Flow Tracing

Note

This approximates the Follow TCP Stream feature of Wireshark.

pcapkit.foundation.traceflow implements flow tracing functions for pcapkit package.

See also

For more information on customisation and extension, please refer to Customisation & Extensions.

• Base Class
  • Internal Definitions
  • Type Variables
• Follow TCP Stream
  • Terminology
  • Data Structures
  • Type Variables

All flow tracing classes are implemented as TraceFlowBase subclasses, which are responsible for processing extracted packets and follow the flow and/or stream to provide more insights. Below is a brief diagram of the class hierarchy of pcapkit.foundation.traceflow:

        flowchart LR
    A{{TraceFlowMeta}} -.->|metaclass| B(TraceFlowBase)

    B --> TCP

    B --> C(TraceFlow)
    C --> D([user customisation ...])

    click A "traceflow.html#pcapkit.foundation.traceflow.traceflow.TraceFlowMeta"
    click B "traceflow.html#pcapkit.foundation.traceflow.traceflow.TraceFlowBase"
    click C "traceflow.html#pcapkit.foundation.traceflow.traceflow.TraceFlow"
    click D "../../../ext.html#reassembly-and-flow-tracing"

    click TCP "tcp.html#pcapkit.foundation.traceflow.tcp.TCP"
    

Auxiliary Data

class pcapkit.foundation.traceflow.TraceFlowManager(*args: VT, **kwargs: VT)

Bases: Info

TraceFlow Manager.

tcp: TCP

TCP flow tracing.

class pcapkit.foundation.traceflow.data.data.TraceFlowData(*args: VT, **kwargs: VT)

Bases: Info

Data storage for flow tracing.

tcp: tuple[Index, ...]

TCP traced flows.

class pcapkit.foundation.traceflow.data.data.Deferred(reassembly)

Bases: object

A postponed reassembly of a traced flow’s application layer.

A traced flow’s packet is the application-layer payload of the conversation, as reassembled datagrams – one per direction and acknowledgement number, see TCP. Producing it means reassembling the stream, which is neither free nor wanted by most callers of a tracer – so the flow keeps the reassembler it was fed and this holds it until somebody reads Index.packet.

Note

Deliberately not pcapkit.foundation.reassembly.data.data.Deferred, and not shared with it. That one postpones a single analyze() call over bytes already in hand; this postpones a submit over a reassembler’s buffers. The two subpackages are siblings and neither should depend on the other, so the few lines are written twice rather than one importing the other – the same reason the two data/data.py modules mirror each other instead of merging.

Parameters:

reassembly (TCP) – The flow’s own TCP reassembler, fed the segments of this conversation as they were traced.

__call__()

Run the postponed reassembly.

Return type:

tuple[Datagram, ...]

Returns:

The conversation’s reassembled datagrams, one per direction and acknowledgement number. Each carries its own postponed analysis in Datagram.packet, so parsing the payload as an application-layer protocol is still not paid for until that is read in turn.