TCP - Transmission Control Protocol¶

pcapkit.protocols.transport.tcp contains TCP only, which implements extractor for Transmission Control Protocol (TCP) *, whose structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.srcport`	Source Port
2	16	`tcp.dstport`	Destination Port
4	32	`tcp.seq`	Sequence Number
8	64	`tcp.ack`	Acknowledgement Number (if ACK set)
12	96	`tcp.hdr_len`	Data Offset
12	100		Reserved (must be `\x00`)
12	103	`tcp.flags.ns`	ECN Concealment Protection (NS)
13	104	`tcp.flags.cwr`	Congestion Window Reduced (CWR)
13	105	`tcp.flags.ece`	ECN-Echo (ECE)
13	106	`tcp.flags.urg`	Urgent (URG)
13	107	`tcp.flags.ack`	Acknowledgement (ACK)
13	108	`tcp.flags.psh`	Push Function (PSH)
13	109	`tcp.flags.rst`	Reset Connection (RST)
13	110	`tcp.flags.syn`	Synchronize Sequence Numbers (SYN)
13	111	`tcp.flags.fin`	Last Packet from Sender (FIN)
14	112	`tcp.window_size`	Size of Receive Window
16	128	`tcp.checksum`	Checksum
18	144	`tcp.urgent_pointer`	Urgent Pointer (if URG set)
20	160	`tcp.opt`	TCP Options (if data offset > 5)

class pcapkit.protocols.transport.tcp.TCP(file=None, length=None, **kwargs)[source]¶

Bases: pcapkit.protocols.transport.transport.Transport

This class implements Transmission Control Protocol.

_syn: bool¶: SYN flag.

_ack: bool¶: ACK flag.

classmethod __index__()[source]¶

Numeral registry index of the protocol.

Returns: Numeral registry index of the protocol in IANA.
Return type: pcapkit.const.reg.transtype.TransType

__length_hint__()[source]¶

Return an estimated length for the object.

Return type: Literal[20]

_read_join_ack(bits, size, kind)[source]¶

Read Join Connection option for Third ACK.

Structure of MP_JOIN-ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |  Length = 24  |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                                                               |
|                                                               |
|                   Sender's HMAC (160 bits)                    |
|                                                               |
|                                                               |
+---------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-ACK) option for Third ACK

Return type

DataType_TCP_Opt_MP_JOIN_ACK

_read_join_syn(bits, size, kind)[source]¶

Read Join Connection option for Initial SYN.

Structure of MP_JOIN-SYN [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 12  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                   Receiver's Token (32 bits)                  |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-SYN) option for Initial SYN

Return type

DataType_TCP_Opt_MP_JOIN_SYN

_read_join_synack(bits, size, kind)[source]¶

Read Join Connection option for Responding SYN/ACK.

Structure of MP_JOIN-SYN/ACK [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 16  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                                                               |
|                Sender's Truncated HMAC (64 bits)              |
|                                                               |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN-SYN/ACK) option for Responding SYN/ACK

Return type

DataType_TCP_Opt_MP_JOIN_SYNACK

_read_mode_acopt(size, kind)[source]¶

Read Alternate Checksum Request option.

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247]:

+----------+----------+----------+
|  Kind=14 | Length=3 |  chksum  |
+----------+----------+----------+

Parameters

size (int) – length of option
kind (Literal[14]) – option kind value (Alt-Chksum Request)

Returns

extracted Alternate Checksum Request (CHKSUM-REQ) option

Return type

DataType_TCP_Opt_ACOPT

_read_mode_donone(size, kind)[source]¶

Read options request no process.

Parameters

size (int) – length of option
kind (int) – option kind value

Returns

Extracted option with no operation.

Return type

DataType_TCP_Opt_DONONE

_read_mode_mptcp(size, kind)[source]¶

Read Multipath TCP option.

Structure of MP-TCP [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|                       |
+---------------+---------------+-------+                       |
|                     Subtype-specific data                     |
|                       (variable length)                       |
+---------------------------------------------------------------+

Parameters

size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Multipath TCP (MP-TCP) option

Return type

DataType_TCP_Opt_MPTCP

_read_mode_pocsp(size, kind)[source]¶

Read Partial Order Connection Service Profile option.

