PCAPNG Constant Enumerations

This module contains all constant enumerations of PCAPNG implementations. Available enumerations include:

PCAPNG_BlockType	Block Types [*]
PCAPNG_OptionType	Option Types [†]
PCAPNG_HashAlgorithm	Hash Algorithms [‡]
PCAPNG_VerdictType	Verdict Types [§]
PCAPNG_RecordType	Record Types [¶]
PCAPNG_SecretsType	Secrets Types [#]
PCAPNG_FilterType	Filter Types [♠]
PCAPNG_TLSKeyLabel	TLS Key Log Labels [♥]

Block Types

This module contains the constant enumeration for Block Types, which is automatically generated from pcapkit.vendor.pcapng.block_type.BlockType.

class pcapkit.const.pcapng.block_type.BlockType(*values)

Bases: EnumRegistry, IntEnum

[BlockType] Block Types

Reserved_0x00000000 = 0

Reserved ???

Interface_Description_Block = 1

Interface Description Block ( Section 4.2 )

Packet_Block = 2

Packet Block ( Appendix A )

Simple_Packet_Block = 3

Simple Packet Block ( Section 4.4 )

Name_Resolution_Block = 4

Name Resolution Block ( Section 4.5 )

Interface_Statistics_Block = 5

Interface Statistics Block ( Section 4.6 )

Enhanced_Packet_Block = 6

Enhanced Packet Block ( Section 4.3 )

IRIG_Timestamp_Block = 7

IRIG Timestamp Block (requested by Gianluca Varenni <gianluca.varenni@cacetech.com>, CACE Technologies LLC); code also used for Socket Aggregation Event Block

ARINC_429_in_AFDX_Encapsulation_Information_Block = 8

ARINC 429 in AFDX Encapsulation Information Block (requested by Gianluca Varenni <gianluca.varenni@cacetech.com>, CACE Technologies LLC)

systemd_Journal_Export_Block = 9

systemd Journal Export Block ( Section 4.7 )

Decryption_Secrets_Block = 10

Decryption Secrets Block ( Section 4.8 )

Hone_Project_Machine_Info_Block = 257

Hone Project Machine Info Block (see also Google version )

Hone_Project_Connection_Event_Block = 258

Hone Project Connection Event Block (see also Google version )

Sysdig_Machine_Info_Block = 513

Sysdig Machine Info Block

Sysdig_Process_Info_Block_version_1 = 514

Sysdig Process Info Block, version 1

Sysdig_FD_List_Block = 515

Sysdig FD List Block

Sysdig_Event_Block = 516

Sysdig Event Block

Sysdig_Interface_List_Block = 517

Sysdig Interface List Block

Sysdig_User_List_Block = 518

Sysdig User List Block

Sysdig_Process_Info_Block_version_2 = 519

Sysdig Process Info Block, version 2

Sysdig_Event_Block_with_flags = 520

Sysdig Event Block with flags

Sysdig_Process_Info_Block_version_3 = 521

Sysdig Process Info Block, version 3

Sysdig_Process_Info_Block_version_4 = 528

Sysdig Process Info Block, version 4

Sysdig_Process_Info_Block_version_5 = 529

Sysdig Process Info Block, version 5

Sysdig_Process_Info_Block_version_6 = 530

Sysdig Process Info Block, version 6

Sysdig_Process_Info_Block_version_7 = 531

Sysdig Process Info Block, version 7

Custom_Block_that_rewriters_can_copy_into_new_files = 2989

Custom Block that rewriters can copy into new files ( Section 4.9 )

Custom_Block_that_rewriters_should_not_copy_into_new_files = 1073744813

Custom Block that rewriters should not copy into new files ( Section 4.9 )

Section_Header_Block = 168627466

Section Header Block ( Section 4.1 )

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

BlockType

Hash Algorithms

This module contains the constant enumeration for Hash Algorithms, which is automatically generated from pcapkit.vendor.pcapng.hash_algorithm.HashAlgorithm.

class pcapkit.const.pcapng.hash_algorithm.HashAlgorithm(*values)

