IPv4 - Internet Protocol version 4

pcapkit.protocols.internet.ipv4 contains IPv4 only, which implements extractor for Internet Protocol version 4 (IPv4) [*], whose structure is described as below:

Octets

Bits

Name

Description

0

0

ipv4.version

Version (4)

0

4

ipv4.hdr_len

Internet Header Length (IHL)

1

8

ipv4.tos.pre

Precedence

1

11

ipv4.tos.del

Delay

1

12

ipv4.tos.thr

Throughput

1

13

ipv4.tos.rel

Reliability

1

14

ipv4.tos.ecn

Explicit Congestion Notification (ECN)

2

16

ipv4.len

Total Length

4

32

ipv4.id

Identification

6

48

Reserved Bit (must be \x00)

6

49

ipv4.flags.df

Don’t Fragment (DF)

6

50

ipv4.flags.mf

More Fragments (MF)

6

51

ipv4.offset

Fragment Offset

8

64

ipv4.ttl

Time To Live (TTL)

9

72

ipv4.protocol

Protocol (Transport Layer)

10

80

ipv4.checksum

Header Checksum

12

96

ipv4.src

Source IP Address

16

128

ipv4.dst

Destination IP Address

20

160

ipv4.options

IP Options (if IHL > 5)

class pcapkit.protocols.internet.ipv4.IPv4(file=None, length=None, **kwargs)[source]

Bases: IP[IPv4, IPv4]

This class implements Internet Protocol version 4.

This class parses the following IPv4 options, which are registered in the self.__option__ attribute:

Changed in version 1.5.0:

  • Options dispatch through __option__ rather than by method name (#429).

  • A rebuild keeps the fragment offset in 8-octet units, and a header without options rebuilds (#494).

  • A rebuild from from_data() keeps the Total Length a truncated capture declares (#1155), and the octets past it as trailer (#1209).

  • A header length declared past the data raises ProtocolError on read (#1404).

  • A rebuild reproduces the option area, the route and timestamp slots, the SEC and TS fields and the reserved bits byte for byte (#1316 to #1322, #1326, #1349, #1391 to #1393).

  • The TS option’s maker takes an address as a string as well (#1402).

property name: Literal['Internet Protocol version 4']

Name of corresponding protocol.

property length: int

Header length of corresponding protocol.

property protocol: TransType

Name of next layer protocol.

property src: IPv4Address

Source IP address.

property dst: IPv4Address

Destination IP address.

classmethod id()[source]

Index ID of the protocol.

Return type:

tuple[Literal['IPv4']]

Returns:

Index ID of the protocol.

classmethod register_option(code, meth)[source]

Register an option parser.

Parameters:
Warns:

RegistryWarning – If a different entry is already registered for code; it is overwritten. Handing back the entry already stored, or one equal to it, is a silent no-op. The entry code shipped with is accepted like any other, so an override can be undone (#1362, #1363).

read(length=None, *, __packet__=None, **kwargs)[source]

Read Internet Protocol version 4 (IPv4).

Structure of IPv4 header [RFC 791]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source Address                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination Address                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
  • length (int | None) – Length of packet data.

  • __packet__ (dict[str, Any] | None) – Optional packet data.

  • **kwargs (Any) – Arbitrary keyword arguments.

Return type:

IPv4

Returns:

Parsed packet data.

Raises:

ProtocolError – If the version is not 4, or if ihl declares more header than the data holds.

make(tos_pre=<ToSPrecedence.Routine: 0>, tos_pre_default=None, tos_pre_namespace=None, tos_pre_reversed=False, tos_del=<ToSDelay.NORMAL: 0>, tos_del_default=None, tos_del_namespace=None, tos_del_reversed=False, tos_thr=<ToSThroughput.NORMAL: 0>, tos_thr_default=None, tos_thr_namespace=None, tos_thr_reversed=False, tos_rel=<ToSReliability.NORMAL: 0>, tos_rel_default=None, tos_rel_namespace=None, tos_rel_reversed=False, tos_ecn=<ToSECN.Not_ECT: 0>, tos_ecn_default=None, tos_ecn_namespace=None, tos_ecn_reversed=False, id=0, reserved=0, df=False, mf=False, offset=0, ttl=0, protocol=<TransType.UDP: 17>, protocol_default=None, protocol_namespace=None, protocol_reversed=False, checksum=b'\\x00\\x00', src='127.0.0.1', dst='0.0.0.0', options=None, total_length=None, padding=None, payload=b'', trailer=b'', **kwargs)[source]

Make (construct) packet data.

Parameters:
Return type:

IPv4

Returns:

Constructed packet data.

classmethod _make_data(data)[source]

Create key-value pairs from data for protocol construction.

Parameters:

data (IPv4) – protocol data

Return type:

dict[str, Any]

Returns:

Key-value pairs for protocol construction.

_read_ipv4_options(length)[source]

Read IPv4 option list.

