DTLS Handshake-Message Analysis¶

pcapkit.foundation.analysis.dtls contains dtls_handshake() only, which decodes a DTLS handshake message that DTLS reassembled (RFC 6347 Section 4.2.3). The decode itself is DTLS.analyze_handshake (#2622).

pcapkit.foundation.analysis.dtls.dtls_handshake(datagram)[source]¶

Parse a DTLS handshake message reassembled by DTLS.

The message is decoded by DTLS.analyze_handshake, which reads it as if it had arrived unfragmented, fragment_offset 0 and fragment_length its length (RFC 6347 Section 4.2.3). So a ClientHello, ServerHello or EncryptedExtensions body decodes as an unfragmented one does, whatever its length, and any other body stays raw octets.

Parameters:: datagram (Datagram) – Reassembled message (reasm.dtls.datagram).
Return type:: DTLSHandshake | None
Returns:: The message, unfragmented. Its body stays the raw reassembled octets if they do not decode as its msg_type. None if datagram is incomplete, as its missing octets cannot be decoded.

Note

Datagram.packet holds the same result, decoded on its first read, unless the reassembly’s __protocol_type__ names another protocol, whose analyze_handshake then decodes it instead.