Bases: EnumRegistry, IntEnum

[HashAlgorithm] Hash Algorithms

two_s_complement = 0

XOR = 1

CRC32 = 2

MD_5 = 3

SHA_1 = 4

Toeplitz = 5

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

HashAlgorithm

Option Types

This module contains the constant enumeration for Option Types, which is automatically generated from pcapkit.vendor.pcapng.option_type.OptionType.

class pcapkit.const.pcapng.option_type.OptionType(*values)

Bases: EnumRegistry, StrEnum

[OptionType] Option Types

Changed in version 1.1.0: A member converts with int to its option code, and compares, orders and hashes as that code.

opt_name: str

Short name of the option type.

opt_value: int

Numeric value of the option type.

opt_endofopt: OptionType = 'opt_endofopt [0]'

opt_endofopt

opt_comment: OptionType = 'opt_comment [1]'

opt_comment

opt_custom_2988: OptionType = 'opt_custom [2988]'

opt_custom

opt_custom_2989: OptionType = 'opt_custom [2989]'

opt_custom

opt_custom_19372: OptionType = 'opt_custom [19372]'

opt_custom

opt_custom_19373: OptionType = 'opt_custom [19373]'

opt_custom

if_name: OptionType = 'if_name [2]'

if_name

if_description: OptionType = 'if_description [3]'

if_description

if_IPv4addr: OptionType = 'if_IPv4addr [4]'

if_IPv4addr

if_IPv6addr: OptionType = 'if_IPv6addr [5]'

if_IPv6addr

if_MACaddr: OptionType = 'if_MACaddr [6]'

if_MACaddr

if_EUIaddr: OptionType = 'if_EUIaddr [7]'

if_EUIaddr

if_speed: OptionType = 'if_speed [8]'

if_speed

if_tsresol: OptionType = 'if_tsresol [9]'

if_tsresol

if_tzone: OptionType = 'if_tzone [10]'

if_tzone

if_filter: OptionType = 'if_filter [11]'

if_filter

if_os: OptionType = 'if_os [12]'

if_os

if_fcslen: OptionType = 'if_fcslen [13]'

if_fcslen

if_tsoffset: OptionType = 'if_tsoffset [14]'

if_tsoffset

if_hardware: OptionType = 'if_hardware [15]'

if_hardware

if_txspeed: OptionType = 'if_txspeed [16]'

if_txspeed

if_rxspeed: OptionType = 'if_rxspeed [17]'

if_rxspeed

epb_flags: OptionType = 'epb_flags [2]'

epb_flags

epb_hash: OptionType = 'epb_hash [3]'

epb_hash

epb_dropcount: OptionType = 'epb_dropcount [4]'

epb_dropcount

epb_packetid: OptionType = 'epb_packetid [5]'

epb_packetid

epb_queue: OptionType = 'epb_queue [6]'

epb_queue

epb_verdict: OptionType = 'epb_verdict [7]'

epb_verdict

ns_dnsname: OptionType = 'ns_dnsname [2]'

ns_dnsname

ns_dnsIP4addr: OptionType = 'ns_dnsIP4addr [3]'

ns_dnsIP4addr

ns_dnsIP6addr: OptionType = 'ns_dnsIP6addr [4]'

ns_dnsIP6addr

isb_starttime: OptionType = 'isb_starttime [2]'

isb_starttime

isb_endtime: OptionType = 'isb_endtime [3]'

isb_endtime

isb_ifrecv: OptionType = 'isb_ifrecv [4]'

isb_ifrecv

isb_ifdrop: OptionType = 'isb_ifdrop [5]'

isb_ifdrop

isb_filteraccept: OptionType = 'isb_filteraccept [6]'

isb_filteraccept

isb_osdrop: OptionType = 'isb_osdrop [7]'

isb_osdrop

isb_usrdeliv: OptionType = 'isb_usrdeliv [8]'

isb_usrdeliv

pack_flags: OptionType = 'pack_flags [2]'

pack_flags

pack_hash: OptionType = 'pack_hash [3]'

pack_hash

classmethod _unregistered_member(value, name)

Build a member absent from this registry’s own lookup tables.