Parameters:

length (int) – length of options

Return type:

OrderedMultiDict[OptionNumber, Option]

Returns:

Extracted IPv4 options.

Raises:

ProtocolError – If the parsed options total more than length octets.

_read_opt_unassigned(schema, *, options)[source]

Read IPv4 unassigned options.

Structure of IPv4 unassigned options [RFC 791]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     type      |    length     |         option data ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
Return type:

UnassignedOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is LESS THAN 2.

_read_opt_eool(schema, *, options)[source]

Read IPv4 End of Option List (EOOL) option.

Structure of IPv4 End of Option List (EOOL) option [RFC 791]:

+--------+
|00000000|
+--------+
  Type=0
Parameters:
Return type:

EOOLOption

Returns:

Parsed option data.

_read_opt_nop(schema, *, options)[source]

Read IPv4 No Operation (NOP) option.

Structure of IPv4 No Operation (NOP) option [RFC 791]:

+--------+
|00000001|
+--------+
  Type=1
Parameters:
Return type:

NOPOption

Returns:

Parsed option data.

_read_opt_sec(schema, *, options)[source]

Read IPv4 Security (SEC) option.

Structure of IPv4 Security (SEC) option [RFC 1108]:

+------------+------------+------------+-------------//----------+
|  10000010  |  XXXXXXXX  |  SSSSSSSS  |  AAAAAAA[1]    AAAAAAA0 |
|            |            |            |         [0]             |
+------------+------------+------------+-------------//----------+
  TYPE = 130     LENGTH   CLASSIFICATION         PROTECTION
                               LEVEL              AUTHORITY
                                                    FLAGS
Parameters:
Return type:

SECOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is LESS THAN 3.

Notes

Per RFC 1108 Section 2.4, the low-order bit of each protection authority octet is the field termination indicator: 0 on the final octet, 1 when more octets follow.

_read_opt_lsr(schema, *, options)[source]

Read IPv4 Loose Source Route (LSR) option.

Structure of IPv4 Loose Source Route (LSR) option [RFC 791]:

+--------+--------+--------+---------//--------+
|10000011| length | pointer|     route data    |
+--------+--------+--------+---------//--------+
Parameters:
Return type:

LSROption

Returns:

Parsed option data.

Raises:

ProtocolError – If option is malformed.

_read_opt_ts(schema, *, options)[source]

Read IPv4 Time Stamp (TS) option.

Structure of IPv4 Time Stamp (TS) option [RFC 791]:

+--------+--------+--------+--------+
|01000100| length | pointer|oflw|flg|
+--------+--------+--------+--------+
|         internet address          |
+--------+--------+--------+--------+
|             timestamp             |
+--------+--------+--------+--------+
|                 .                 |
                  .
                  .
Parameters:
Return type:

TSOption

Returns:

Parsed option data.

Raises:

ProtocolError – If the option is malformed.

_read_opt_e_sec(schema, *, options)[source]

Read IPv4 Extended Security (E-SEC) option.

Structure of IPv4 Extended Security (E-SEC) option [RFC 1108]:

+------------+------------+------------+-------//-------+
|  10000101  |  000LLLLL  |  AAAAAAAA  |  add sec info  |
+------------+------------+------------+-------//-------+
 TYPE = 133      LENGTH     ADDITIONAL      ADDITIONAL
                           SECURITY INFO     SECURITY
                            FORMAT CODE        INFO
Parameters:
Return type:

ESECOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is LESS THAN 3.

_read_opt_rr(schema, *, options)[source]

Read IPv4 Record Route (RR) option.

Structure of IPv4 Record Route (RR) option [RFC 791]:

+--------+--------+--------+---------//--------+
|00000111| length | pointer|     route data    |
+--------+--------+--------+---------//--------+
  Type=7
Parameters:
Return type:

RROption

Returns:

Parsed option data.

Raises:

ProtocolError – If option is malformed.

_read_opt_sid(schema, *, options)[source]

Read IPv4 Stream ID (SID) option.

Structure of IPv4 Stream ID (SID) option [RFC 791][RFC 6814]:

+--------+--------+--------+--------+
|10001000|00000010|    Stream ID    |
+--------+--------+--------+--------+
 Type=136 Length=4
Parameters:
Return type:

SIDOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_opt_ssr(schema, *, options)[source]

Read IPv4 Strict Source Route (SSR) option.

Structure of IPv4 Strict Source Route (SSR) option [RFC 791]:

+--------+--------+--------+---------//--------+
|10001001| length | pointer|     route data    |
+--------+--------+--------+---------//--------+
 Type=137
Parameters:
Return type:

SSROption

Returns:

Parsed option data.

Raises:

ProtocolError – If option is malformed.

_read_opt_mtup(schema, *, options)[source]

Read IPv4 MTU Probe (MTUP) option.