Structure of TCP POC-SP Option [RFC 1693][RFC 6247]:

                          1 bit        1 bit    6 bits
+----------+----------+------------+----------+--------+
|  Kind=10 | Length=3 | Start_flag | End_flag | Filler |
+----------+----------+------------+----------+--------+

Parameters

size (int) – length of option
kind (Literal[10]) – option kind value (POC-Serv Profile)

Returns

extracted Partial Order Connection Service Profile (POC-SP) option

Return type

DataType_TCP_Opt_POCSP

_read_mode_qsopt(size, kind)[source]¶

Read Quick-Start Response option.

Structure of TCP QSopt [RFC 4782]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Kind      |  Length=8     | Resv. | Rate  |   TTL Diff    |
|               |               |       |Request|               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   QS Nonce                                | R |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

size (int) – length of option
kind (Literal[27]) – option kind value (Quick-Start Response)

Returns

extracted Quick-Start Response (QS) option

Return type

DataType_TCP_Opt_QSOPT

_read_mode_tcpao(size, kind)[source]¶

Read Authentication option.

Structure of TCP AOopt [RFC 5925]:

+------------+------------+------------+------------+
|  Kind=29   |   Length   |   KeyID    | RNextKeyID |
+------------+------------+------------+------------+
|                     MAC           ...
+-----------------------------------...

...-----------------+
...  MAC (con't)    |
...-----------------+

Parameters

size (int) – length of option
kind (Literal[29]) – option kind value (TCP Authentication Option)

Returns

extracted Authentication (AO) option

Return type

DataType_TCP_Opt_TCPAO

_read_mode_tsopt(size, kind)[source]¶

Read Timestamps option.

Structure of TCP TSopt [RFC 7323]:

+-------+-------+---------------------+---------------------+
|Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
+-------+-------+---------------------+---------------------+
    1       1              4                     4

Parameters

size (int) – length of option
kind (Literal[8]) – option kind value (Timestamps)

Returns

extracted Timestamps (TS) option

Return type

DataType_TCP_Opt_TS

_read_mode_unpack(size, kind)[source]¶

Read options request unpack process.

Parameters

size (int) – length of option
kind (int) – option kind value

Returns

Extracted option which unpacked.

Return type

DataType_TCP_Opt_UNPACK

_read_mode_utopt(size, kind)[source]¶

Read User Timeout option.

Structure of TCP TIMEOUT [RFC 5482]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Kind = 28   |   Length = 4  |G|        User Timeout         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters

size (int) – length of option
kind (Literal[28]) – option kind value (User Timeout Option)

Returns

extracted User Timeout (TIMEOUT) option

Return type

DataType_TCP_Opt_UTOPT

_read_mptcp_add(bits, size, kind)[source]¶

Read Add Address option.

Structure of ADD_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |     Length    |Subtype| IPVer |  Address ID   |
+---------------+---------------+-------+-------+---------------+
|          Address (IPv4 - 4 octets / IPv6 - 16 octets)         |
+-------------------------------+-------------------------------+
|   Port (2 octets, optional)   |
+-------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Add Address (ADD_ADDR) option

Return type

DataType_TCP_Opt_ADD_ADDR

Raises

ProtocolError – If the option is malformed.

_read_mptcp_capable(bits, size, kind)[source]¶

Read Multipath Capable option.

Structure of MP_CAPABLE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |    Length     |Subtype|Version|A|B|C|D|E|F|G|H|
+---------------+---------------+-------+-------+---------------+
|                   Option Sender's Key (64 bits)               |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
|                  Option Receiver's Key (64 bits)              |
|                     (if option Length == 20)                  |
|                                                               |
+---------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Multipath Capable (MP_CAPABLE) option

Return type

DataType_TCP_Opt_MP_CAPABLE

_read_mptcp_dss(bits, size, kind)[source]¶

Read Data Sequence Signal (Data ACK and Data Sequence Mapping) option.

