Byte-Order Helpers

pcapkit.corekit.fields.byteorder contains the field callback that reads a capture file’s byte order out of the packet data. It is shared by the PCAP frame header (frame) and the PCAP-NG blocks (pcapng).

Added in version 1.5.0: byteorder_callback() moves here from pcapkit.protocols.schema.misc.pcap.frame (#1711).

Auxiliary Functions

pcapkit.corekit.fields.byteorder.byteorder_callback(field, packet)[source]

Update byte order of a PCAP or PCAP-NG file.

Parameters:

Notes

byteorder is the key a caller has to seed, and packet_byteorder() is what reads it. Frame.pack and Frame.unpack both write it from the global header’s magic number. A PCAP-NG Section Header Block writes it from its own Byte-Order Magic (see shb_byteorder_callback()), and the blocks, options and records of that section read it, nested or not. The fallback to sys.byteorder is for a schema packed or unpacked on its own, with no header to ask. That also means a misspelled key looks exactly like an absent one and reports nothing: every field would be read in the host’s order rather than the file’s, which is right by coincidence on a little-endian capture and byte-swapped on a big-endian one. See tests/protocols/misc/pcap/test_frame_endian_runtime.py for the fixtures that take the other side of the branch.

pcapkit.corekit.fields.byteorder.packet_byteorder(packet)[source]

Byte order declared for the file or section that packet belongs to.

A nested schema is handed its parent’s packet data under a __packet__ key (see SchemaField.pack), so the byte order may live one level up.

Parameters:

packet (dict[str, Any]) – Packet data.

Return type:

Literal['big', 'little']

Returns:

Byte order of the enclosing file or section, falling back to the host byte order when the packet data declares none.