Structure of IPv4 MTU Probe (MTUP) option [RFC 1063][RFC 1191]:

+--------+--------+--------+--------+
|00001011|00000100|   2 octet value |
+--------+--------+--------+--------+
Parameters:
Return type:

MTUPOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_opt_mtur(schema, *, options)[source]

Read IPv4 MTU Reply (MTUR) option.

Structure of IPv4 MTU Reply (MTUR) option [RFC 1063][RFC 1191]:

+--------+--------+--------+--------+
|00001100|00000100|   2 octet value |
+--------+--------+--------+--------+
Parameters:
Return type:

MTUROption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_opt_tr(schema, *, options)[source]

Read IPv4 Traceroute (TR) option.

Structure of IPv4 Traceroute (TR) option [RFC 1393][RFC 6814]:

 0               8              16              24
+-+-+-+-+-+-+-+-+---------------+---------------+---------------+
|F| C |  Number |    Length     |          ID Number            |
+-+-+-+-+-+-+-+-+---------------+---------------+---------------+
|      Outbound Hop Count       |       Return Hop Count        |
+---------------+---------------+---------------+---------------+
|                     Originator IP Address                     |
+---------------+---------------+---------------+---------------+
Parameters:
Return type:

TROption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 12.

_read_opt_rtralt(schema, *, options)[source]

Read IPv4 Router Alert (RTRALT) option.

Structure of IPv4 Router Alert (RTRALT) option [RFC 2113]:

+--------+--------+--------+--------+
|10010100|00000100|  2 octet value  |
+--------+--------+--------+--------+
Parameters:
Return type:

RTRALTOption

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_opt_qs(schema, *, options)[source]

Read IPv4 Quick Start (QS) option.

Structure of IPv4 Quick Start (QS) option [RFC 4782]:

  • A Quick-Start Request

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Option      |  Length=8     | Func. | Rate  |   QS TTL      |
    |               |               | 0000  |Request|               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        QS Nonce                           | R |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    
  • Report of Approved Rate

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Option      |  Length=8     | Func. | Rate  |   Not Used    |
    |               |               | 1000  | Report|               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        QS Nonce                           | R |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    
Parameters:
Return type:

QSOption

Returns:

Parsed option data.

Raises:

ProtocolError – If the option is malformed.

Note

An option whose QS function is neither of the two above has no defined layout, so the schema keeps it as an unassigned option and it is parsed as one, c.f. _read_opt_unassigned().

_make_ipv4_options(options, padding=None)[source]

Make options for IPv4.

A list is a fresh option list, so any NOP and EOOL in it are dropped and the padding is generated. A container is what read() hands back, so its NOP and EOOL options are written in place, as parsed.

Either way, the options are concatenated and then padded once, after the last one, to the 32-bit boundary: with NOP options and a closing EOOL, or with zero octets if an EOOL has already ended the list. padding goes after that EOOL verbatim, before any alignment; it is dropped if no EOOL ends the list, since the reader would take its octets for options.

Parameters:
Return type:

tuple[list[Option | bytes], int]

Returns:

Tuple of options and total length of options.

_make_opt_unassigned(kind, option=None, *, data=b'', **kwargs)[source]

Make IPv4 unassigned options.

Parameters:
  • kind (OptionNumber) – option type code

  • option (UnassignedOption | None) – option data

  • data (bytes) – option payload, i.e. the octets after the length octet

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

Option

Returns:

Constructed option schema.

_make_opt_eool(kind, option=None, **kwargs)[source]

Make IPv4 End of Option List (EOOL) option.

Parameters:
Return type:

EOOLOption

Returns:

Constructed option schema.

_make_opt_nop(kind, option=None, **kwargs)[source]

Make IPv4 No Operation (NOP) option.

Parameters:
Return type:

NOPOption

Returns:

Constructed option schema.

_make_opt_sec(kind, option=None, *, level=<ClassificationLevel.Unclassified: 171>, level_default=None, level_namespace=None, level_reversed=False, authorities=None, **kwargs)[source]

Make IPv4 Security (SEC) option.

Parameters:
Return type:

SECOption

Returns:

Constructed option schema.

Raises:

ProtocolError – If authorities names a bit position that is not a protection authority – a negative one, or one that RFC 1108 reserves as a field termination indicator.

Notes

RFC 1108 Section 2.4 lays each protection authority octet out as seven authority bits followed by a field termination indicator in the low-order bit: 1 means another octet follows, 0 means this is the last. So the authority numbering skips every position that is a termination bit – 7, 15, 23 – which is what _read_opt_sec() encodes by looping over range(7) per octet, and the reason Field_Termination_Indicator is rejected here rather than written: the enumeration names it as structure, and a value written there would be dropped on the way back in. See #537.

The indicators themselves are set from position, except that a parsed option whose termination covers every octet written gets back the bits it carried, so that a non-conforming indicator rebuilds as read.