Structure of DSS [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |    Length     |Subtype| (reserved) |F|m|M|a|A|
+---------------+---------------+-------+----------------------+
|                                                              |
|           Data ACK (4 or 8 octets, depending on flags)       |
|                                                              |
+--------------------------------------------------------------+
|                                                              |
|   Data sequence number (4 or 8 octets, depending on flags)   |
|                                                              |
+--------------------------------------------------------------+
|              Subflow Sequence Number (4 octets)              |
+-------------------------------+------------------------------+
|  Data-Level Length (2 octets) |      Checksum (2 octets)     |
+-------------------------------+------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Data Sequence Signal (DSS) option

Return type

DataType_TCP_Opt_DSS

_read_mptcp_fail(bits, size, kind)[source]¶

Read Fallback option.

Structure of MP_FAIL [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |   Length=12   |Subtype|      (reserved)      |
+---------------+---------------+-------+----------------------+
|                                                              |
|                 Data Sequence Number (8 octets)              |
|                                                              |
+--------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Fallback (MP_FAIL) option

Return type

DataType_TCP_Opt_MP_FAIL

_read_mptcp_fastclose(bits, size, kind)[source]¶

Read Fast Close option.

Structure of MP_FASTCLOSE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                      Option Receiver's Key                    |
|                            (64 bits)                          |
|                                                               |
+---------------------------------------------------------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Fast Close (MP_FASTCLOSE) option

Return type

DataType_TCP_Opt_MP_FAIL

_read_mptcp_join(bits, size, kind)[source]¶

Read Join Connection option.

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Join Connection (MP_JOIN) option

Return type

DataType_TCP_Opt_MP_JOIN

_read_mptcp_prio(bits, size, kind)[source]¶

Read Change Subflow Priority option.

Structure of MP_PRIO [RFC 6824]:

                      1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+--------------+
|     Kind      |     Length    |Subtype|     |B| AddrID (opt) |
+---------------+---------------+-------+-----+-+--------------+

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Change Subflow Priority (MP_PRIO) option

Return type

DataType_TCP_Opt_REMOVE_ADDR

_read_mptcp_remove(bits, size, kind)[source]¶

Read Remove Address option.

Structure of REMOVE_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |  Length = 3+n |Subtype|(resvd)|   Address ID  | ...
+---------------+---------------+-------+-------+---------------+
                           (followed by n-1 Address IDs, if required)

Parameters

bits (str) – 4-bit data (after subtype)
size (int) – length of option
kind (Literal[30]) – option kind value (Multipath TCP)

Returns

extracted Remove Address (REMOVE_ADDR) option

Return type

DataType_TCP_Opt_REMOVE_ADDR

_read_tcp_options(size)[source]¶

Read TCP option list.

Parameters: size (int) – length of option list
Returns: Tuple of TCP option list and extracted TCP options.
Return type: Tuple[Tuple[pcapkit.const.tcp.option.Option], DataType_TCP_Opt]

make(**kwargs)[source]¶

Make (construct) packet data.

Keyword Arguments: **kwargs – Arbitrary keyword arguments.
Returns: Constructed packet data.
Return type: bytes

read(length=None, **kwargs)[source]¶

Read Transmission Control Protocol (TCP).

Structure of TCP header [RFC 793]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Acknowledgement Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |           |U|A|P|R|S|F|                               |
| Offset| Reserved  |R|C|S|S|Y|I|            Window             |
|       |           |G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters: length (Optional[int]) – Length of packet data.
Keyword Arguments: **kwargs – Arbitrary keyword arguments.
Returns: Parsed packet data.
Return type: DataType_TCP

property dst¶

Destination port.

Return type: int

property length¶

Header length of current protocol.

Return type: int

property name¶

Name of current protocol.

Return type: Literal[‘Transmission Control Protocol’]

property src¶

Source port.