Cannot reuse the base’s generic construction – _unregistered_member() calls str’s __new__ directly on the raw value, but OptionType stores a formatted string ('{name} [{value}]') as its own _value_, not value itself, so that approach would build a member whose value looks nothing like this registry’s real members.

Deliberately does not add to __members_ns__ either – that dict is this registry’s own second lookup table, alongside _value2member_map_, and growing it would defeat the whole point of an unregistered member exactly as growing _value2member_map_ would.

Parameters:

• value (int) – Value to get enum item.

• name (str) – Bare label for the unregistered member, per the ranged mint/unmint criterion.

Return type:

OptionType

classmethod register(value, name)

Register a new option code value under name.

Overrides register() because of this registry’s own __new__():

• __new__() takes the option name as its second argument and files the member under the namespace that name’s prefix gives (if_rtaudit goes under if), so name is passed through to it as well as used as the member’s attribute name.

• _value_ is the formatted '{name} [{value}]' string, so the base’s duplicate check against _value2member_map_ can never match an int code. The check runs against __members_ns__ instead, the table get() resolves codes through: both name’s own namespace and opt, whose codes are common to every block and which get() overlays the namespace on.

Parameters:

• value (int) – Option code of the new member.

• name (str) – Name of the new member, led by its namespace, e.g. if_rtaudit.

Return type:

OptionType

Returns:

The newly registered member.

Raises:

• ValueError – If value is already assigned in name’s namespace or in opt, or if name is already taken.

• EnumValueError – If value is outside the range _missing_() accepts, from _validate_value(). A ValueError, carrying the message the constructor raises for the same code.

classmethod register_alias(value, name)

Add name as a further name for the member at option code value.

Overrides register_alias() for the same reason as register(): the base looks the int code up in _value2member_map_, whose keys are the formatted '{name} [{value}]' strings, so it could never find one.

The member is resolved as get() resolves value with namespace set to name’s prefix: that namespace overlaid on opt. So register_alias(2, 'if_label') aliases if_name, while register_alias(1, 'if_note') aliases opt_comment, since if assigns no code 1 of its own. The alias adds a name only; the member keeps its own name and namespace.

Parameters:

• value (int) – Option code of the existing member to alias.

• name (str) – Alias to add for it, led by the namespace to resolve value in.

Return type:

OptionType

Returns:

The existing member, now reachable under name as well.

Raises:

ValueError – If neither name’s namespace nor opt assigns value, or if name is already taken.

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the option codes the constructor refuses, in the same words (#1816). get() never calls it: that override answers every int code, out of range or not, with an unregistered member.

Parameters:

value (Any) – Option code about to be minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

OptionType

static _generate_next_value_(name, start, count, last_values)

Return the lower-cased version of the member name.

Record Types

This module contains the constant enumeration for Record Types, which is automatically generated from pcapkit.vendor.pcapng.record_type.RecordType.

class pcapkit.const.pcapng.record_type.RecordType(*values)

Bases: EnumRegistry, IntEnum

[RecordType] Record Types

nrb_record_end = 0

nrb_record_end

nrb_record_ipv4 = 1

nrb_record_ipv4

nrb_record_ipv6 = 2

nrb_record_ipv6

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

RecordType

Secrets Types

This module contains the constant enumeration for Secrets Types, which is automatically generated from pcapkit.vendor.pcapng.secrets_type.SecretsType.

class pcapkit.const.pcapng.secrets_type.SecretsType(*values)

Bases: EnumRegistry, IntEnum

[SecretsType] Secrets Types

TLS_Key_Log = 1414288203

WireGuard_Key_Log = 1464290124

ZigBee_NWK_Key = 1515083595

ZigBee_APS_Key = 1514229843

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

SecretsType

Verdict Types

This module contains the constant enumeration for Verdict Types, which is automatically generated from pcapkit.vendor.pcapng.verdict_type.VerdictType.

class pcapkit.const.pcapng.verdict_type.VerdictType(*values)

Bases: EnumRegistry, IntEnum

[VerdictType] Verdict Types

Hardware = 0

Linux_eBPF_TC = 1

Linux_eBPF_XDP = 2

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

VerdictType

Filter Types

This module contains the constant enumeration for Filter Types, which is automatically generated from pcapkit.vendor.pcapng.filter_type.FilterType.

class pcapkit.const.pcapng.filter_type.FilterType(new_class_name, /, names, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: EnumRegistry, IntEnum

[FilterType] Filter Types

classmethod _validate_value(value)

Reject value unless it passes the range check _missing_() makes.