_make_opt_lsr(kind, option=None, *, counts=10, route=None, remaining=None, **kwargs)[source]

Make IPv4 Loose Source and Record Route (LSR) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (LSROption | None) – option data

  • counts (int) – maximum number of addresses to record

  • route (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses as recorded routes, i.e. the address slots before the pointer

  • remaining (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses for the address slots at or beyond the pointer; the slots left over up to counts are zero

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

LSROption

Returns:

Constructed option schema.

_make_opt_ts(kind, option=None, *, counts=5, overflow=0, timestamp=None, remaining=None, **kwargs)[source]

Make IPv4 Timestamp (TS) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (TSOption | None) – option data

  • counts (int) – maximum number of timestamps to record

  • overflow (int) – overflow count, i.e. the number of modules that could not register a timestamp (RFC 791 Section 3.1)

  • timestamp (list[int | timedelta] | dict[IPv4Address | str | int, int | timedelta] | None) – list of timestamps, i.e. the slots before the pointer, or a mapping of the addresses to their timestamps; an address may be anything parse_ip_address() accepts for IPv4

  • remaining (list[int] | None) – raw 32-bit words for the slots at or beyond the pointer; the slots left over up to counts are zero

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

TSOption

Returns:

Constructed option schema.

Raises:

FieldValueError – If an address is a bool or is not a valid IPv4 address.

_make_opt_e_sec(kind, option=None, *, format=0, info=None, **kwargs)[source]

Make IPv4 Extended Security (E-SEC) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (ESECOption | None) – option data

  • format (int) – additional security information format code

  • info (bytes | None) – additional security information

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

ESECOption

Returns:

Constructed option schema.

_make_opt_rr(kind, option=None, *, counts=10, route=None, remaining=None, **kwargs)[source]

Make IPv4 Record Route (RR) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (RROption | None) – option data

  • counts (int) – maximum number of addresses to record

  • route (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses as recorded routes, i.e. the address slots before the pointer

  • remaining (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses for the address slots at or beyond the pointer; the slots left over up to counts are zero

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

RROption

Returns:

Constructed option schema.

_make_opt_sid(kind, option=None, *, sid=0, **kwargs)[source]

Make IPv4 Stream ID (SID) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (SIDOption | None) – option data

  • sid (int) – stream ID

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

SIDOption

Returns:

Constructed option schema.

_make_opt_ssr(kind, option=None, *, counts=10, route=None, remaining=None, **kwargs)[source]

Make IPv4 Strict Source Route (SSR) option.

Parameters:
  • kind (OptionNumber) – option type code

  • option (SSROption | None) – option data

  • counts (int) – maximum number of addresses to record

  • route (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses as recorded routes, i.e. the address slots before the pointer

  • remaining (list[IPv4Address | str | bytes | int] | None) – list of IPv4 addresses for the address slots at or beyond the pointer; the slots left over up to counts are zero

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

SSROption

Returns:

Constructed option schema.

_make_opt_mtup(kind, option=None, *, mtu=0, **kwargs)[source]

Make IPv4 MTU Probe (MTUP) option.

Parameters:
Return type:

MTUPOption

Returns:

Constructed option schema.

_make_opt_mtur(kind, option=None, *, mtu=0, **kwargs)[source]

Make IPv4 MTU Reply (MTUR) option.

Parameters:
Return type:

MTUROption

Returns:

Constructed option schema.

_make_opt_tr(kind, option=None, *, id=0, out=0, ret=0, origin='127.0.0.1', **kwargs)[source]

Make IPv4 Traceroute (TR) option.

Parameters:
Return type:

TROption

Returns:

Constructed option schema.

_make_opt_rtralt(kind, option=None, *, alert=<RouterAlert.Aggregated_Reservation_Nesting_Level_0: 1>, alert_default=None, alert_namespace=None, alert_reversed=False, **kwargs)[source]

Make IPv4 Router Alert (RTRALT) option.

Parameters:
Return type:

RTRALTOption

Returns:

Constructed option schema.

_make_opt_qs(kind, option=None, *, func=<QSFunction.Quick_Start_Request: 0>, func_default=None, func_namespace=None, func_reversed=False, rate=0, ttl=0, unused=0, nonce=0, reserved=0, **kwargs)[source]

Make IPv4 Quick-Start (QS) option.

Parameters:
Return type:

QSOption | UnassignedOption

Returns:

Constructed option schema. An unassigned option schema if option is a Quick-Start option parsed as unassigned, c.f. _read_opt_qs(), or if func is neither of the assigned functions, in which case the option takes the eight-octet layout of a Quick-Start Request.

Raises:

ProtocolError – If func does not fit in four bits.

__option__: DefaultDict[OptionNumber | int, str | tuple[Callable[[Option, OrderedMultiDict[OptionNumber, Option]], Option], Callable[[OptionNumber, Option | None, Any], Option]]]

DefaultDict[Enum_OptionNumber, str | tuple[OptionParser, OptionConstructor]]: Option code to method mapping, c.f. _read_ipv4_options() and/or _make_ipv4_options(). A str value names the methods _read_opt_${name} and _make_opt_${name}, falling back to _read_opt_unassigned / _make_opt_unassigned when they do not exist; any other value is a (parser, constructor) pair of callables.

classmethod __index__()[source]

Numeral registry index of the protocol.