Return type: int

pcapkit.protocols.transport.tcp.TCP_OPT: DataType_TCP_OPT¶

TCP option dict parsing mapping.

kind	length	type	process	comment	name
0					[RFC 793] End of Option List
1					[RFC 793] No-Operation
2	4	`H`	1		[RFC 793] Maximum Segment Size
3	3	`B`	1		[RFC 7323] Window Scale
4	2	`?`		`True`	[RFC 2018] SACK Permitted
5	?	`P`	0	`2+8*N`	[RFC 2018] SACK
6	6	`P`	0		[RFC 1072][RFC 6247] Echo
7	6	`P`	0		[RFC 1072][RFC 6247] Echo Reply
8	10	`II`	2		[RFC 7323] Timestamps
9	2	`?`		`True`	[RFC 1693][RFC 6247] POC Permitted
10	3	`??P`	3		[RFC 1693][RFC 6247] POC-Serv Profile
11	6	`P`	0		[RFC 1693][RFC 6247] Connection Count
12	6	`P`	0		[RFC 1693][RFC 6247] CC.NEW
13	6	`P`	0		[RFC 1693][RFC 6247] CC.ECHO
14	3	`B`	4		[RFC 1146][RFC 6247] Alt-Chksum Request
15	?	`P`	0		[RFC 1146][RFC 6247] Alt-Chksum Data
19	18	`P`	0		[RFC 2385] MD5 Signature Option
27	8	`P`	5		[RFC 4782] Quick-Start Response
28	4	`P`	6		[RFC 5482] User Timeout Option
29	?	`P`	7		[RFC 5925] TCP Authentication Option
30	?	`P`	8		[RFC 6824] Multipath TCP
34	?	`P`	0		[RFC 7413] Fast Open

Data Structure¶

Important

Following classes are only for documentation purpose. They do NOT exist in the pcapkit module.

class pcapkit.protocols.transport.tcp.DataType_TCP¶

Bases: TypedDict

Structure of TCP header [RFC 793].

srcport: int¶: Source port.

dstport: int¶: Description port.

seq: int¶: Sequence number.

ack: int¶: Acknowledgement number.

hdr_len: int¶: Data offset.

flags: DataType_TCP_Flags¶: Flags.

window_size: int¶: Size of receive window.

checksum: bytes¶: Checksum.

urgent_pointer: int¶: Urgent pointer.

opt: Tuple[pcapkit.const.tcp.option.Option]¶: Array of TCP options.

packet: bytes¶: Raw packet data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Flags¶

Bases: TypedDict

Flags.

ns: bool¶: ECN concealment protection.

cwr: bool¶: Congestion window reduced.

ece: bool¶: ECN-Echo.

urg: bool¶: Urgent.

ack: bool¶: Acknowledgement.

psh: bool¶: Push function.

rst: bool¶: Reset connection.

syn: bool¶: Synchronize sequence numbers.

fin: bool¶: Last packet from sender.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt¶

Bases: TypedDict

Structure of TCP options.

kind: int¶: Option kind value.

length: int¶: Length of option.

class pcapkit.protocols.transport.tcp.DataType_TCP_OPT¶

Bases: TypedDict

TCP option dict parsing mapping.

flag: bool¶: If the length of option is GREATER THAN 1.

desc: str¶: Description string, also attribute name.

func: Optional[Callable[[int], int]]¶: Function, length of data bytes.

proc: Optional[int]¶: Process method that data bytes need (when flag is True).

See also

pcapkit.protocols.transport.tcp.process_opt

TCP Miscellaneous Options¶

No Process Options¶

For TCP options require no process, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.opt.kind`	Kind
1	8	`tcp.opt.length`	Length
2	16	`tcp.opt.data`	Kind-specific Data

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DONONE¶

Bases: DataType_TCP_Opt

Structure of TCP options.

data: bytes¶: Kind-specific data.

Unpack Process Options¶

For TCP options require unpack process, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.opt.kind`	Kind
1	8	`tcp.opt.length`	Length
2	16	`tcp.opt.data`	Kind-specific Data

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_UNPACK¶

Bases: DataType_TCP_Opt

Structure of TCP options.

data: bytes¶: Kind-specific data.

Timestamps Option¶

For TCP Timestamps (TS) option as described in RFC 7323, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.ts.kind`	Kind (`8`)
1	8	`tcp.ts.length`	Length (`10`)
2	16	`tcp.ts.val`	Timestamp Value
6	48	`tcp.ts.ecr`	Timestamps Echo Reply

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_TS¶

Bases: DataType_TCP_Opt

Structure of TCP TSopt [RFC 7323].

val: int¶: Timestamp value.

ecr: int¶: Timestamps echo reply.

