcp.mp.dss.ssn

Subflow Sequence Number

16/24

128/192

tcp.mp.dss.dl_len

Data-Level Length

18/26

144/208

tcp.mp.dss.checksum

Checksum


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS
Bases

DataType_TCP_Opt_MPTCP

Structure of DSS [RFC 6824].

dss: DataType_TCP_Opt_DSS_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS_Data
Bases

TypedDict

Structure of DSS [RFC 6824].

flags: DataType_TCP_Opt_DSS_Flags

Flags.

ack: Optional[int]

Data ACK.

dsn: Optional[int]

DSN.

ssn: Optional[int]

Subflow sequence number.

dl_len: int

Data-level length.

checksum: bytes

Checksum.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS_Flags
Bases

TypedDict

Flags.

fin: bool

DATA_FIN.

dsn_len: int

DSN length.

data_pre: int

DSN, SSN, data-level length, checksum present.

ack_len: int

ACK length.

ack_pre: bool

ACK present.

Add Address Option

For Add Address (ADD_ADDR) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (3)

2

20

tcp.mp.add_addr.ip_ver

IP Version

3

24

tcp.mp.add_addr.addr_id

Address ID

4

32

tcp.mp.add_addr.addr

IP Address (4 / 16)

8/20

64/160

tcp.mp.add_addr.port

Port (optional)


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ADD_ADDR
Bases

DataType_TCP_Opt_MPTCP

Structure of ADD_ADDR [RFC 6824].

add_addr: DataType_TCP_Opt_ADD_ADDR_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ADD_ADDR_Data
Bases

TypedDict

Structure of ADD_ADDR [RFC 6824].

ip_ver: Literal[4, 6]

IP version.

addr_id: int

Address ID.

addr: Union[ipaddress.IPv4Address, ipaddress.IPv6Address]

IP address.

port: Optional[int]

Port.

Remove Address Option

For Remove Address (REMOVE_ADDR) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (4)

2

20

Reserved (must be \x00)

3

24

tcp.mp.remove_addr.addr_id

Address ID (optional list)


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_REMOVE_ADDR
Bases

DataType_TCP_Opt_MPTCP

Structure of REMOVE_ADDR [RFC 6824].

remove_addr: DataType_TCP_Opt_REMOVE_ADDR_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_REMOVE_ADDR_Data
Bases

TypedDict

Structure of REMOVE_ADDR [RFC 6824].

addr_id: Tuple[int]

Array of address IDs.

Change Subflow Priority Option

For Change Subflow Priority (MP_PRIO) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (4)

2

23

tcp.mp.prio.backup

Backup Path (B)

3

24

tcp.mp.prio.addr_id

Address ID (optional)


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_PRIO
Bases

DataType_TCP_Opt_MPTCP

Structure of MP_PRIO [RFC 6824].

prio: DataType_TCP_Opt_MP_PRIO_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_PRIO_Data
Bases

TypedDict

Structure of MP_PRIO [RFC 6824].

backup: bool

Backup path.

addr_id: Optional[int]

Address ID.

Fallback Option

For Fallback (MP_FAIL) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (4)

2

23

Reserved (must be \x00)

4

32

tcp.mp.fail.dsn

Data Sequence Number


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FAIL
Bases

DataType_TCP_Opt_MPTCP

Structure of MP_FAIL [RFC 6824].

fail: DataType_TCP_Opt_MP_FAIL_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FAIL_Data
Bases

TypedDict

Structure of MP_FAIL [RFC 6824].

dsn: int

Data sequence number.

Fast Close Option

For Fast Close (MP_FASTCLOSE) options as described in RFC 6824, its structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.mp.kind

Kind (30)

1

8

tcp.mp.length

Length

2

16

tcp.mp.subtype

Subtype (4)

2

23

Reserved (must be \x00)

4

32

tcp.mp.fastclose.rkey

Option Receiver’s Key


class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FASTCLOSE
Bases

DataType_TCP_Opt_MPTCP

Structure of MP_FASTCLOSE [RFC 6824].

fastclose: DataType_TCP_Opt_MP_FASTCLOSE_Data

Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FASTCLOSE_Data
Bases

TypedDict

Structure of MP_FASTCLOSE [RFC 6824].

rkey: int

Option receiver’s key.


*

https://en.wikipedia.org/wiki/Transmission_Control_Protocol