Return type:

TransType

Returns:

Numeral registry index of the protocol in IANA.

Header Schemas

pcapkit.protocols.schema.internet.ipv4.IPV4_HEADER_LEN = 20

Length of the fixed IPv4 header, i.e. with no options, RFC 791 Section 3.1. The one home of this value (#1739), here so that the schema’s option length and the protocol modules read the same one; it is fixed by the RFC, so it is never configurable.

Added in version 1.5.0.

class pcapkit.protocols.schema.internet.ipv4.IPv4(*args: _VT, **kwargs: _VT)[source]

Bases: Schema

Header schema for IPv4 packet.

vihl: VerIHLField = <BitField vihl>

Version and header length.

tos: ToSField = <BitField tos>

Type of service.

length: int = <UInt16Field length>

Total length.

id: int = <UInt16Field id>

Identification.

flags: Flags = <BitField flags>

Flags and fragment offset.

ttl: int = <UInt8Field ttl>

Time to live.

proto: TransType = <EnumField proto>

Protocol.

chksum: bytes = <BytesField chksum>

Header checksum.

src: IPv4Address = <IPv4AddressField src>

Source address.

dst: IPv4Address = <IPv4AddressField dst>

Destination address.

options: list[Option] = <OptionField options>

Options.

padding: bytes = <PaddingField padding>

Padding.

payload: bytes = <PayloadField payload>

Payload. A Total Length of 0, as TCP segmentation offload leaves it in a capture taken on the sending host, takes the rest of the data and leaves no trailer; any other Total Length shorter than the header leaves the payload empty and the rest to the trailer (#1547).

trailer: bytes = <PayloadField trailer>

Octets captured past the Total Length, such as Ethernet minimum-frame padding. A PayloadField with no length takes whatever the payload leaves on unpack and writes its value verbatim on pack, so the octets survive whatever they hold.

class pcapkit.protocols.schema.internet.ipv4.Option(dict_=None, **kwargs)[source]

Bases: EnumSchema[OptionNumber]

Header schema for IPv4 options.

type: OptionNumber = <EnumField type>

Option type.

length: int = <ConditionalField length>

Option length.

post_process(packet)[source]

Revise schema data after unpacking process.

Parameters:

packet (dict[str, Any]) – Unpacked data.

Return type:

Schema

Returns:

Revised schema.

class pcapkit.protocols.schema.internet.ipv4.UnassignedOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 unassigned options.

data: bytes = <BytesField data>

Option data.

class pcapkit.protocols.schema.internet.ipv4.EOOLOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 end of option list (EOOL) option.

class pcapkit.protocols.schema.internet.ipv4.NOPOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 no operation (NOP) option.

class pcapkit.protocols.schema.internet.ipv4.SECOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 security (SEC) option.

level: ClassificationLevel = <EnumField level>

Classification level.

data: bytes = <ConditionalField data>

Protection authority flags.

class pcapkit.protocols.schema.internet.ipv4.LSROption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 loose source route (LSR) option.

pointer: int = <UInt8Field pointer>

Pointer.

route: list[IPv4Address] = <ListField route>

every address slot of the option, those before the pointer and those at or beyond it alike.

Type:

Route

remainder: bytes = <PaddingField remainder>

Trailing octets that do not make up a whole address slot.

class pcapkit.protocols.schema.internet.ipv4.TSOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 timestamp (TS) option.

pointer: int = <UInt8Field pointer>

Pointer.

flags: TSFlags = <BitField flags>

Overflow and flags.

ts_data: list[int] = <ListField ts_data>

every 32-bit slot of the option, those before the pointer and those at or beyond it alike.

Type:

Timestamps and internet addresses

remainder: bytes = <BytesField remainder>

Trailing octets that do not make up a whole 32-bit slot, kept as read rather than packed as zeros.

post_process(packet)[source]

Revise schema data after unpacking process.

Parameters:

packet (dict[str, Any]) – Unpacked data.

Return type:

Schema

Returns:

Revised schema.

Raises:

FieldValueError – If an entry of ts_data that the timestamp flag makes an address is a bool, is not a valid IP address, or is not IPv4 – c.f. parse_ip_address().