Partial Order Connection Service Profile Option¶

For TCP Partial Order Connection Service Profile (POC-SP) option as described in RFC 1693 and RFC 6247, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.pocsp.kind`	Kind (`10`)
1	8	`tcp.pocsp.length`	Length (`3`)
2	16	`tcp.pocsp.start`	Start Flag
2	17	`tcp.pocsp.end`	End Flag
2	18	`tcp.pocsp.filler`	Filler

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_POCSP¶

Bases: DataType_TCP_Opt

Structure of TCP POC-SP Option [RFC 1693][RFC 6247].

start: bool¶: Start flag.

end: bool¶: End flag.

filler: bytes¶: Filler.

Alternate Checksum Request Option¶

For TCP Alternate Checksum Request (CHKSUM-REQ) option as described in RFC 1146 and RFC 6247, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.chksumreq.kind`	Kind (`14`)
1	8	`tcp.chksumreq.length`	Length (`3`)
2	16	`tcp.chksumreq.ac`	Checksum Algorithm

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ACOPT¶

Bases: DataType_TCP_Opt

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247].

ac: pcapkit.const.tcp.checksum.Checksum¶: Checksum algorithm.

Quick-Start Response Option¶

For TCP Quick-Start Response (QS) option as described in RFC 4782, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.qs.kind`	Kind (`27`)
1	8	`tcp.qs.length`	Length (`8`)
2	16		Reserved (must be `\x00`)
2	20	`tcp.qs.req_rate`	Request Rate
3	24	`tcp.qs.ttl_diff`	TTL Difference
4	32	`tcp.qs.nounce`	QS Nounce
7	62		Reserved (must be `\x00`)

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_QSOPT¶

Bases: DataType_TCP_Opt

Structure of TCP QSopt [RFC 4782].

req_rate: int¶: Request rate.

ttl_diff: int¶: TTL difference.

nounce: int¶: QS nounce.

User Timeout Option¶

For TCP User Timeout (TIMEOUT) option as described in RFC 5482, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.timeout.kind`	Kind (`28`)
1	8	`tcp.timeout.length`	Length (`4`)
2	16	`tcp.timeout.granularity`	Granularity
2	17	`tcp.timeout.timeout`	User Timeout

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_UTOPT¶

Bases: DataType_TCP_Opt

Structure of TCP TIMEOUT [RFC 5482].

granularity: Literal[‘minutes’, ‘seconds’]¶: Granularity.

timeout: datetime.timedelta¶: User timeout.

Authentication Option¶

For Authentication (AO) option as described in RFC 5925, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.ao.kind`	Kind (`29`)
1	8	`tcp.ao.length`	Length
2	16	`tcp.ao.key_id`	KeyID
3	24	`tcp.ao.r_next_key_id`	RNextKeyID
4	32	`tcp.ao.mac`	Message Authentication Code

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_TCPAO¶

Bases: DataType_TCP_Opt

Structure of TCP AOopt [RFC 5925].

key_id: int¶: KeyID.

r_next_key_id: int¶: RNextKeyID.

mac: bytes¶: Message authentication code.

Multipath TCP Options¶

For Multipath TCP (MP-TCP) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype
2	20	`tcp.mp.data`	Subtype-specific Data

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MPTCP¶

Bases: DataType_TCP_Opt

Structure of MP-TCP [RFC 6824].

subtype: pcapkit.const.tcp.mp_tcp_option.MPTCPOption¶: Subtype.

data: Optional[bytes]¶: Subtype-specific data.

Multipath Capable Option¶

For Multipath Capable (MP_CAPABLE) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length (`12`/`20`)
2	16	`tcp.mp.subtype`	Subtype (`0`)
2	20	`tcp.mp.capable.version`	Version
3	24	`tcp.mp.capable.flags.req`	Checksum Require Flag (`A`)
3	25	`tcp.mp.capable.flags.ext`	Extensibility Flag (`B`)
3	26	`tcp.mp.capable.flags.res`	Unassigned (`C` - `G`)
3	31	`tcp.mp.capable.flags.hsa`	HMAC-SHA1 Flag (`H`)
4	32	`tcp.mp.capable.skey`	Option Sender’s Key
12	96	`tcp.mp.capable.rkey`	Option Receiver’s Key (only if option length is `20`)

