PCAP-NG File Format¶
pcapkit.protocols.misc.pcapng contains
PCAPNG only,
which implements extractor for PCAP-NG file format [*].
- class pcapkit.protocols.misc.pcapng.PCAPNG(file=None, length=None, **kwargs)[source]¶
Bases:
ProtocolBase[PCAPNG,PCAPNG]PCAP-NG file block extractor.
The class currently supports parsing of the following protocols, which are registered in the
self.__proto__attribute:Index
Protocol
The class currently supports parsing of the following block types, which are registered in the
self.__block__attribute:Block Type
Block Parser
Block Constructor
The class currently supports parsing of the following option types, which are registered in the
self.__option__attribute:Option Type
Option Parser
Option Constructor
The class currently supports parsing of the following systemd(1) journal export record types, which are registered in the
self.__record__attribute:Record Type
Record Parser
Record Constructor
The class currently supports parsing of the following decryption secrets types, which are registered in the
self.__secrets__attribute:Secrets Type
Secrets Parser
Secrets Constructor
- property length: int¶
Block total length of corresponding protocol.
Note
This is the wire’s Block Total Length – the whole block, trailing length field included – and not a header length. The two are the same thing for a protocol whose payload runs to the end of its buffer, which is why
ProtocolBase.lengthdoes not distinguish them, but a PCAP-NG block carries a trailer.self.packetis overridden accordingly; see there and #646.
- property ts_timezone: timezone¶
Timezone of the current block.
Defaults to UTC when the capture names no
if_tzone, for the reason given inself._get_timezone.
- property linktype: LinkType¶
Data link layer protocol type.
- Raises:
UnsupportedCall – If current block is not a valid packet block, i.e., EPB, ISB or obsolete Packet Block.
- classmethod register(code, protocol)[source]¶
Register a new protocol class.
Notes
The full qualified class name of the new protocol class should be as
{protocol.module}.{protocol.name}.- Parameters:
protocol (
ModuleDescriptor[ProtocolBase] |Type[ProtocolBase]) – module descriptor or aProtocolsubclass
- Raises:
pcapkit.utilities.exceptions.RegistryError – If
protocolis not aProtocolsubclass.- Warns:
pcapkit.utilities.warnings.RegistryWarning – If this link type is already registered against PCAP-NG blocks, naming the displaced entry and its replacement so a caller can tell what was lost. Fires only when the incumbent differs from the replacement, so re-registering the same class is a silent no-op. Note this registry is separate from the PCAP one, so
register_linktype()writing to both cannot make either warn about the other.
- classmethod register_option(code, meth)[source]¶
Register a option parser.
- Parameters:
code (
OptionType) – PCAP-NG option type code.meth (
str|tuple[Callable[[Option,OrderedMultiDict[OptionType,Option]],Option],Callable[[OptionType,Option|None,Any],Option]]) – Method name or callable to parse and/or construct the option.
- classmethod register_record(code, meth)[source]¶
Register a systemd(1) journal export record parser.
- Parameters:
code (
RecordType) – PCAP-NG systemd(1) journal export record type code.meth (
str|tuple[Callable[[NameResolutionRecord,OrderedMultiDict[RecordType,NameResolutionRecord]],NameResolutionRecord],Callable[[RecordType,NameResolutionRecord|None,Any],NameResolutionRecord]]) – Method name or callable to parse and/or construct the systemd(1) journal export record.
- classmethod register_secrets(code, meth)[source]¶
Register a decryption secrets parser.
- Parameters:
code (
SecretsType) – PCAP-NG decryption secrets type code.meth (
str|tuple[Callable[[DSBSecrets,DecryptionSecretsBlock],DSBSecrets],Callable[[SecretsType,DSBSecrets|None,Any],DSBSecrets]]) – Method name or callable to parse and/or construct the decryption secrets.
- unpack(length=None, **kwargs)[source]¶
Unpack (parse) packet data.
- Parameters:
- Return type:
- Returns:
Parsed packet data.
Notes
We used a special keyword argument
__packet__to pass the global packet data to underlying methods. This is useful when the packet data is not available in the current instance.
- pack(**kwargs)[source]¶
Pack (construct) packet data.
- Parameters:
**kwargs (
Any) – Arbitrary keyword arguments.- Return type:
- Returns:
Constructed packet data.
Notes
We used a special keyword argument
__packet__to pass the global packet data to underlying methods. This is useful when the packet data is not available in the current instance.
- read(length=None, *, _read=True, _seek_set=0, **kwargs)[source]¶
Read PCAP-NG file blocks.
Structure of PCAP-NG file blocks:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 / Block Body / / variable length, padded to 32 bits / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- make(type=<BlockType.Simple_Packet_Block: 3>, type_default=None, type_namespace=None, type_reversed=False, block=b'', **kwargs)[source]¶
Make PCAP-NG block data.
- Parameters:
type (
BlockType|IntEnum|IntEnum|str|int) – Block type.type_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Block type namespace.type_reversed (
bool) – Whether to reverse block type namespace.block (
bytes|PCAPNG|BlockType|dict[str,Any]) – Block data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed packet data.
- index(name)[source]¶
Call
ProtoChain.index.- Parameters:
name (
str|ProtocolBase|Type[ProtocolBase]) –nameto be searched- Return type:
- Returns:
First index of
name.- Raises:
IndexNotFound – if
nameis not present
- _decode_next_layer(dict_, proto=None, length=None, *, packet=None)[source]¶
Decode next layer protocol.
- Parameters:
- Return type:
- Returns:
Current protocol with packet extracted.
Notes
We added a new key
__next_type__todict_to store the next layer protocol type, and a new key__next_name__to store the next layer protocol name. These two keys will NOT be included whenInfo.to_dictis called.We also added a new key
protocolstodict_to store the protocol chain of the current packet (frame).
- _get_payload()[source]¶
Get payload of
self.__header__.- Return type:
- Returns:
Payload of
self.__header__asbytes.
See also
This is a wrapper function for
pcapkit.protocols.schema.Schema.get_payload().
- _read_block_unknown(schema, *, header)[source]¶
Read unknown PCAP-NG block.
- Parameters:
schema (
UnknownBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_shb(schema, *, header)[source]¶
Read PCAP-NG section header block (SHB).
Structure of Section Header Block:
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x0A0D0D0A | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Byte-Order Magic | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Major Version | Minor Version | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | | | Section Length | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 24 / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- Parameters:
schema (
SectionHeaderBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_idb(schema, *, header)[source]¶
Read PCAP-NG interface description block (IDB).
Structure of Interface Description Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000001 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | LinkType | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | SnapLen | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
InterfaceDescriptionBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_epb(schema, *, header)[source]¶
Read PCAP-NG enhanced packet block (EPB).
Structure of Enhanced Packet Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000006 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Interface ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Timestamp (High) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | Timestamp (Low) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 20 | Captured Packet Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 24 | Original Packet Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 28 / / / Packet Data / / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
EnhancedPacketBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_spb(schema, *, header)[source]¶
Read PCAP-NG simple packet block (SPB).
Structure of Simple Packet Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000003 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Original Packet Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 / / / Packet Data / / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
SimplePacketBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_nrb(schema, *, header)[source]¶
Read PCAP-NG name resolution block (NRB).
Structure of Name Resolution Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000004 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Record Type | Record Value Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 / Record Value / / variable length, padded to 32 bits / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . . . other records . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Record Type = nrb_record_end | Record Value Length = 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
NameResolutionBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_isb(schema, *, header)[source]¶
Read PCAP-NG interface statistics block (ISB).
Structure of Interface Statistics Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000005 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Interface ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Timestamp (High) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | Timestamp (Low) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 20 / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
InterfaceStatisticsBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_systemd(schema, *, header)[source]¶
Read PCAP-NG systemd(1) journal export block.
Structure of systemd(1) Journal Export Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000009 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 / / / Journal Entry / / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- Parameters:
schema (
SystemdJournalExportBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_dsb(schema, *, header)[source]¶
Read PCAP-NG decryption secrets block (DSB).
Structure of Decryption Secrets Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x0000000A | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Secrets Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Secrets Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 / / / Secrets Data / / (variable length, padded to 32 bits) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Block Total Length / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
DecryptionSecretsBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_cb(schema, *, header)[source]¶
Read PCAP-NG custom block (CB).
Structure of Custom Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000BAD or 0x40000BAD | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Private Enterprise Number (PEN) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 / / / Custom Data / / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
CustomBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_block_packet(schema, *, header)[source]¶
Read PCAP-NG packet block (obsolete).
Structure of Packet Block:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 | Block Type = 0x00000002 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Interface ID | Drops Count | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Timestamp (High) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | Timestamp (Low) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 20 | Captured Packet Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 24 | Original Packet Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 28 / / / Packet Data / / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Parameters:
schema (
PacketBlock) – Parsed block schema.header (
PCAPNG) – Parsed PCAP-NG header schema.
- Return type:
- Returns:
Parsed packet data.
- _read_pcapng_options(options_schema)[source]¶
Read PCAP-NG options.
Structure of PCAP-NG option:
1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option Code | Option Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Option Value / / variable length, padded to 32 bits / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / / / . . . other options . . . / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option Code == opt_endofopt | Option Length == 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- Parameters:
- Return type:
- Returns:
Parsed PCAP-NG options data.
- _read_option_unknown(schema, *, options)[source]¶
Read unknown PCAP-NG option.