Notes

This runs on the packing path as well as the unpacking one – Schema.pack calls it once the buffer is filled – so the ts_data entries it converts below are whatever the caller passed to the constructor, not octets read off the wire. That is why those conversions go through parse_ip_address() rather than ipaddress.ip_address(): this schema is reachable from public IPv4.make, which accepts a caller-built option schema and packs it, and ts_data’s UInt32Field item type takes a bool as the int it is a subclass of, so nothing downstream can question it: ts_data=[True, 5] would otherwise pack as 0000000100000005 and report IPv4Address('0.0.0.1') with no exception and no warning.

class pcapkit.protocols.schema.internet.ipv4.ESECOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 extended security (ESEC) option.

format: int = <UInt8Field format>

Additional security information format code.

info: bytes = <ConditionalField info>

Additional security information.

class pcapkit.protocols.schema.internet.ipv4.RROption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 record route (RR) option.

pointer: int = <UInt8Field pointer>

Pointer.

route: list[IPv4Address] = <ListField route>

every address slot of the option, those before the pointer and those at or beyond it alike.

Type:

Route

remainder: bytes = <PaddingField remainder>

Trailing octets that do not make up a whole address slot.

class pcapkit.protocols.schema.internet.ipv4.SIDOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 stream identifier (SID) option.

sid: int = <UInt16Field sid>

Stream identifier. Two octets, per RFC 791 section 3.1, which gives the option as four octets in total: one of type, one of length, and a 16-bit stream identifier.

class pcapkit.protocols.schema.internet.ipv4.SSROption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 strict source route (SSR) option.

pointer: int = <UInt8Field pointer>

Pointer.

route: list[IPv4Address] = <ListField route>

every address slot of the option, those before the pointer and those at or beyond it alike.

Type:

Route

remainder: bytes = <PaddingField remainder>

Trailing octets that do not make up a whole address slot.

class pcapkit.protocols.schema.internet.ipv4.MTUPOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 MTU probe (MTUP) option.

mtu: int = <UInt16Field mtu>

MTU.

class pcapkit.protocols.schema.internet.ipv4.MTUROption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 MTU reply (MTUR) option.

mtu: int = <UInt16Field mtu>

MTU.

class pcapkit.protocols.schema.internet.ipv4.TROption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 traceroute (TR) option.

id: int = <UInt16Field id>

ID number.

out: int = <UInt16Field out>

Outbound hop count.

ret: int = <UInt16Field ret>

Return hop count.

origin: IPv4Address = <IPv4AddressField origin>

Originator IP address.

class pcapkit.protocols.schema.internet.ipv4.RTRALTOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for IPv4 router alert (RTRALT) option.

alert: RouterAlert = <EnumField alert>

Router alert value.

class pcapkit.protocols.schema.internet.ipv4._QSOption(*args: _VT, **kwargs: _VT)[source]

Bases: Schema

Header schema for IPv4 quick start (QS) options in generic representation.

flags: QSTestFlags = <ForwardMatchField flags>

Flags.

data: QuickStartRequestOption | QuickStartReportOption = <SwitchField data>

QS data.

post_process(packet)[source]

Revise schema data after unpacking process.

Parameters:

packet (dict[str, Any]) – Unpacked data.

Return type:

QSOption | UnassignedOption

Returns:

Revised schema.

class pcapkit.protocols.schema.internet.ipv4.QSOption(dict_=None, **kwargs)[source]

Bases: Option, EnumSchema[QSFunction]

Header schema for IPv4 quick start (QS) options.

flags: QuickStartFlags = <BitField flags>

Flags.

class pcapkit.protocols.schema.internet.ipv4.QuickStartRequestOption(*args: _VT, **kwargs: _VT)[source]

Bases: QSOption

Header schema for IPv4 quick start request options.

ttl: int = <UInt8Field ttl>

QS time-to-live (TTL).

nonce: QSNonce = <BitField nonce>

QS nonce.

class pcapkit.protocols.schema.internet.ipv4.QuickStartReportOption(*args: _VT, **kwargs: _VT)[source]

Bases: QSOption

Header schema for IPv4 quick start report of approved rate options.

reserved: int = <UInt8Field reserved>

Not used. One octet, holding the place a Quick-Start Request fills with QS TTL: RFC 4782 Section 3.1 says in as many words that “for a Report of Approved Rate, the fourth byte of the Quick-Start Option is not used”, and that “bytes 5-8 contain a 30-bit QS Nonce and a 2-bit Reserved field” – so the nonce begins at the fifth octet for both functions, and figure 4 gives this option as Length=8 like figure 3 gives its sibling. Without this field the schema would be seven octets wide against the eight _make_opt_qs() writes into length and the eight _read_opt_qs() demands of it, and the nonce would decode one octet early. Kept as an integer rather than as padding, so that whatever the sender put there is written back.

nonce: QSNonce = <BitField nonce>

QS nonce.

