TCP Datagram Analysis¶

pcapkit.foundation.analysis.tcp contains tcp_datagram() only, which parses the application-layer payload of a TCP datagram that TCP reassembled.

pcapkit.foundation.analysis.tcp.tcp_datagram(datagram)[source]¶

Parse the payload of a TCP datagram reassembled by TCP.

A reassembled datagram carries no protocol number, so its payload is dispatched on its (source, destination) ports by Transport.analyze of TCP. Each port is resolved to its TCP member by Transport._make_port, as TCP._make_ports resolves them for the reassembly.

Parameters:: datagram (Datagram) – Reassembled datagram (reasm.tcp.datagram).
Return type:: ProtocolBase | None
Returns:: The parsed payload. A payload reported as one contiguous run is parsed whether or not datagram is complete, as strict=False reports an incomplete one. None if the payload is the tuple of runs received, as strict=True reports an incomplete one.

Note

Datagram.packet holds the same result, parsed on its first read, unless the reassembly’s __protocol_type__ names another protocol, which then parses it instead.