- Parameters:
schema (
UnknownOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_endofopt(schema, *, options)[source]¶
Read PCAP-NG
opt_endofoptoption.- Parameters:
schema (
EndOfOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_comment(schema, *, options)[source]¶
Read PCAP-NG
opt_commentoption.- Parameters:
schema (
CommentOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_custom(schema, *, options)[source]¶
Read PCAP-NG
opt_customoption.Structure of PCAP-NG
opt_customoption:1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Custom Option Code | Option Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Private Enterprise Number (PEN) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Custom Data / / variable length, padded to 32 bits / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- Parameters:
schema (
CustomOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_name(schema, *, options)[source]¶
Read PCAP-NG
if_nameoption.- Parameters:
schema (
IF_NameOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_description(schema, *, options)[source]¶
Read PCAP-NG
if_descriptionoption.- Parameters:
schema (
IF_DescriptionOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_ipv4(schema, *, options)[source]¶
Read PCAP-NG
if_IPv4addroption.- Parameters:
schema (
IF_IPv4AddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_ipv6(schema, *, options)[source]¶
Read PCAP-NG
if_IPv6addroption.- Parameters:
schema (
IF_IPv6AddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_mac(schema, *, options)[source]¶
Read PCAP-NG
if_MACaddroption.- Parameters:
schema (
IF_MACAddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_eui(schema, *, options)[source]¶
Read PCAP-NG
if_EUIaddroption.- Parameters:
schema (
IF_EUIAddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_speed(schema, *, options)[source]¶
Read PCAP-NG
if_speedoption.- Parameters:
schema (
IF_SpeedOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_tsresol(schema, *, options)[source]¶
Read PCAP-NG
if_tsresoloption.- Parameters:
schema (
IF_TSResolOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_tzone(schema, *, options)[source]¶
Read PCAP-NG
if_tzoneoption.- Parameters:
schema (
IF_TZoneOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_filter(schema, *, options)[source]¶
Read PCAP-NG
if_filteroption.- Parameters:
schema (
IF_FilterOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_os(schema, *, options)[source]¶
Read PCAP-NG
if_osoption.- Parameters:
schema (
IF_OSOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_fcslen(schema, *, options)[source]¶
Read PCAP-NG
if_fcslenoption.- Parameters:
schema (
IF_FCSLenOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_tsoffset(schema, *, options)[source]¶
Read PCAP-NG
if_tsoffsetoption.- Parameters:
schema (
IF_TSOffsetOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_hardware(schema, *, options)[source]¶
Read PCAP-NG
if_hardwareoption.- Parameters:
schema (
IF_HardwareOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_txspeed(schema, *, options)[source]¶
Read PCAP-NG
if_txspeedoption.- Parameters:
schema (
IF_TxSpeedOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_if_rxspeed(schema, *, options)[source]¶
Read PCAP-NG
if_rxspeedoption.- Parameters:
schema (
IF_RxSpeedOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_flags(schema, *, options)[source]¶
Read PCAP-NG
epb_flagsoption.- Parameters:
schema (
EPB_FlagsOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_hash(schema, *, options)[source]¶
Read PCAP-NG
epb_hashoption.- Parameters:
schema (
EPB_HashOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_dropcount(schema, *, options)[source]¶
Read PCAP-NG
epb_dropcountoption.- Parameters:
schema (
EPB_DropCountOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_packetid(schema, *, options)[source]¶
Read PCAP-NG
epb_packetidoption.- Parameters:
schema (
EPB_PacketIDOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_queue(schema, *, options)[source]¶
Read PCAP-NG
epb_queueoption.- Parameters:
schema (
EPB_QueueOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_epb_verdict(schema, *, options)[source]¶
Read PCAP-NG
epb_verdictoption.- Parameters:
schema (
EPB_VerdictOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_ns_dnsname(schema, *, options)[source]¶
Read PCAP-NG
ns_dnsnameoption.- Parameters:
schema (
NS_DNSNameOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_ns_dnsipv4(schema, *, options)[source]¶
Read PCAP-NG
ns_dnsIP4addroption.- Parameters:
schema (
NS_DNSIP4AddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_ns_dnsipv6(schema, *, options)[source]¶
Read PCAP-NG
ns_dnsIP6addroption.- Parameters:
schema (
NS_DNSIP6AddrOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_starttime(schema, *, options)[source]¶
Read PCAP-NG
isb_starttimeoption.- Parameters:
schema (
ISB_StartTimeOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_endtime(schema, *, options)[source]¶
Read PCAP-NG
isb_endtimeoption.- Parameters:
schema (
ISB_EndTimeOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_ifrecv(schema, *, options)[source]¶
Read PCAP-NG
isb_ifrecvoption.- Parameters:
schema (
ISB_IFRecvOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_ifdrop(schema, *, options)[source]¶
Read PCAP-NG
isb_ifdropoption.- Parameters:
schema (
ISB_IFDropOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_filteraccept(schema, *, options)[source]¶
Read PCAP-NG
isb_filteracceptoption.- Parameters:
schema (
ISB_FilterAcceptOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_osdrop(schema, *, options)[source]¶
Read PCAP-NG
isb_osdropoption.- Parameters:
schema (
ISB_OSDropOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_isb_usrdeliv(schema, *, options)[source]¶
Read PCAP-NG
isb_usrdelivoption.- Parameters:
schema (
ISB_UsrDelivOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_pack_flags(schema, *, options)[source]¶
Read PCAP-NG
pack_flagsoption.- Parameters:
schema (
PACK_FlagsOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_option_pack_hash(schema, *, options)[source]¶
Read PCAP-NG
pack_hashoption.- Parameters:
schema (
PACK_HashOption) – Parsed option schema.options (
OrderedMultiDict[OptionType,Option]) – Parsed PCAP-NG options.
- Return type:
- Returns:
Constructed option data.
- _read_nrb_records(records_schema)[source]¶
Read PCAP-NG systemd(1) journal export records.
- Parameters:
records_schema (
list[NameResolutionRecord]) – Parsed systemd(1) journal export records.- Return type:
- Returns:
Parsed PCAP-NG systemd(1) journal export records data.
- _read_record_unknown(schema, *, records)[source]¶
Read PCAP-MG unknown systemd(1) journal export records.
- Parameters:
schema (
UnknownRecord) – Parsed systemd(1) journal export record schema.records (
OrderedMultiDict[RecordType,NameResolutionRecord]) – Parsed PCAP-NG records.
- Return type:
- Returns:
Constructed systemd(1) journal export record data.
- _read_record_end(schema, *, records)[source]¶
Read PCAP-MG
nrb_record_endsystemd(1) journal export records.- Parameters:
schema (
EndRecord) – Parsed systemd(1) journal export record schema.records (
OrderedMultiDict[RecordType,NameResolutionRecord]) – Parsed PCAP-NG records.
- Return type:
- Returns:
Constructed systemd(1) journal export record data.
- _read_record_ipv4(schema, *, records)[source]¶
Read PCAP-MG
nrb_record_ipv4systemd(1) journal export records.- Parameters:
schema (
IPv4Record) – Parsed systemd(1) journal export record schema.records (
OrderedMultiDict[RecordType,NameResolutionRecord]) – Parsed PCAP-NG records.
- Return type:
- Returns:
Constructed systemd(1) journal export record data.
- _read_record_ipv6(schema, *, records)[source]¶
Read PCAP-MG
nrb_record_ipv6systemd(1) journal export records.- Parameters:
schema (
IPv6Record) – Parsed systemd(1) journal export record schema.records (
OrderedMultiDict[RecordType,NameResolutionRecord]) – Parsed PCAP-NG records.
- Return type:
- Returns:
Constructed systemd(1) journal export record data.
- _read_secrets_unknown(schema, *, block)[source]¶
Read PCAP-NG unknown secrets.
- Parameters:
schema (
UnknownSecrets) – Parsed secret schema.block (
DecryptionSecretsBlock) – Parsed PCAP-NG decryption secrets block.
- Return type:
- _read_secrets_tls(schema, *, block)[source]¶
Read PCAP-NG TLS key log secrets.
- Parameters:
schema (
TLSKeyLog) – Parsed secret schema.block (
DecryptionSecretsBlock) – Parsed PCAP-NG decryption secrets block.
- Return type:
- _read_secrets_wireguard(schema, *, block)[source]¶
Read PCAP-NG WireGuard key log secrets.
- Parameters:
schema (
WireGuardKeyLog) – Parsed secret schema.block (
DecryptionSecretsBlock) – Parsed PCAP-NG decryption secrets block.
- Return type:
- Returns:
Constructed decryption secrets data.
- _read_secrets_zigbee_nwk(schema, *, block)[source]¶
Read PCAP-NG ZigBee NWK Key secrets.
Structure of ZigBee NWK Key secrets:
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +---------------------------------------------------------------+ 0 | Block Type = 0x0000000A | +---------------------------------------------------------------+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Secrets Type = 0x5a4e574b | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Secrets Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | AES-128 | | NKW Key | | (16 octets) | | (128 bits) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 32 | PAN ID | padding (0) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 36 / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Block Total Length / +---------------------------------------------------------------+
- Parameters:
schema (
ZigBeeNWKKey) – Parsed secret schema.block (
DecryptionSecretsBlock) – Parsed PCAP-NG decryption secrets block.
- Return type:
- Returns:
Constructed decryption secrets data.
- _read_secrets_zigbee_aps(schema, *, block)[source]¶
Read PCAP-NG ZigBee APS Key secrets.
Structure of ZigBee APS Key secrets:
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +---------------------------------------------------------------+ 0 | Block Type = 0x0000000A | +---------------------------------------------------------------+ 4 | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8 | Secrets Type = 0x5a415053 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 12 | Secrets Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16 | AES-128 | | APS Key | | (16 octets) | | (128 bits) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 32 | PAN ID | Low Node Short Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 36 | High Node Short Address | padding (0) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 40 / / / Options (variable) / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Block Total Length / +---------------------------------------------------------------+
- Parameters:
schema (
ZigBeeAPSKey) – Parsed secret schema.block (
DecryptionSecretsBlock) – Parsed PCAP-NG decryption secrets block.