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE¶

Bases: DataType_TCP_Opt_MPTCP

Structure of MP_CAPABLE [RFC 6824].

capable: DataType_TCP_Opt_MP_CAPABLE_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE_Data¶

Bases: TypedDict

Structure of MP_CAPABLE [RFC 6824].

version: int¶: Version.

flags: DataType_TCP_Opt_MP_CAPABLE_Flags¶: Flags.

skey: int¶: Option sender’s key.

rkey: Optional[int]¶: Option receiver’s key.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_CAPABLE_Flags¶

Bases: TypedDict

Flags.

req: bool¶: Checksum require flag.

ext: bool¶: Extensibility flag.

res: Tuple[bool, bool, bool, bool, bool]¶: Unassigned flags.

hsa: bool¶: HMAC-SHA1 flag.

Join Connection Option¶

For Join Connection (MP_JOIN) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`1`)
2	20	`tcp.mp.data`	Handshake-specific Data

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN¶

Bases: DataType_TCP_Opt_MPTCP

Structure of MP_JOIN [RFC 6824].

connection: Optional[Literal[‘SYN/ACK’, ‘SYN’, ‘ACK’]]¶: Join connection type.

join: DataType_TCP_Opt_MP_JOIN_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_Data¶

Bases: TypedDict

Structure of MP_JOIN [RFC 6824].

data: Optional[bytes]¶: Unknown type data.

`MP_JOIN-SYN`¶

For Join Connection (MP_JOIN-SYN) option for Initial SYN as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length (`12`)
2	16	`tcp.mp.subtype`	Subtype (`1` \| `SYN`)
2	20		Reserved (must be `\x00`)
2	23	`tcp.mp.join.syn.backup`	Backup Path (`B`)
3	24	`tcp.mp.join.syn.addr_id`	Address ID
4	32	`tcp.mp.join.syn.token`	Receiver’s Token
8	64	`tcp.mp.join.syn.rand_num`	Sender’s Random Number

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYN¶

Bases: DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-SYN [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_SYN_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYN_Data¶

Bases: TypedDict

Structure of MP_JOIN-SYN [RFC 6824].

backup: bool¶: Backup path.

addr_id: int¶: Address ID.

token: int¶: Receiver’s token.

rand_num: int¶: Sender’s random number.

`MP_JOIN-SYN/ACK`¶

For Join Connection (MP_JOIN-SYN/ACK) option for Responding SYN/ACK as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length (`16`)
2	16	`tcp.mp.subtype`	Subtype (`1` \| `SYN/ACK`)
2	20		Reserved (must be `\x00`)
2	23	`tcp.mp.join.synack.backup`	Backup Path (`B`)
3	24	`tcp.mp.join.synack.addr_id`	Address ID
4	32	`tcp.mp.join.synack.hmac`	Sender’s Truncated HMAC
12	96	`tcp.mp.join.synack.rand_num`	Sender’s Random Number

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYNACK¶

Bases: DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-SYN/ACK [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_SYNACK_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_SYNACK_Data¶

Bases: TypedDict

Structure of MP_JOIN-SYN/ACK [RFC 6824].

backup: bool¶: Backup path.

addr_id: int¶: Address ID.

hmac: bytes¶: Sender’s truncated HMAC.

rand_num: int¶: Sender’s random number.

`MP_JOIN-ACK`¶

For Join Connection (MP_JOIN-ACK) option for Third ACK as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length (`16`)
2	16	`tcp.mp.subtype`	Subtype (`1` \| `ACK`)
2	20		Reserved (must be `\x00`)
4	32	`tcp.mp.join.ack.hmac`	Sender’s HMAC

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_ACK¶

Bases: DataType_TCP_Opt_MP_JOIN_Data

Structure of MP_JOIN-ACK [RFC 6824].

syn: DataType_TCP_Opt_MP_JOIN_ACK_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_JOIN_ACK_Data¶

Bases: TypedDict

Structure of MP_JOIN-ACK [RFC 6824].

hmac: bytes¶: Sender’s HMAC.