Overrides _validate_value() with that check and the message it raises, so register() refuses exactly the values get() refuses, in the same words (#1816).

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value fails that check. A ValueError, so an except ValueError caller is unaffected.

classmethod _missing_(value)

Lookup function used when value is not found.

Parameters:

value (int) – Value to get enum item.

Return type:

FilterType

TLS Key Log Labels

This module contains the constant enumeration for TLS Key Log Labels, which is automatically generated from pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel.

class pcapkit.const.pcapng.tls_key_label.TLSKeyLabel(*values)

Bases: EnumRegistry, StrEnum

[TLSKeyLabel] TLS Key Log Labels

Added in version 1.5.0: Moved here from pcapkit.protocols.misc.pcapng (#886).

RSA = 'RSA'

NSS-historical: not a registered label of RFC 9850 Section 4.2’s “TLS SSLKEYLOGFILE Labels” registry. Defined by the Mozilla NSS SSLKEYLOGFILE convention and removed in NSS 3.34; kept here only so that key logs predating RFC 9850 still read.

CLIENT_RANDOM = 'CLIENT_RANDOM'

Master secret in TLS 1.2 and earlier, c.f., RFC 9850 Section 4.2.

CLIENT_EARLY_TRAFFIC_SECRET = 'CLIENT_EARLY_TRAFFIC_SECRET'

Secret for client early data records, c.f., RFC 9850 Section 4.2.

EARLY_EXPORTER_SECRET = 'EARLY_EXPORTER_SECRET'

Early exporter secret, c.f., RFC 9850 Section 4.2.

CLIENT_HANDSHAKE_TRAFFIC_SECRET = 'CLIENT_HANDSHAKE_TRAFFIC_SECRET'

Secret protecting client handshake, c.f., RFC 9850 Section 4.2.

SERVER_HANDSHAKE_TRAFFIC_SECRET = 'SERVER_HANDSHAKE_TRAFFIC_SECRET'

Secret protecting server handshake, c.f., RFC 9850 Section 4.2.

CLIENT_TRAFFIC_SECRET_0 = 'CLIENT_TRAFFIC_SECRET_0'

Secret protecting client records post handshake, c.f., RFC 9850 Section 4.2.

SERVER_TRAFFIC_SECRET_0 = 'SERVER_TRAFFIC_SECRET_0'

Secret protecting server records post handshake, c.f., RFC 9850 Section 4.2.

EXPORTER_SECRET = 'EXPORTER_SECRET'

Exporter secret after handshake, c.f., RFC 9850 Section 4.2.

ECH_SECRET = 'ECH_SECRET'

HPKE KEM shared secret used in the ECH, c.f., RFC 9850 Section 4.2.

ECH_CONFIG = 'ECH_CONFIG'

ECHConfig used for construction of the ECH, c.f., RFC 9850 Section 4.2.

classmethod _validate_value(value)

Reject value unless it is a str, this registry’s member type.

Overrides _validate_value() so that register() refuses a value get() refuses, in the same words (#1816). There is no _missing_ here to take a range from – the constructor refuses every value no member carries – so the member type is the whole check, and any str label may still be minted.

Parameters:

value (Any) – Value about to be looked up or minted.

Raises:

EnumValueError – If value is not a str. A ValueError, so an except ValueError caller is unaffected.

static _generate_next_value_(name, start, count, last_values)

Return the lower-cased version of the member name.

[*]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-standardized-block-type-cod

[†]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-options

[‡]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-enhanced-packet-block-flags

[§]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-enhanced-packet-block

[¶]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-name-resolution-block

[#]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-decryption-secrets-block

[♠]

https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-interface-description-block

[♥]

https://www.iana.org/assignments/tls-parameters/tls-sslkeylogfile-labels.csv, c.f., RFC 9850 Section 4.2