- Return type:
- Returns:
Constructed decryption secrets data.
- _make_block_unknown(block=None, *, data=b'', **kwargs)[source]¶
Make unknown PCAP-NG block.
- Parameters:
block (
UnknownBlock|None) – Block data model.data (
bytes) – Unspecified block data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_shb(block=None, *, version=(1, 0), major_version=None, minor_version=None, section_length=-1, options=None, **kwargs)[source]¶
Make PCAP-NG section header block (SHB).
- Parameters:
block (
SectionHeaderBlock|None) – Block data model.version (
tuple[int,int] |VersionInfo) – Version information.section_length (
int) – Section length.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_idb(block=None, *, linktype=<LinkType.NULL: 0>, linktype_default=None, linktype_namespace=None, linktype_reversed=False, snaplen=18446744073709551615, options=None, **kwargs)[source]¶
Make PCAP-NG interface description block (IDB).
- Parameters:
block (
InterfaceDescriptionBlock|None) – Block data model.linktype (
LinkType|IntEnum|IntEnum|str|int) – Link layer protocol type.linktype_default (
int|None) – Default value of link layer protocol type.linktype_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of link layer protocol type.linktype_reversed (
bool) – Reversed flag for link layer protocol type namespace.snaplen (
int) – Snap length.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_epb(block=None, *, interface_id=0, timestamp=None, captured_len=None, original_len=None, packet_data=b'', options=None, **kwargs)[source]¶
Make PCAP-NG enhanced packet block (EPB).
- Parameters:
block (
EnhancedPacketBlock|None) – Block data model.interface_id (
int) – Interface ID.timestamp (
float|Decimal|int|datetime|None) – Packet timestamp.packet_data (
bytes|ProtocolBase|Schema) – Payload of the block.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_spb(block=None, *, original_len=None, packet_data=b'', **kwargs)[source]¶
Make PCAP-NG simple packet block (SPB).
- Parameters:
block (
SimplePacketBlock|None) – Block data model.packet_data (
bytes|ProtocolBase|Schema) – Payload of the block.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_nrb(block=None, *, records=None, options=None, **kwargs)[source]¶
Make PCAP-NG name resolution block (NRB).
- Parameters:
block (
NameResolutionBlock|None) – Block data model.records (
OrderedMultiDict[RecordType,NameResolutionRecord] |list[NameResolutionRecord|tuple[RecordType,dict[str,Any]] |bytes] |None) – Name resolution records.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_isb(block=None, *, interface_id=0, timestamp=None, options=None, **kwargs)[source]¶
Make PCAP-NG interface statistics block (ISB).
- Parameters:
block (
InterfaceStatisticsBlock|None) – Block data model.interface_id (
int) – Interface ID.timestamp (
float|Decimal|int|datetime|None) – Block timestamp.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_systemd(block=None, *, entries=None, **kwargs)[source]¶
Make PCAP-NG systemd(1) journal export block.
- Parameters:
block (
SystemdJournalExportBlock|None) – Block data model.entries (
list[OrderedMultiDict[str,str|bytes]] |bytes|None) – systemd(1) journal export entries.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_dsb(block=None, *, secrets_type=<SecretsType.TLS_Key_Log: 1414288203>, secrets_type_default=None, secrets_type_namespace=None, secrets_type_reversed=False, secrets_data=b'', options=None, **kwargs)[source]¶
Make PCAP-NG decryption secrets block (DSB).
- Parameters:
block (
DecryptionSecretsBlock|None) – Block data model.secrets_type (
SecretsType|IntEnum|IntEnum|str|int) – Decryption secrets type.secrets_type_default (
int|None) – Default value of decryption secrets type.secrets_type_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of decryption secrets type.secrets_type_reversed (
bool) – Reversed flag for namespace of decryption secrets type.secrets_data (
DSBSecrets|DSBSecrets|bytes|dict[str,Any]) – Decryption secrets data.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_cb(block=None, *, pen=0, data=b'', options=None, **kwargs)[source]¶
Make PCAP-NG custom block (CB).
- Parameters:
block (
CustomBlock|None) – Block data model.pen (
int) – Private enterprise number.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_block_packet(block=None, *, interface_id=0, drop_count=0, timestamp=None, captured_len=None, original_len=None, packet_data=b'', options=None, **kwargs)[source]¶
Make PCAP-NG packet block (obsolete).
- Parameters:
block (
PacketBlock|None) – Block data model.interface_id (
int) – Interface ID.drop_count (
int) – Drops count.timestamp (
float|Decimal|int|datetime|None) – Packet timestamp.packet_data (
bytes|ProtocolBase|Schema) – Payload of the block.options (
OrderedMultiDict[OptionType,Option] |list[Option|tuple[OptionType,dict[str,Any]] |bytes] |None) – Block options.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed block schema.
- _make_option_unknown(type, option=None, *, data=b'', **kwargs)[source]¶
Make unknown PCAP-NG option.
- Parameters:
type (
OptionType) – Option type.option (
UnknownOption|None) – Option data model.data (
bytes) – Unspecified option data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_endofopt(type, option=None, **kwargs)[source]¶
Make PCAP-NG
opt_endofoptoption.- Parameters:
type (
OptionType) – Option type.option (
EndOfOption|None) – Option data model.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_comment(type, option=None, *, comment='', **kwargs)[source]¶
Make PCAP-NG
opt_commentoption.- Parameters:
type (
OptionType) – Option type.option (
CommentOption|None) – Option data model.comment (
str) – Comment text.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_custom(type, option=None, *, pen=4294967295, data=b'', **kwargs)[source]¶
Make PCAP-NG
opt_customoption.- Parameters:
type (
OptionType) – Option type.option (
CustomOption|None) – Option data model.pen (
int) – Private enterprise number.data (
bytes) – Custom data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_name(type, option=None, *, name='', **kwargs)[source]¶
Make PCAP-NG
if_nameoption.- Parameters:
type (
OptionType) – Option type.option (
IF_NameOption|None) – Option data model.name (
str) – Interface name.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_description(type, option=None, *, description='', **kwargs)[source]¶
Make PCAP-NG
if_descriptionoption.- Parameters:
type (
OptionType) – Option type.option (
IF_DescriptionOption|None) – Option data model.description (
str) – Interface description.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_ipv4(type, option=None, *, interface='192.168.1.1/255.255.255.0', **kwargs)[source]¶
Make PCAP-NG
if_IPv4addroption.- Parameters:
type (
OptionType) – Option type.option (
IF_IPv4AddrOption|None) – Option data model.interface (
IPv4Interface|str) – IPv4 interface.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_ipv6(type, option=None, *, interface='2001:0db8:85a3:08d3:1319:8a2e:0370:7344/64', **kwargs)[source]¶
Make PCAP-NG
if_IPv6addroption.- Parameters:
type (
OptionType) – Option type.option (
IF_IPv6AddrOption|None) – Option data model.interface (
IPv6Interface|str) – IPv6 interface.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_mac(type, option=None, *, interface='00:01:02:03:04:05', **kwargs)[source]¶
Make PCAP-NG
if_MACaddroption.- Parameters:
type (
OptionType) – Option type.option (
IF_MACAddrOption|None) – Option data model.interface (
str|bytes|bytearray) – MAC interface address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_eui(type, option=None, *, interface='02:34:56:FF:FE:78:9A:BC', **kwargs)[source]¶
Make PCAP-NG
if_EUIaddroption.- Parameters:
type (
OptionType) – Option type.option (
IF_EUIAddrOption|None) – Option data model.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_speed(type, option=None, *, speed=100000000, **kwargs)[source]¶
Make PCAP-NG
if_speedoption.- Parameters:
type (
OptionType) – Option type.option (
IF_SpeedOption|None) – Option data model.speed (
int) – Interface speed, in bits per second.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_tsresol(type, option=None, *, resolution=1000000, **kwargs)[source]¶
Make PCAP-NG
if_tsresoloption.- Parameters:
type (
OptionType) – Option type.option (
IF_TSResolOption|None) – Option data model.resolution (
int) – Resolution of timestamps, in units per second.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_tzone(type, option=None, *, tzone=0, **kwargs)[source]¶
Make PCAP-NG
if_tzoneoption.- Parameters:
type (
OptionType) – Option type.option (
IF_TZoneOption|None) – Option data model.tzone (
timezone|timedelta|int) – Timezone offset, in seconds.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_filter(type, option=None, *, filter=<FilterType.Unassigned_0: 0>, filter_default=None, filter_namespace=None, filter_reversed=False, expression=b'', **kwargs)[source]¶
Make PCAP-NG
if_filteroption.- Parameters:
type (
OptionType) – Option type.option (
IF_FilterOption|None) – Option data model.filter (
FilterType|IntEnum|IntEnum|str|int) – Filter type.filter_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Filter namespace.filter_reversed (
bool) – Whether filter namespace is reversed.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_os(type, option=None, *, os='macOS-26.6.2-arm64-arm-64bit-Mach-O', **kwargs)[source]¶
Make PCAP-NG
if_osoption.- Parameters:
type (
OptionType) – Option type.option (
IF_OSOption|None) – Option data model.os (
str) – Operating system name.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_fcslen(type, option=None, *, fcs_length=4, **kwargs)[source]¶
Make PCAP-NG
if_fcslenoption.- Parameters:
type (
OptionType) – Option type.option (
IF_FCSLenOption|None) – Option data model.fcs_length (
int) – FCS length, in bytes.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_tsoffset(type, option=None, *, offset=0, **kwargs)[source]¶
Make PCAP-NG
if_tsoffsetoption.- Parameters:
type (
OptionType) – Option type.option (
IF_TSOffsetOption|None) – Option data model.offset (
int) – Timestamp offset in seconds.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_hardware(type, option=None, *, hardware='arm', **kwargs)[source]¶
Make PCAP-NG
