Byte-Order Helpers

pcapkit.corekit.schema.byteorder reads the byte order a capture file or section declares out of the packet data: byteorder_callback() sets it on a NumberField for the record header of a classic PCAP file (frame) and the blocks of a PCAP-NG file (pcapng), and packet_byteorder() is what the callback and the PCAP-NG makers (pcapkit.protocols.misc.pcapng) read it with. It is one of the pcapkit.corekit.schema helpers shared across the schema layer, not part of the header schema framework in pcapkit.protocols.schema; see Choosing Between utilities and corekit.

Added in version 1.6.0: Moved here from pcapkit.corekit.fields.byteorder, with both its helpers (#2674).

Removed in version 1.6.0: pcapkit.corekit.fields.byteorder, with no alias (#2674).

pcapkit.corekit.schema.byteorder.byteorder_callback(field, packet)[source]

Update byte order of a PCAP or PCAP-NG file.

Parameters:

Notes

byteorder is the key a caller has to seed, and packet_byteorder() is what reads it. Frame.pack and Frame.unpack both write it from the global header’s magic number. A PCAP-NG Section Header Block writes it from its own Byte-Order Magic (see shb_byteorder_callback()), and the blocks, options and records of that section read it, nested or not. The fallback to sys.byteorder is for a schema packed or unpacked on its own, with no header to ask. That also means a misspelled key looks exactly like an absent one and reports nothing: every field would be read in the host’s order rather than the file’s, which is right by coincidence on a little-endian capture and byte-swapped on a big-endian one. See tests/protocols/misc/pcap/test_frame_endian_runtime.py for the fixtures that take the other side of the branch.

pcapkit.corekit.schema.byteorder.packet_byteorder(packet)[source]

Byte order declared for the file or section that packet belongs to.

A nested schema is handed its parent’s packet data under a __packet__ key (see SchemaField.pack), so the byte order may live one level up.

Parameters:

packet (dict[str, Any]) – Packet data.

Return type:

Literal['big', 'little']

Returns:

Byte order of the enclosing file or section, falling back to the host byte order when the packet data declares none.