Type Stubs

class pcapkit.protocols.schema.internet.ipv4.VerIHLField[source]

Bases: TypedDict

Version and header length field.

version: int

IP version.

ihl: int

Internet header length.

class pcapkit.protocols.schema.internet.ipv4.ToSField

Bases: TypedDict

Type of service field.

class pcapkit.protocols.schema.internet.ipv4.Flags[source]

Bases: TypedDict

Flags and fragment offset field.

reserved: int

Reserved flag bit.

df: int

Don’t fragment flag.

mf: int

More fragments flag.

offset: int

Fragment offset.

class pcapkit.protocols.schema.internet.ipv4.TSFlags[source]

Bases: TypedDict

Timestamp flags field.

oflw: int

Timestamp overflow flag.

flag: int

Timestamp type flag.

class pcapkit.protocols.schema.internet.ipv4.QuickStartFlags[source]

Bases: TypedDict

Quick-Start flags.

func: int

QS function.

rate: int

Rate request/report.

class pcapkit.protocols.schema.internet.ipv4.QSTestFlags[source]

Bases: TypedDict

Quick start test flag.

length: int

Option length.

func: int

QS function.

class pcapkit.protocols.schema.internet.ipv4.QSNonce[source]

Bases: TypedDict

Quick start nonce field.

nonce: int

Nonce.

reserved: int

Reserved bits.

Auxiliary Functions

pcapkit.protocols.schema.internet.ipv4.quick_start_option_length(schema)[source]

On-the-wire length, in octets, of a resolved Quick-Start (QS) suboption.

The Quick-Start suboption schemas carry the option’s own type and length octets – they inherit them from Option – so what quick_start_data_selector() has to hand the nested SchemaField is the length of the whole option, not of the data after its header. Per RFC 4782 Section 3.1 – figure 3 for a Quick-Start Request and figure 4 for a Report of Approved Rate – that is eight octets for both functions, which differ in what the fourth octet holds rather than in how many there are: “The second byte contains the length field, indicating an option length of eight bytes”, and “For a Report of Approved Rate, the fourth byte of the Quick-Start Option is not used”. And _read_opt_qs() rejects any other value in the length field outright.

It is summed from the resolved schema’s own fields rather than written as that literal, because the registry is open – QSOption is an EnumSchema, so a caller may register a further function code with a schema of its own width – and a number written here would have to be kept in step by hand with every field the suboptions declare.

Parameters:

schema (Type[QSOption]) – Quick-Start suboption schema, as resolved from the func sub-field by quick_start_data_selector().

Return type:

int

Returns:

Length, in octets, that schema occupies on the wire.

Raises:

FieldValueError – If schema declares a field whose width is not fixed. Every field of a Quick-Start suboption is fixed-width, because the option is, and a variable-width one cannot be summed here without a packet to size it against – which is the one thing a selector does not have for the schema it is about to return. It fails rather than guessing a width.

pcapkit.protocols.schema.internet.ipv4.quick_start_data_selector(pkt)[source]

Selector function for _QSOption.data field.

Parameters:

pkt (dict[str, Any]) – Packet data.

Return type:

FieldBase

Returns:

Notes

The length handed to the SchemaField comes from quick_start_option_length(), i.e. from the suboption that was just resolved, rather than from a fixed literal: a wrong width mis-sizes the nested read, so the nonce decodes wrongly and the leftover octets are read as a further, fabricated option.

Data Models

class pcapkit.protocols.data.internet.ipv4.IPv4(*args: VT, **kwargs: VT)[source]

Bases: Protocol

Data model for IPv4 packet.

version: Literal[4]

Version.

hdr_len: int

Internet header length.

tos: ToSField

Type of services.

len: int

Total length.

id: int

Identification.

flags: Flags

Flags.

offset: int

Fragment offset.

ttl: timedelta

Time to live.

protocol: TransType

Protocol.

checksum: bytes

Header checksum.

src: IPv4Address

Source address.

dst: IPv4Address

Destination address.

options: OrderedMultiInfo[OptionNumber, Option]

Options, present only when the header carries any.

padding: bytes

Octets after the End of Option List, present along with options.

trailer: bytes

Octets captured past the Total Length, present only when there are any.

class pcapkit.protocols.data.internet.ipv4.ToSField(*args: Any, **kwargs: Any)[source]

Bases: Data

Data model for IPv4 ToS fields.

Important

Due to the reserved keyword conflict, please use from_dict() to create an instance of this data model.

del: pcapkit.const.ipv4.tos_del.ToSDelay

Delay.

Note

This field is conflict with del keyword. To access this field, directly use getattr() instead.

pre: ToSPrecedence

Precedence.

thr: ToSThroughput

Throughput.

rel: ToSReliability

Reliability.

ecn: ToSECN

Explicit congestion notification (ECN).

class pcapkit.protocols.data.internet.ipv4.Flags(*args: VT, **kwargs: VT)[source]

Bases: Data

Data model for IPv4 Flags.

Changed in version 1.5.0: New required field reserved (#1326).

reserved: int

Reserved flag bit.

df: bool

Don’t fragment.

mf: bool

More fragments.

class pcapkit.protocols.data.internet.ipv4.Option(dict_=None, **kwargs)[source]

Bases: Data

Data model for IPv4 options.

code: OptionNumber

Option code.

length: int

Option length.

type: OptionType

Option type.

class pcapkit.protocols.data.internet.ipv4.OptionType(*args: Any, **kwargs: Any)[source]

Bases: Data

Data model for IPv4 option type data.

class: pcapkit.const.ipv4.option_class.OptionClass

Option class.