if_hardwareoption.- Parameters:
type (
OptionType) – Option type.option (
IF_HardwareOption|None) – Option data model.hardware (
str) – Hardware information.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_txspeed(type, option=None, *, speed=100000000, **kwargs)[source]¶
Make PCAP-NG
if_txspeedoption.- Parameters:
type (
OptionType) – Option type.option (
IF_TxSpeedOption|None) – Option data model.speed (
int) – Interface transmit speed, in bits per second.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_if_rxspeed(type, option=None, *, speed=100000000, **kwargs)[source]¶
Make PCAP-NG
if_rxspeedoption.- Parameters:
type (
OptionType) – Option type.option (
IF_RxSpeedOption|None) – Option data model.speed (
int) – Interface receive speed, in bits per second.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_flags(type, option=None, *, direction=PacketDirection.UNKNOWN, direction_default=None, direction_namespace=None, direction_reversed=False, reception=PacketReception.UNKNOWN, reception_default=None, reception_namespace=None, reception_reversed=False, fcs_len=0, crc_error=False, too_long=False, too_short=False, gap_error=False, unaligned_error=False, delimiter_error=False, preamble_error=False, symbol_error=False, **kwargs)[source]¶
Make PCAP-NG
epb_flagsoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_FlagsOption|None) – Option data model.direction (
PacketDirection|IntEnum|IntEnum|str|int) – Packet direction.direction_default (
int|None) – Default value of packet direction.direction_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of packet direction.direction_reversed (
bool) – Whether to reverse packet direction namespace.reception (
PacketReception|IntEnum|IntEnum|str|int) – Packet reception.reception_default (
int|None) – Default value of packet reception.reception_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of packet reception.reception_reversed (
bool) – Whether to reverse packet reception namespace.fcs_len (
int) – Length of FCS field, in bytes.crc_error (
bool) – Whether CRC error occurred.too_long (
bool) – Whether packet is too long.too_short (
bool) – Whether packet is too short.gap_error (
bool) – Whether gap error occurred.unaligned_error (
bool) – Whether unaligned error occurred.delimiter_error (
bool) – Whether delimiter error occurred.preamble_error (
bool) – Whether preamble error occurred.symbol_error (
bool) – Whether symbol error occurred.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_hash(type, option=None, *, algorithm=<HashAlgorithm.two_s_complement: 0>, algorithm_default=None, algorithm_namespace=None, algorithm_reversed=False, hash=b'', **kwargs)[source]¶
Make PCAP-NG
epb_hashoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_HashOption|None) – Option data model.algorithm (
HashAlgorithm|IntEnum|IntEnum|int|str) – Hash algorithm.algorithm_default (
int|None) – Default value of hash algorithm.algorithm_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of hash algorithm.algorithm_reversed (
bool) – Whether to reverse hash algorithm namespace.hash (
bytes) – Hash value.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_dropcount(type, option=None, *, drop_count=0, **kwargs)[source]¶
Make PCAP-NG
epb_dropcountoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_DropCountOption|None) – Option data model.drop_count (
int) – Number of dropped packets.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_packetid(type, option=None, *, packet_id=0, **kwargs)[source]¶
Make PCAP-NG
epb_packetidoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_PacketIDOption|None) – Option data model.packet_id (
int) – Packet ID.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_queue(type, option=None, *, queue_id=0, **kwargs)[source]¶
Make PCAP-NG
epb_queueoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_QueueOption|None) – Option data model.queue_id (
int) – Queue ID.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_epb_verdict(type, option=None, *, verdict=<VerdictType.Hardware: 0>, verdict_default=None, verdict_namespace=None, verdict_reversed=False, value=b'', **kwargs)[source]¶
Make PCAP-NG
epb_verdictoption.- Parameters:
type (
OptionType) – Option type.option (
EPB_VerdictOption|None) – Option data model.verdict (
VerdictType|IntEnum|IntEnum|str|int) – Verdict type.verdict_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace for verdict.verdict_reversed (
bool) – Whether to reverse the namespace.value (
bytes) – Verdict value.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_ns_dnsname(type, option=None, *, name='', **kwargs)[source]¶
Make PCAP-NG
ns_dnsnameoption.- Parameters:
type (
OptionType) – Option type.option (
NS_DNSNameOption|None) – Option data model.name (
str) – DNS server name.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_ns_dnsipv4(type, option=None, *, ip='8.8.8.8', **kwargs)[source]¶
Make PCAP-NG
ns_dnsip4addroption.- Parameters:
type (
OptionType) – Option type.option (
NS_DNSIP4AddrOption|None) – Option data model.ip (
str|bytes|IPv4Address|int) – DNS server IPv4 address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_ns_dnsipv6(type, option=None, *, ip='8.8.8.8', **kwargs)[source]¶
Make PCAP-NG
ns_dnsip6addroption.- Parameters:
type (
OptionType) – Option type.option (
NS_DNSIP6AddrOption|None) – Option data model.ip (
str|bytes|IPv6Address|int) – DNS server IPv6 address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_starttime(type, option=None, *, timestamp=None, **kwargs)[source]¶
Make PCAP-NG
isb_starttimeoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_StartTimeOption|None) – Option data model.timestamp (
float|Decimal|int|datetime|None) – Start time.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_endtime(type, option=None, *, timestamp=None, **kwargs)[source]¶
Make PCAP-NG
isb_endtimeoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_EndTimeOption|None) – Option data model.timestamp (
float|Decimal|int|datetime|None) – End time.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_ifrecv(type, option=None, *, packets=0, **kwargs)[source]¶
Make PCAP-NG
isb_ifrecvoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_IFRecvOption|None) – Option data model.packets (
int) – Number of received packets.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_ifdrop(type, option=None, *, packets=0, **kwargs)[source]¶
Make PCAP-NG
isb_ifdropoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_IFDropOption|None) – Option data model.packets (
int) – Number of dropped packets.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_filteraccept(type, option=None, *, packets=0, **kwargs)[source]¶
Make PCAP-NG
isb_filteracceptoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_FilterAcceptOption|None) – Option data model.packets (
int) – Number of packets accepted by the filter.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_osdrop(type, option=None, *, packets=0, **kwargs)[source]¶
Make PCAP-NG
isb_osdropoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_OSDropOption|None) – Option data model.packets (
int) – Number of packets dropped by the OS.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_isb_usrdeliv(type, option=None, *, packets=0, **kwargs)[source]¶
Make PCAP-NG
isb_usrdelivoption.- Parameters:
type (
OptionType) – Option type.option (
ISB_UsrDelivOption|None) – Option data model.packets (
int) – Number of dropped packets.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_pack_flags(type, option=None, *, direction=PacketDirection.UNKNOWN, direction_default=None, direction_namespace=None, direction_reversed=False, reception=PacketReception.UNKNOWN, reception_default=None, reception_namespace=None, reception_reversed=False, fcs_len=0, crc_error=False, too_long=False, too_short=False, gap_error=False, unaligned_error=False, delimiter_error=False, preamble_error=False, symbol_error=False, **kwargs)[source]¶
Make PCAP-NG
pack_flagsoption.- Parameters:
type (
OptionType) – Option type.option (
PACK_FlagsOption|None) – Option data model.direction (
PacketDirection|IntEnum|IntEnum|str|int) – Packet direction.direction_default (
int|None) – Default value of packet direction.direction_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of packet direction.direction_reversed (
bool) – Whether to reverse packet direction namespace.reception (
PacketReception|IntEnum|IntEnum|str|int) – Packet reception.reception_default (
int|None) – Default value of packet reception.reception_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of packet reception.reception_reversed (
bool) – Whether to reverse packet reception namespace.fcs_len (
int) – Length of FCS field, in bytes.crc_error (
bool) – Whether CRC error occurred.too_long (
bool) – Whether packet is too long.too_short (
bool) – Whether packet is too short.gap_error (
bool) – Whether gap error occurred.unaligned_error (
bool) – Whether unaligned error occurred.delimiter_error (
bool) – Whether delimiter error occurred.preamble_error (
bool) – Whether preamble error occurred.symbol_error (
bool) – Whether symbol error occurred.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_option_pack_hash(type, option=None, *, algorithm=<HashAlgorithm.two_s_complement: 0>, algorithm_default=None, algorithm_namespace=None, algorithm_reversed=False, hash=b'', **kwargs)[source]¶
Make PCAP-NG
pack_hashoption.- Parameters:
type (
OptionType) – Option type.option (
PACK_HashOption|None) – Option data model.algorithm (
HashAlgorithm|IntEnum|IntEnum|int|str) – Hash algorithm.algorithm_default (
int|None) – Default value of hash algorithm.algorithm_namespace (
dict[str,int] |dict[int,str] |Type[IntEnum] |Type[IntEnum] |None) – Namespace of hash algorithm.algorithm_reversed (
bool) – Whether to reverse hash algorithm namespace.hash (
bytes) – Hash value.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed option schema.
- _make_nrb_records(records)[source]¶
Make systemd(1) journal export records for PCAP-NG.
- Parameters:
records (
OrderedMultiDict[RecordType,NameResolutionRecord] |list[NameResolutionRecord|tuple[RecordType,dict[str,Any]] |bytes]) – PCAP-NG systemd(1) journal export records.- Return type:
- Returns:
Tuple of systemd(1) journal export records and total length of the records.