Data Sequence Signal Option¶

For Data Sequence Signal (DSS) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`2`)
2	20		Reserved (must be `\x00`)
3	27	`tcp.mp.dss.flags.fin`	DATA_FIN (`F`)
3	28	`tcp.mp.dss.flags.dsn_len`	DSN Length (`m`)
3	29	`tcp.mp.dss.flags.data_pre`	DSN, SSN, Data-Level Length, CHKSUM Present (`M`)
3	30	`tcp.mp.dss.flags.ack_len`	ACK Length (`a`)
3	31	`tcp.mp.dss.flags.ack_pre`	Data ACK Present (`A`)
4	32	`tcp.mp.dss.ack`	Data ACK (`4` / `8` octets)
8/12	64/96	`tcp.mp.dss.dsn`	DSN (`4` / `8` octets)
12/20	48/160	`tcp.mp.dss.ssn`	Subflow Sequence Number
16/24	128/192	`tcp.mp.dss.dl_len`	Data-Level Length
18/26	144/208	`tcp.mp.dss.checksum`	Checksum

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS¶

Bases: DataType_TCP_Opt_MPTCP

Structure of DSS [RFC 6824].

dss: DataType_TCP_Opt_DSS_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS_Data¶

Bases: TypedDict

Structure of DSS [RFC 6824].

flags: DataType_TCP_Opt_DSS_Flags¶: Flags.

ack: Optional[int]¶: Data ACK.

dsn: Optional[int]¶: DSN.

ssn: Optional[int]¶: Subflow sequence number.

dl_len: int¶: Data-level length.

checksum: bytes¶: Checksum.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_DSS_Flags¶

Bases: TypedDict

Flags.

fin: bool¶: DATA_FIN.

dsn_len: int¶: DSN length.

data_pre: int¶: DSN, SSN, data-level length, checksum present.

ack_len: int¶: ACK length.

ack_pre: bool¶: ACK present.

Add Address Option¶

For Add Address (ADD_ADDR) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`3`)
2	20	`tcp.mp.add_addr.ip_ver`	IP Version
3	24	`tcp.mp.add_addr.addr_id`	Address ID
4	32	`tcp.mp.add_addr.addr`	IP Address (`4` / `16`)
8/20	64/160	`tcp.mp.add_addr.port`	Port (optional)

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ADD_ADDR¶

Bases: DataType_TCP_Opt_MPTCP

Structure of ADD_ADDR [RFC 6824].

add_addr: DataType_TCP_Opt_ADD_ADDR_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_ADD_ADDR_Data¶

Bases: TypedDict

Structure of ADD_ADDR [RFC 6824].

ip_ver: Literal[4, 6]¶: IP version.

addr_id: int¶: Address ID.

addr: Union[ipaddress.IPv4Address, ipaddress.IPv6Address]¶: IP address.

port: Optional[int]¶: Port.

Remove Address Option¶

For Remove Address (REMOVE_ADDR) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`4`)
2	20		Reserved (must be `\x00`)
3	24	`tcp.mp.remove_addr.addr_id`	Address ID (optional list)

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_REMOVE_ADDR¶

Bases: DataType_TCP_Opt_MPTCP

Structure of REMOVE_ADDR [RFC 6824].

remove_addr: DataType_TCP_Opt_REMOVE_ADDR_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_REMOVE_ADDR_Data¶

Bases: TypedDict

Structure of REMOVE_ADDR [RFC 6824].

addr_id: Tuple[int]¶: Array of address IDs.

Change Subflow Priority Option¶

For Change Subflow Priority (MP_PRIO) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`4`)
2	23	`tcp.mp.prio.backup`	Backup Path (`B`)
3	24	`tcp.mp.prio.addr_id`	Address ID (optional)

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_PRIO¶

Bases: DataType_TCP_Opt_MPTCP

Structure of MP_PRIO [RFC 6824].

prio: DataType_TCP_Opt_MP_PRIO_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_PRIO_Data¶

Bases: TypedDict

Structure of MP_PRIO [RFC 6824].

backup: bool¶: Backup path.

addr_id: Optional[int]¶: Address ID.