Note

This field is conflict with class keyword. To access this field, directly use getattr() instead.

change: bool

Change flag.

number: int

Number.

class pcapkit.protocols.data.internet.ipv4.UnassignedOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 unassigned option.

data: bytes

Option data.

class pcapkit.protocols.data.internet.ipv4.EOOLOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 End of Option List (EOOL) option.

class pcapkit.protocols.data.internet.ipv4.NOPOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 No Operation (NOP) option.

class pcapkit.protocols.data.internet.ipv4.SECOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Security (SEC) option.

Changed in version 1.5.0: New required field termination (#1393).

level: ClassificationLevel

Classification level.

flags: tuple[ProtectionAuthority, ...]

Protection authority flags.

termination: tuple[bool, ...]

Field termination indicator of each protection authority octet, as on the wire.

class pcapkit.protocols.data.internet.ipv4.LSROption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Loose Source Route (LSR) option.

Changed in version 1.5.0: New required field remaining (#1319).

pointer: int

Pointer.

route: tuple[IPv4Address, ...]

Route, i.e. the address slots before the pointer.

remaining: tuple[IPv4Address, ...]

Address slots at or beyond the pointer.

class pcapkit.protocols.data.internet.ipv4.TSOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Time Stamp (TS) option.

Changed in version 1.5.0: New required fields remaining and remainder (#1349, #1392).

pointer: int

Pointer.

overflow: int

Overflow.

flag: TSFlag

Flag.

timestamp: tuple[timedelta | int, ...] | OrderedMultiInfo[IPv4Address, timedelta | int]

Timestamp data, i.e. the slots before the pointer.

remaining: tuple[int, ...]

Slots at or beyond the pointer, as raw 32-bit words.

remainder: bytes

Trailing octets that do not make up a whole 32-bit slot.

class pcapkit.protocols.data.internet.ipv4.ESECOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Extended Security (ESEC) option.

format: int

Additional security information format code.

info: bytes

Additional security information.

class pcapkit.protocols.data.internet.ipv4.RROption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Record Route (RR) option.

Changed in version 1.5.0: New required field remaining (#1319).

pointer: int

Pointer.

route: tuple[IPv4Address, ...] | None

Route, i.e. the address slots before the pointer.

remaining: tuple[IPv4Address, ...]

Address slots at or beyond the pointer.

class pcapkit.protocols.data.internet.ipv4.SIDOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Stream ID (SID) option.

sid: int

Stream ID.

class pcapkit.protocols.data.internet.ipv4.SSROption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Strict Source Route (SSR) option.

Changed in version 1.5.0: New required field remaining (#1319).

pointer: int

Pointer.

route: tuple[IPv4Address, ...] | None

Route, i.e. the address slots before the pointer.

remaining: tuple[IPv4Address, ...]

Address slots at or beyond the pointer.

class pcapkit.protocols.data.internet.ipv4.MTUPOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 MTU Probe (MTUP) option.

mtu: int

MTU.

class pcapkit.protocols.data.internet.ipv4.MTUROption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 MTU Reply (MTUR) option.

mtu: int

MTU.

class pcapkit.protocols.data.internet.ipv4.TROption(*args: Any, **kwargs: Any)[source]

Bases: Option

Data model for IPv4 Traceroute (TR) option.

Important

Due to the reserved keyword conflict, please use from_dict() to create an instance of this data model.

return: int

Return hop count.

Note

This field is conflict with return keyword. To access this field, directly use getattr() instead.

id: int

ID number.

outbound: int

Outbound hop count.

originator: IPv4Address

Originator IP address.

class pcapkit.protocols.data.internet.ipv4.RTRALTOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for IPv4 Router Alert (RTRALT) option.

alert: RouterAlert

Router alert.

class pcapkit.protocols.data.internet.ipv4.QSOption(dict_=None, **kwargs)[source]

Bases: Option

Data model for IPv4 Quick Start (QS) option.

func: QSFunction

QS function.

rate: int

Rate request/report.

class pcapkit.protocols.data.internet.ipv4.QuickStartRequestOption(*args: VT, **kwargs: VT)[source]

Bases: QSOption

Data model for IPv4 Quick Start request option.

Changed in version 1.5.0: New required field reserved (#1326).

ttl: timedelta

TTL.

nonce: int

Nonce.

reserved: int

Reserved bits after the nonce.

class pcapkit.protocols.data.internet.ipv4.QuickStartReportOption(*args: VT, **kwargs: VT)[source]

Bases: QSOption

Data model for IPv4 Quick Start report of approved rate option.

Changed in version 1.5.0: New required fields unused and reserved (#1326).

unused: int

Not-used octet, where a request carries its TTL.

nonce: int

Nonce.

reserved: int

Reserved bits after the nonce.

Footnotes