- _make_record_unknown(type, record=None, *, data=b'', **kwargs)[source]¶
Make PCAP-NG unknown systemd(1) journal export record.
- Parameters:
type (
RecordType) – Record type.record (
UnknownRecord|None) – Record data model.data (
bytes) – Record data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed record schema.
- _make_record_end(type, record=None, **kwargs)[source]¶
Make PCAP-NG
nrb_record_endsystemd(1) journal export record.- Parameters:
type (
RecordType) – Record type.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed record schema.
- _make_record_ipv4(type, record=None, *, ip='127.0.0.1', names=None, **kwargs)[source]¶
Make PCAP-NG
nrb_record_ipv4systemd(1) journal export record.- Parameters:
type (
RecordType) – Record type.record (
IPv4Record|None) – Record data model.ip (
IPv4Address|str|bytes|int) – IPv4 address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed record schema.
- _make_record_ipv6(type, record=None, *, ip='127.0.0.1', names=None, **kwargs)[source]¶
Make PCAP-NG
nrb_record_ipv6systemd(1) journal export record.- Parameters:
type (
RecordType) – Record type.record (
IPv6Record|None) – Record data model.ip (
IPv6Address|str|bytes|int) – IPv6 address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed record schema.
- _make_secrets_unknown(type, secrets=None, *, data=b'', **kwargs)[source]¶
Make PCAP-NG unknown secrets.
- Parameters:
type (
SecretsType) – Secrets type.secrets (
UnknownSecrets|None) – Secrets data model.data (
bytes) – Secrets data.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed secrets schema.
- _make_secrets_tls(type, secrets=None, *, entries=None, **kwargs)[source]¶
Make PCAP-NG TLS Key Log secrets.
- Parameters:
type (
SecretsType) – Secrets type.entries (
dict[TLSKeyLabel,OrderedMultiDict[bytes,bytes]] |None) – TLS Key Log entries.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed secrets schema.
- _make_secrets_wireguard(type, secrets=None, *, entries=None, **kwargs)[source]¶
Make PCAP-NG WireGuard secrets.
- Parameters:
type (
SecretsType) – Secrets type.secrets (
WireGuardKeyLog|None) – Secrets data model.entries (
OrderedMultiDict[WireGuardKeyLabel,bytes] |None) – WireGuard Key Log entries.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed secrets schema.
- _make_secrets_zigbee_nwk(type, secrets=None, *, nwk_key=b'', pan_id=0, **kwargs)[source]¶
Make PCAP-NG ZigBee NWK Key secrets.
- Parameters:
type (
SecretsType) – Secrets type.secrets (
ZigBeeNWKKey|None) – Secrets data model.nwk_key (
bytes) – NWK key.pan_id (
int) – PAN ID.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed secrets schema.
- _make_secrets_zigbee_aps(type, secrets=None, *, aps_key=b'', pan_id=0, short_address=0, **kwargs)[source]¶
Make PCAP-NG ZigBee APS Key secrets.
- Parameters:
type (
SecretsType) – Secrets type.secrets (
ZigBeeAPSKey|None) – Secrets data model.aps_key (
bytes) – APS key.pan_id (
int) – PAN ID.short_address (
int) – Short address.**kwargs (
Any) – Arbitrary keyword arguments.
- Return type:
- Returns:
Constructed secrets schema.
- __proto__: DefaultDict[LinkType | int, ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]]¶
Protocol index mapping for decoding next layer, c.f.
self._decode_next_layer&self._import_next_layer. The values should be a tuple representing the module name and class name, or aProtocolsubclass.- Type:
DefaultDict[Enum_LinkType, ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]]
- __block__: DefaultDict[BlockType | int, str | tuple[Callable[[BlockType, PCAPNG], PCAPNG], Callable[[PCAPNG | None, Any], BlockType]]]¶
Block type to method mapping. Method names are expected to be referred to the class by
_read_block_${name}and/or_make_block_${name}, and if such name not found, the value should then be a method that can parse the block by itself.
- __option__: DefaultDict[OptionType | Tuple[str, int], str | tuple[Callable[[Option, OrderedMultiDict[OptionType, Option]], Option], Callable[[OptionType, Option | None, Any], Option]]]¶
Block option type to method mapping. Method names are expected to be referred to the class by
_read_option_${name}and/or_make_option_${name}, and if such name not found, the value should then be a method that can parse the option by itself.
- __record__: DefaultDict[RecordType | int, str | tuple[Callable[[NameResolutionRecord, OrderedMultiDict[RecordType, NameResolutionRecord]], NameResolutionRecord], Callable[[RecordType, NameResolutionRecord | None, Any], NameResolutionRecord]]]¶
systemd(1) Journal Export record type to method mapping. Method names are expected to be referred to the class by
_read_record_${name}and/or_make_record_${name}, and if such name not found, the value should then be a method that can parse the name record by itself.
- __secrets__: DefaultDict[SecretsType | int, str | tuple[Callable[[DSBSecrets, DecryptionSecretsBlock], DSBSecrets], Callable[[SecretsType, DSBSecrets | None, Any], DSBSecrets]]]¶
Decryption secrets type to method mapping. Method names are expected to be referred to the class by
_read_secrets_${name}and/or_make_secrets_${name}, and if such name not found, the value should then be a method that can parse the decryption secrets by itself.
- __post_init__(file=None, length=None, *, num, sct, ctx, **kwargs)[source]¶
Initialisation.
- Overloads:
self, file (IO[bytes] | bytes), length (Optional[int]), num (int), sct (int), ctx (Context), kwargs (Any) → None
self, num (int), sct (int), ctx (Context), kwargs (Any) → None
- Parameters:
Notes
For the first block,
numwill be set to0and ctx asNone, such that we can be sure that the first block is the section header block.See also
For construction argument, please refer to
make().
- __index__()[source]¶
Index of the block.
- Parameters:
- Return type:
- Returns:
If the object is initiated, i.e.
self._fnumexists, and is of a packet block (EPB, ISB or Packet), returns the block index number of itself; else raisesUnsupportedCall.- Raises:
UnsupportedCall – This protocol has no registry entry.
Auxiliary Data¶
- class pcapkit.protocols.misc.pcapng.PacketDirection(*values)[source]¶
Bases:
IntEnumPacket direction for
epb_flagsoptions.- UNKNOWN = 0¶
Information not available.
- INBOUND = 1¶
Inbound packet.
- OUTBOUND = 2¶
Outbound packet.
- class pcapkit.protocols.misc.pcapng.PacketReception(*values)[source]¶
Bases:
IntEnumReception type for
epb_flagsoptions.- UNKNOWN = 0¶
Not specified.
- UNICAST = 1¶
Unicast.
- MULTICAST = 2¶
Multicast.
- BROADCAST = 3¶
Broadcast.
- PROMISCUOUS = 4¶
Promiscuous.
- class pcapkit.protocols.misc.pcapng.TLSKeyLabel(*values)[source]¶
Bases:
StrEnumTLS key log label.
- RSA = 'RSA'¶
- CLIENT_RANDOM = 'CLIENT_RANDOM'¶
- CLIENT_EARLY_TRAFFIC_SECRET = 'CLIENT_EARLY_TRAFFIC_SECRET'¶
- CLIENT_HANDSHAKE_TRAFFIC_SECRET = 'CLIENT_HANDSHAKE_TRAFFIC_SECRET'¶
- SERVER_HANDSHAKE_TRAFFIC_SECRET = 'SERVER_HANDSHAKE_TRAFFIC_SECRET'¶
- CLIENT_TRAFFIC_SECRET_0 = 'CLIENT_TRAFFIC_SECRET_0'¶
- SERVER_TRAFFIC_SECRET_0 = 'SERVER_TRAFFIC_SECRET_0'¶
- EARLY_EXPORTER_SECRET = 'EARLY_EXPORTER_SECRET'¶
- EXPORTER_SECRET = 'EXPORTER_SECRET'¶
- static _generate_next_value_(name, start, count, last_values)¶
Return the lower-cased version of the member name.
- class pcapkit.protocols.misc.pcapng.WireGuardKeyLabel(*values)[source]¶
Bases:
StrEnumWireGuard key log label.
- LOCAL_STATIC_PRIVATE_KEY = 'LOCAL_STATIC_PRIVATE_KEY'¶
- REMOTE_STATIC_PUBLIC_KEY = 'REMOTE_STATIC_PUBLIC_KEY'¶
- LOCAL_EPHEMERAL_PRIVATE_KEY = 'LOCAL_EPHEMERAL_PRIVATE_KEY'¶
- PRESHARED_KEY = 'PRESHARED_KEY'¶
- static _generate_next_value_(name, start, count, last_values)¶
Return the lower-cased version of the member name.
Header Schemas¶
- class pcapkit.protocols.schema.misc.pcapng.PCAPNG(*args: _VT, **kwargs: _VT)[source]¶
Bases:
SchemaHeader schema for PCAP-NG file blocks.
- class pcapkit.protocols.schema.misc.pcapng.BlockType(dict_=None, **kwargs)[source]¶
Bases:
EnumSchema[BlockType]Header schema for PCAP-NG file blocks.
- class pcapkit.protocols.schema.misc.pcapng.UnknownBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for unknown PCAP-NG file blocks.
- class pcapkit.protocols.schema.misc.pcapng.SectionHeaderBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Section Header Block (SHB).
- match: ByteorderTest = <ForwardMatchField match>¶
Fast forward field to test the byteorder.
- padding: bytes = <PaddingField padding>¶
Padding, sized from the
__option_padding__key that OptionField generates.
- pre_pack(packet)[source]¶
Prepare
packetdata for packing process.Note
This method is expected to directly modify any data stored in the
packetand thus no return is required.The Byte-Order Magic is not carried by any field of the schema –
magicis the palindromic constant, identical in either byte order – so it is seeded here from the byte order the packet data asks for, and from the host byte order when it asks for none.