Fallback Option¶

For Fallback (MP_FAIL) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`4`)
2	23		Reserved (must be `\x00`)
4	32	`tcp.mp.fail.dsn`	Data Sequence Number

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FAIL¶

Bases: DataType_TCP_Opt_MPTCP

Structure of MP_FAIL [RFC 6824].

fail: DataType_TCP_Opt_MP_FAIL_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FAIL_Data¶

Bases: TypedDict

Structure of MP_FAIL [RFC 6824].

dsn: int¶: Data sequence number.

Fast Close Option¶

For Fast Close (MP_FASTCLOSE) options as described in RFC 6824, its structure is described as below:

Octets	Bits	Name	Description
0	0	`tcp.mp.kind`	Kind (`30`)
1	8	`tcp.mp.length`	Length
2	16	`tcp.mp.subtype`	Subtype (`4`)
2	23		Reserved (must be `\x00`)
4	32	`tcp.mp.fastclose.rkey`	Option Receiver’s Key

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FASTCLOSE¶

Bases: DataType_TCP_Opt_MPTCP

Structure of MP_FASTCLOSE [RFC 6824].

fastclose: DataType_TCP_Opt_MP_FASTCLOSE_Data¶: Subtype-specific data.

class pcapkit.protocols.transport.tcp.DataType_TCP_Opt_MP_FASTCLOSE_Data¶

Bases: TypedDict

Structure of MP_FASTCLOSE [RFC 6824].

rkey: int¶: Option receiver’s key.

*: https://en.wikipedia.org/wiki/Transmission_Control_Protocol

Code	Method	Description
0	`_read_mode_donone()`	do nothing
1	`_read_mode_unpack()`	unpack according to size
2	`_read_mode_tsopt()`	timestamps
3	`_read_mode_pocsp()`	POC service profile
4	`_read_mode_acopt()`	alternate checksum request
5	`_read_mode_qsopt()`	Quick-Start response
6	`_read_mode_utopt()`	user timeout option
7	`_read_mode_tcpao()`	TCP authentication option
8	`_read_mode_mptcp()`	multipath TCP

TCP - Transmission Control Protocol¶

Data Structure¶

TCP Miscellaneous Options¶

No Process Options¶

Unpack Process Options¶

Timestamps Option¶

Partial Order Connection Service Profile Option¶

Alternate Checksum Request Option¶

Quick-Start Response Option¶

User Timeout Option¶

Authentication Option¶

Multipath TCP Options¶

Multipath Capable Option¶

Join Connection Option¶

`MP_JOIN-SYN`¶

`MP_JOIN-SYN/ACK`¶

`MP_JOIN-ACK`¶

Data Sequence Signal Option¶

Add Address Option¶

Remove Address Option¶

Change Subflow Priority Option¶

Fallback Option¶

Fast Close Option¶

PyPCAPKit

Navigation

Related Topics

Code	Method	Description
0	`_read_mptcp_capable()`	`MP_CAPABLE`
1	`_read_mptcp_join()`	`MP_JOIN`
2	`_read_mptcp_dss()`	`DSS`
3	`_read_mptcp_add()`	`ADD_ADDR`
4	`_read_mptcp_remove()`	`REMOVE_ADDR`
5	`_read_mptcp_prio()`	`MP_PRIO`
6	`_read_mptcp_fail()`	`MP_FAIL`
7	`_read_mptcp_fastclose()`	`MP_FASTCLOSE`

TCP - Transmission Control Protocol¶

Data Structure¶

TCP Miscellaneous Options¶

No Process Options¶

Unpack Process Options¶

Timestamps Option¶

Partial Order Connection Service Profile Option¶

Alternate Checksum Request Option¶

Quick-Start Response Option¶

User Timeout Option¶

Authentication Option¶

Multipath TCP Options¶

Multipath Capable Option¶

Join Connection Option¶

MP_JOIN-SYN¶

MP_JOIN-SYN/ACK¶

MP_JOIN-ACK¶

Data Sequence Signal Option¶

Add Address Option¶

Remove Address Option¶

Change Subflow Priority Option¶

Fallback Option¶

Fast Close Option¶

`MP_JOIN-SYN`¶

`MP_JOIN-SYN/ACK`¶

`MP_JOIN-ACK`¶