- class pcapkit.protocols.schema.misc.pcapng.InterfaceDescriptionBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Interface Description Block (IDB).
- class pcapkit.protocols.schema.misc.pcapng.EnhancedPacketBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Enhanced Packet Block (EPB).
- class pcapkit.protocols.schema.misc.pcapng.SimplePacketBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Simple Packet Block (SPB).
- class pcapkit.protocols.schema.misc.pcapng.NameResolutionBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Name Resolution Block (NRB).
- records: list[NameResolutionRecord] = <OptionField records>¶
Name resolution records.
- padding: bytes = <PaddingField padding>¶
Padding, sized from the
__option_padding__key that OptionField generates.
- mapping: MultiDict[IPv4Address | IPv6Address, str]¶
Name resolution mapping (IP address -> name).
- reverse_mapping: MultiDict[str, IPv4Address | IPv6Address]¶
Name resolution mapping (name -> IP address).
- class pcapkit.protocols.schema.misc.pcapng.InterfaceStatisticsBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Interface Statistics Block (ISB).
- class pcapkit.protocols.schema.misc.pcapng.SystemdJournalExportBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG systemd(1) Journal Export Block.
- post_process(packet)[source]¶
Revise
schemadata after unpacking process.Note
Two ways the entry data runs out mid-field are reported rather than raised, for the reason
nonnegative()gives: a barestruct.erroris neither one ofpcapkit.utilities.exceptionsnor anEOFError, so it aborted the whole extraction rather than this one entry. See #678.A line of nothing but NUL octets is the block’s own 32-bit padding and ends the entry.
bytes.strip()takes only ASCII whitespace, so those octets survived it and were read as the name of a binary field – which made every journal entry whose length is not a multiple of four raise, valid or not, since the padding that follows it has no 64-bit length prefix behind it to unpack. Measured on a 14-octetMESSAGE=hello\nentry, which is as ordinary as this block gets.A name line whose 64-bit length prefix is itself cut short ends the entry too. There is nothing to read past the end of the entry, so stopping at it is what keeps the truncated block parsing.
A binary field’s length is the widest declared length in the format, and nothing bounded it against the entry holding it: at
2**63and aboveio.BytesIO.read()refuses it outright with a bareOverflowError(cannot fit 'int' into an index-sized integer), and below that it silently returned whatever was there – so the same malformed prefix was either fatal or invisible depending only on its magnitude. It is clamped to the octets the entry has left and reported, which isnonnegative()’s rule at the other end of the same range.Field names, keys and values are decoded with
errors='replace'rather than strictly. A non-UTF-8 octet in any of the three raised a bareUnicodeDecodeError– aValueError, so foreign on both counts, and fatal to the whole extraction over one bad octet in one field.'replace'is the option this module’s ownStringFieldalready takes for the same problem, and a value that is not text is a value the writer should have emitted as a binary field, so the entry is malformed however it is read.Entries used to be split apart with
self.entry.split(b'\n\n')before a single field was read – delimiting a length-prefixed format by content, which a binary field’s own bytes need no escaping to defeat. A value that itself containsb'\n\n'was cut in the middle of its own data, turning what followed it into a bogus field in a fabricated second entry; a value 2,570 octets long is worse, sincestruct.pack('<Q', 2570) == b'\n\n\x00\x00\x00\x00\x00\x00'puts the separator inside the length prefix itself, so the split landed before a single field was read. See #723. The entry is now walked once, end to end: a length-prefixed field’s bytes are never inspected for structure, only counted out by the prefix that names them, and a blank line – found by reading, not by splitting – is what starts the next entry. The one-octet terminator that must follow a binary field’s value, and the warning when it is missing, are unchanged from #722; walking the buffer whole rather than pre-slicing it also retires that fix’s newline restoration, which existed only to undo what the slicing itself had taken away.A trailing separator – a blank line with nothing behind it – used to be swallowed instead of ending the entry: with nothing left to read, the walk stopped without recording that the separator had been seen at all, so a rebuild lost that one octet and wrote a
lengthone short of what was read. It is now tracked explicitly, so a blank line actually read, rather than the block’s own NUL padding or plain end of data, still starts the next entry – even an empty one – matching what splitting on it always did.The guard above ends the entry on a line of nothing but NUL padding, but only catches it when the real content ahead of the padding ended with its own newline – which put the padding on a line by itself for
readline()to return alone. An entry whose last field is missing that trailing newline, as the format requires, has no such separation:readline()runs straight through the field’s own bytes and into the padding behind them, returning both as one line, andbytes.strip()still will not take the NUL octets off since they are not ASCII whitespace. The padding then went out as part of the field’s value with nothing to flag it, silently, however small – see #794.readline()returns a line without its own trailing newline only at end of stream, so a terminator-less line is necessarily the buffer’s last one; a binary field’s name landing on such a line fails its own 8-octet length-prefix read for the same reason, nothing being left behind it to hold one, so the guard below firing on that shape of line too is harmless. A binary field’s value, once its name and length prefix are known, is read by that length prefix directly, never by scanning for a line ending, so real block padding immediately behind one cannot land inside it this way: the one-octet terminator check already in place is always reached in that case, and either reads the real separator newline and passes silently, or reads padding’s first octet instead, fails, and reports it. Block padding is always 0-3 octets, whatever the last field turns out to be, so at most the trailing three octets of a terminator-less line are stripped as padding and warned about, and only when the line’s own raw, unstripped tail is itself NUL – anything past three such octets, or a line whose actual last octet is not NUL at all, cannot be padding and is left as data. This cannot tell a padding octet from a text value that itself legitimately ends in one – NUL is valid UTF-8 – but that entry is already malformed for lacking the newline the format mandates, and returning the block’s own padding as field data is the one outcome that must not survive it.
- static _decode_text(octets)[source]¶
Decode a journal field name, key or value, reporting what did not decode.
- Parameters:
octets (
bytes) – Field name, key or value, as it came off the wire.- Return type:
- Returns:
The decoded text, with any octet that is not UTF-8 replaced.
See
post_process()for why this replaces rather than raising.
- class pcapkit.protocols.schema.misc.pcapng.DecryptionSecretsBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Decryption Secrets Block (DSB).
- secrets_type: SecretsType = <EnumField secrets_type>¶
Secrets type.
- secrets_data: DSBSecrets = <SwitchField secrets_data>¶
Secrets data.
- class pcapkit.protocols.schema.misc.pcapng.CustomBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Custom Block (CB).
Note
The block carries no length for its custom data, so where the custom data ends and the block options begin is known only to the owner of the private enterprise number.
datatherefore spans the whole region betweenpenand the trailing block total length, i.e. the custom data, its padding to a 32-bit boundary, and any options.
- class pcapkit.protocols.schema.misc.pcapng.PacketBlock(*args: _VT, **kwargs: _VT)[source]¶
Bases:
BlockTypeHeader schema for PCAP-NG Packet Block (obsolete).
- class pcapkit.protocols.schema.misc.pcapng.Option(dict_=None, **kwargs)[source]¶
Bases:
EnumSchema[OptionType]Header schema for PCAP-NG file options.
- classmethod __init_subclass__(code=None, ns=None, *args, **kwargs)[source]¶
Register option type to
__enum__mapping.- Parameters:
code (
OptionType|Iterable[OptionType] |None) – Option type code. It can be either a single option type enumeration or a list of option type enumerations.ns (
str|None) – Namespace of option type enumeration. If not given, the value will be inferred from the option type code. Spellednsrather thannamespacebecauseabc.ABCMeta.__new__()names its own fourth parameternamespace, and before Python 3.11 that parameter is positional-or-keyword rather than positional-only – so a class keyword literally callednamespacebound it twice. See GitHub issue #439.*args (
Any) – Arbitrary positional arguments.**kwargs (
Any) – Arbitrary keyword arguments.
If
codeis provided, the subclass will be registered to the__enum__mapping with the givencode. Ifcodeis not given, the subclass will not be registered.Examples
from pcapkit.const.pcapng.option_type import OptionType as Enum_OptionType from pcapkit.protocols.schema.misc.pcapng improt Option class NewOption(Option, ns='opt', code=Enum_OptionType.opt_new): ...
- static register(code, cls, ns=None)[source]¶
Register option type to
__enum__mapping.- Parameters:
code (
OptionType) – Option type code.ns (
str|None) – Namespace of option type enumeration. If not given, the value will be inferred from the option type code.
A registration that displaces another schema for the same code is reported as a
RegistryWarning, as every other registry in the package does – the lookup that follows cannot tell a deliberate replacement from an accidental one, so an unreported overwrite is a parser silently swapped out for another. See #681 for the guardregister_protocoladded first, which this one now matches.The guard is identity-based: it fires only when the incumbent differs from
cls, so re-registering the exact same class under the samecodeis a silent no-op – in every namespacetargetsreaches – rather than a warning about nothing displaced. That is what keeps__init_subclass__()honest: it loops over acodelist with no deduplication, so a repeated or aliased entry reaches this method twice with the same class, and the second call now finds itself already the incumbent. GitHub issue #718 corrected the previous presence-only guard, which read every such repeat as a caller mistake whether or not the value had actually changed – the same fix the siblingregister()methods onProtocolBaseand friends already received.Note
ns='opt'fans one registration out across every namespace, so the collision is reported once for the registration and names the namespaces it displaced something in, rather than once per namespace.A namespace created by this call starts as a copy of
opt’s defaults, so nothing in it is a prior registration and it is exempt: registering anopt-namespace code into a brand-new namespace is exactly what that copy is for.Membership is tested with
.get(), never by subscripting. The per-namespace registries arecollections.defaultdicts – only the outer one is the miss-safe_EnumRegistry– so readingOption.registry[key][code]to see whether it is there would insertUnknownOptionfor a code nobody registered.
- type: OptionType¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng._OPT_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
opt_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.UnknownOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_OPT_OptionHeader schema for unknown PCAP-NG file options.
- class pcapkit.protocols.schema.misc.pcapng.EndOfOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_OPT_OptionHeader schema for PCAP-NG file
opt_endofoptoptions.
- class pcapkit.protocols.schema.misc.pcapng.CommentOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_OPT_OptionHeader schema for PCAP-NG file
opt_commentoptions.
- class pcapkit.protocols.schema.misc.pcapng.CustomOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_OPT_OptionHeader schema for PCAP-NG file
opt_customoptions.
- class pcapkit.protocols.schema.misc.pcapng._IF_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
if_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.IF_NameOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_nameoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_DescriptionOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_descriptionoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_IPv4AddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_IPv4addroptions.- interface: IPv4Interface = <IPv4InterfaceField interface>¶
IPv4 interface.
- class pcapkit.protocols.schema.misc.pcapng.IF_IPv6AddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_IPv6addroptions.- interface: IPv6Interface = <IPv6InterfaceField interface>¶
IPv6 interface.
- class pcapkit.protocols.schema.misc.pcapng.IF_MACAddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_MACaddroptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_EUIAddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_EUIaddroptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_SpeedOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_speedoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_TSResolOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_tsresoloptions.- tsresol: ResolutionData = <BitField tsresol>¶
Interface timestamp resolution, in units per second.
- class pcapkit.protocols.schema.misc.pcapng.IF_TZoneOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_tzoneoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_FilterOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_filteroptions.- code: FilterType = <EnumField code>¶
Filter code.
- class pcapkit.protocols.schema.misc.pcapng.IF_OSOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_osoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_FCSLenOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_fcslenoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_TSOffsetOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_tsoffsetoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_HardwareOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_hardwareoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_TxSpeedOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_txspeedoptions.
- class pcapkit.protocols.schema.misc.pcapng.IF_RxSpeedOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_IF_OptionHeader schema for PCAP-NG file
if_rxspeedoptions.
- class pcapkit.protocols.schema.misc.pcapng._EPB_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
epb_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.EPB_FlagsOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_flagsoptions.
- class pcapkit.protocols.schema.misc.pcapng.EPB_HashOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_hashoptions.- func: HashAlgorithm = <EnumField func>¶
Hash algorithm.
- class pcapkit.protocols.schema.misc.pcapng.EPB_DropCountOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_dropcountoptions.
- class pcapkit.protocols.schema.misc.pcapng.EPB_PacketIDOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_packetidoptions.
- class pcapkit.protocols.schema.misc.pcapng.EPB_QueueOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_queueoptions.
- class pcapkit.protocols.schema.misc.pcapng.EPB_VerdictOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_EPB_OptionHeader schema for PCAP-NG
epb_verdictoptions.- verdict: VerdictType = <EnumField verdict>¶
Verdict type.
- class pcapkit.protocols.schema.misc.pcapng._NS_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
ns_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.NS_DNSNameOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_NS_OptionHeader schema for PCAP-NG
ns_dnsnameoption.
- class pcapkit.protocols.schema.misc.pcapng.NS_DNSIP4AddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_NS_OptionHeader schema for PCAP-NG
ns_dnsIP4addroption.- ip: IPv4Address = <IPv4AddressField ip>¶
IPv4 address.
- class pcapkit.protocols.schema.misc.pcapng.NS_DNSIP6AddrOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_NS_OptionHeader schema for PCAP-NG
ns_dnsIP6addroption.- ip: IPv6Address = <IPv6AddressField ip>¶
IPv6 address.
- class pcapkit.protocols.schema.misc.pcapng._ISB_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
isb_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.ISB_StartTimeOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_starttimeoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_EndTimeOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_endtimeoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_IFRecvOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_ifrecvoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_IFDropOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_ifdropoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_FilterAcceptOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_filteracceptoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_OSDropOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_osdropoption.
- class pcapkit.protocols.schema.misc.pcapng.ISB_UsrDelivOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_ISB_OptionHeader schema for PCAP-NG
isb_usrdelivoption.
- class pcapkit.protocols.schema.misc.pcapng._PACK_Option(dict_=None, **kwargs)[source]¶
Bases:
OptionHeader schema for
pack_*options.- type: OptionType = <OptionEnumField type>¶
Option type.
- class pcapkit.protocols.schema.misc.pcapng.PACK_FlagsOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_PACK_OptionHeader schema for PCAP-NG
pack_flagsoptions.
- class pcapkit.protocols.schema.misc.pcapng.PACK_HashOption(*args: _VT, **kwargs: _VT)[source]¶
Bases:
_PACK_OptionHeader schema for PCAP-NG
pack_hashoptions.- func: HashAlgorithm = <EnumField func>¶
Hash algorithm.
- class pcapkit.protocols.schema.misc.pcapng.NameResolutionRecord(dict_=None, **kwargs)[source]¶
Bases:
EnumSchema[RecordType]Header schema for PCAP-NG NRB records.
- type: RecordType = <EnumField type>¶
Record type.
- class pcapkit.protocols.schema.misc.pcapng.UnknownRecord(*args: _VT, **kwargs: _VT)[source]¶
Bases:
NameResolutionRecordHeader schema for PCAP-NG NRB unknown records.
- class pcapkit.protocols.schema.misc.pcapng.EndRecord(*args: _VT, **kwargs: _VT)[source]¶
Bases:
NameResolutionRecordHeader schema for PCAP-NG
nrb_record_endrecords.
- class pcapkit.protocols.schema.misc.pcapng.IPv4Record(*args: _VT, **kwargs: _VT)[source]¶
Bases:
NameResolutionRecordHeader schema for PCAP-NG NRB
nrb_record_ipv4records.- ip: IPv4Address = <IPv4AddressField ip>¶
IPv4 address.
- class pcapkit.protocols.schema.misc.pcapng.IPv6Record(*args: _VT, **kwargs: _VT)[source]¶
Bases:
NameResolutionRecordHeader schema for PCAP-NG NRB
nrb_record_ipv6records.- ip: IPv6Address = <IPv6AddressField ip>¶
IPv6 address.
- class pcapkit.protocols.schema.misc.pcapng.DSBSecrets(dict_=None, **kwargs)[source]¶
Bases:
EnumSchema[SecretsType]Header schema for DSB secrets data.
- class pcapkit.protocols.schema.misc.pcapng.UnknownSecrets(*args: _VT, **kwargs: _VT)[source]¶
Bases:
DSBSecretsHeader schema for unknown DSB secrets data.
- class pcapkit.protocols.schema.misc.pcapng.TLSKeyLog(*args: _VT, **kwargs: _VT)[source]¶
Bases:
DSBSecretsHeader schema for TLS Key Log secrets data.
- entries: dict[TLSKeyLabel, OrderedMultiDict[bytes, bytes]]¶
TLS Key Log entries.
- class pcapkit.protocols.schema.misc.pcapng.WireGuardKeyLog(*args: _VT, **kwargs: _VT)[source]¶
Bases:
DSBSecretsHeader schema for WireGuard Key Log secrets data.
- entries: OrderedMultiDict[WireGuardKeyLabel, bytes]¶
WireGuard Key Log entries.
- class pcapkit.protocols.schema.misc.pcapng.ZigBeeNWKKey(*args: _VT, **kwargs: _VT)[source]¶
Bases:
DSBSecretsHeader schema for ZigBee NWK Key and ZigBee PANID secrets data.
- class pcapkit.protocols.schema.misc.pcapng.ZigBeeAPSKey(*args: _VT, **kwargs: _VT)[source]¶
Bases:
DSBSecretsHeader schema for ZigBee APS Key secrets data.
Type Stubs¶
- class pcapkit.protocols.schema.misc.pcapng.ByteorderTest[source]¶
Bases:
TypedDictTest for byteorder.
- class pcapkit.protocols.schema.misc.pcapng.ResolutionData[source]¶
Bases:
TypedDictData for resolution.
- class pcapkit.protocols.schema.misc.pcapng.EPBFlags[source]¶
Bases:
TypedDictEPB flags.
- direction: int¶
Inbound / Outbound packet (
00= information not available,01= inbound,10= outbound)
- reception: int¶
Reception type (
000= not specified,001= unicast,010= multicast,011= broadcast,100= promiscuous).
- class pcapkit.protocols.schema.misc.pcapng.PACKFlags[source]¶
Bases:
TypedDictPACK flags.
- direction: int¶
Inbound / Outbound packet (
00= information not available,01= inbound,10= outbound)
- reception: int¶
Reception type (
000= not specified,001= unicast,010= multicast,011= broadcast,100= promiscuous).
Auxiliary Functions¶
- pcapkit.protocols.schema.misc.pcapng.byteorder_callback(field, packet)[source]¶
Update byte order of PCAP-NG file.
- Parameters:
field (
NumberField) – Field instance.
- pcapkit.protocols.schema.misc.pcapng.shb_byteorder_callback(field, packet)[source]¶
Update byte order of PCAP-NG file for SHB.
A Section Header Block declares the byte order of its own section through its Byte-Order Magic, so it cannot take one from the enclosing packet data: the first SHB of a file has no section context by construction, and a later one would otherwise inherit the previous section’s byte order. The magic is therefore also written back as
packet['byteorder'], which is what the SHB’s own options – read bybyteorder_callback(), after this field – resolve their byte order from.- Parameters:
field (
NumberField) – Field instance.
- pcapkit.protocols.schema.misc.pcapng.pcapng_block_selector(packet)[source]¶
Selector function for
PCAPNG.blockfield.- Parameters:
- Return type:
- Returns:
Returns a
SchemaFieldwrappedBlockTypesubclass instance.
Note
__length__is what is left of the stream, not what the block declares, and it is decremented by four forPCAPNG.typewhether or not those four octets were there to read –FieldBase.unpackzero-pads a short read rather than refusing it. A tail of one, two or three octets therefore arrived here negative andio.RawIOBase.read()raised a bareValueError, which is #678. The floor is a backstop:PCAPNG._check_block_floorreports that tail as end-of-stream before it gets here, and on the packing pathSchema.packseeds__length__as-1for “unknown”, whichSchemaField.packdoes not read at all.
- pcapkit.protocols.schema.misc.pcapng.dsb_secrets_selector(packet)[source]¶
Selector function for
DecryptionSecretsBlock.secrets_datafield.- Parameters:
- Return type:
- Returns:
If
secrets_typeis unknown, returns aBytesFieldinstance.If
secret_typeisTLS_Key_Logand/orWireGuard_Key_Log, returns aStringFieldinstance.Otherwise, returns a
SchemaFieldwrappedDSBSecretssubclass instance.
Data Models¶
- class pcapkit.protocols.data.misc.pcapng.PCAPNG(dict_=None, **kwargs)[source]¶
Bases:
ProtocolData model for PCAP-NG file blocks.
- class pcapkit.protocols.data.misc.pcapng.UnknownBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for unknown PCAP-NG file blocks.
- class pcapkit.protocols.data.misc.pcapng.SectionHeaderBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Section Header Block (SHB).
- version: VersionInfo¶
Version number.
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.InterfaceDescriptionBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Interface Description Block (IDB).
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.EnhancedPacketBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Enhanced Packet Block (EPB).
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.SimplePacketBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Simple Packet Block (SPB).
- class pcapkit.protocols.data.misc.pcapng.NameResolutionBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Name Resolution Block (NRB).
- records: OrderedMultiDict[RecordType, NameResolutionRecord]¶
Records.
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- mapping: MultiDict[IPv4Address | IPv6Address, str]¶
Name resolution mapping (IP address -> name).
- reverse_mapping: MultiDict[str, IPv4Address | IPv6Address]¶
Name resolution mapping (name -> IP address).
- class pcapkit.protocols.data.misc.pcapng.InterfaceStatisticsBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Interface Statistics Block (ISB).
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.SystemdJournalExportBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG systemd(1) Journal Export Block.
- class pcapkit.protocols.data.misc.pcapng.DecryptionSecretsBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Decryption Secrets Block (DSB).
- secrets_type: SecretsType¶
Secrets type.
- secrets_data: DSBSecrets¶
Secrets data.
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.CustomBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Custom Block (CB).
- class pcapkit.protocols.data.misc.pcapng.PacketBlock(*args: VT, **kwargs: VT)[source]¶
Bases:
PCAPNGData model for PCAP-NG Packet Block (obsolete).
- options: OrderedMultiDict[OptionType, Option]¶
Options.
- class pcapkit.protocols.data.misc.pcapng.Option(dict_=None, **kwargs)[source]¶
Bases:
DataData model for PCAP-NG file options.
- type: OptionType¶
Option type.
- class pcapkit.protocols.data.misc.pcapng.UnknownOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for unknown PCAP-NG file options.
- class pcapkit.protocols.data.misc.pcapng.EndOfOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
opt_endofoptoptions.
- class pcapkit.protocols.data.misc.pcapng.CommentOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
opt_commentoptions.
- class pcapkit.protocols.data.misc.pcapng.CustomOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
opt_customoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_NameOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_nameoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_DescriptionOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_descriptionoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_IPv4AddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_IPv4addroptions.- interface: IPv4Interface¶
IPv4 interface.
- class pcapkit.protocols.data.misc.pcapng.IF_IPv6AddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_IPv6addroptions.- interface: IPv6Interface¶
IPv6 interface.
- class pcapkit.protocols.data.misc.pcapng.IF_MACAddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_MACaddroptions.
- class pcapkit.protocols.data.misc.pcapng.IF_EUIAddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_EUIaddroptions.
- class pcapkit.protocols.data.misc.pcapng.IF_SpeedOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_speedoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_TSResolOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_tsresoloptions.
- class pcapkit.protocols.data.misc.pcapng.IF_TZoneOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_tzoneoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_FilterOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_filteroptions.- code: FilterType¶
Filter code.
- class pcapkit.protocols.data.misc.pcapng.IF_OSOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_osoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_FCSLenOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_fcslenoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_TSOffsetOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_tsoffsetoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_HardwareOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_hardwareoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_TxSpeedOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_txspeedoptions.
- class pcapkit.protocols.data.misc.pcapng.IF_RxSpeedOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
if_rxspeedoptions.
- class pcapkit.protocols.data.misc.pcapng.EPB_FlagsOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
epb_flagsoptions.- direction: PacketDirection¶
Inbound / Outbound packet.
- reception: PacketReception¶
Reception type.
- class pcapkit.protocols.data.misc.pcapng.EPB_HashOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
epb_hashoptions.- algorithm: HashAlgorithm¶
Hash algorithm.
- class pcapkit.protocols.data.misc.pcapng.EPB_DropCountOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
epb_dropcountoptions.
- class pcapkit.protocols.data.misc.pcapng.EPB_PacketIDOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
epb_packetidoptions.
- class pcapkit.protocols.data.misc.pcapng.EPB_QueueOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
epb_queueoptions.
- class pcapkit.protocols.data.misc.pcapng.EPB_VerdictOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
epb_verdictoptions.- verdict: VerdictType¶
Verdict type.
- class pcapkit.protocols.data.misc.pcapng.NS_DNSNameOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
ns_dnsnameoption.
- class pcapkit.protocols.data.misc.pcapng.NS_DNSIP4AddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
ns_dnsip4addroption.- ip: IPv4Address¶
IPv4 address.
- class pcapkit.protocols.data.misc.pcapng.NS_DNSIP6AddrOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
ns_dnsip6addroption.- ip: IPv6Address¶
IPv6 address.
- class pcapkit.protocols.data.misc.pcapng.ISB_StartTimeOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_starttimeoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_EndTimeOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_endtimeoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_IFRecvOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_ifrecvoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_IFDropOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_ifdropoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_FilterAcceptOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_filteracceptoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_OSDropOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_osdropoption.
- class pcapkit.protocols.data.misc.pcapng.ISB_UsrDelivOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
isb_usrdelivoption.
- class pcapkit.protocols.data.misc.pcapng.PACK_FlagsOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG file
pack_flagsoptions.- direction: PacketDirection¶
Inbound / Outbound packet.
- reception: PacketReception¶
Reception type.
- class pcapkit.protocols.data.misc.pcapng.PACK_HashOption(*args: VT, **kwargs: VT)[source]¶
Bases:
OptionData model for PCAP-NG
pack_hashoptions.- algorithm: HashAlgorithm¶
Hash algorithm.
- class pcapkit.protocols.data.misc.pcapng.NameResolutionRecord(dict_=None, **kwargs)[source]¶
Bases:
DataData model for PCAP-NG NRB records.
- type: RecordType¶
Record type.
- class pcapkit.protocols.data.misc.pcapng.UnknownRecord(*args: VT, **kwargs: VT)[source]¶
Bases:
NameResolutionRecordData model for PCAP-NG NRB unknown records.
- class pcapkit.protocols.data.misc.pcapng.EndRecord(*args: VT, **kwargs: VT)[source]¶
Bases:
NameResolutionRecordData model for PCAP-NG
nrb_record_endrecords.
- class pcapkit.protocols.data.misc.pcapng.IPv4Record(*args: VT, **kwargs: VT)[source]¶
Bases:
NameResolutionRecordData model for PCAP-NG
nrb_record_ipv4records.- ip: IPv4Address¶
IPv4 address.
- class pcapkit.protocols.data.misc.pcapng.IPv6Record(*args: VT, **kwargs: VT)[source]¶
Bases:
NameResolutionRecordData model for PCAP-NG
nrb_record_ipv6records.- ip: IPv6Address¶
IPv6 address.
- class pcapkit.protocols.data.misc.pcapng.DSBSecrets(dict_=None, **kwargs)[source]¶
Bases:
DataData model for DSB secrets data.
- class pcapkit.protocols.data.misc.pcapng.UnknownSecrets(*args: VT, **kwargs: VT)[source]¶
Bases:
DSBSecretsData model for unknown DSB secrets.
- class pcapkit.protocols.data.misc.pcapng.TLSKeyLog(*args: VT, **kwargs: VT)[source]¶
Bases:
DSBSecretsData model for TLS key log DSB secrets.
- entries: dict[TLSKeyLabel, OrderedMultiDict[bytes, bytes]]¶
TLS key log entries.
- class pcapkit.protocols.data.misc.pcapng.WireGuardKeyLog(*args: VT, **kwargs: VT)[source]¶
Bases:
DSBSecretsData model for WireGuard key DSB secrets.
- entries: OrderedMultiDict[WireGuardKeyLabel, bytes]¶
WireGuard Key Log entries.
- class pcapkit.protocols.data.misc.pcapng.ZigBeeNWKKey(*args: VT, **kwargs: VT)[source]¶
Bases:
DSBSecretsData model for ZigBEE NWK Key and ZigBee PANID secrets data.
- class pcapkit.protocols.data.misc.pcapng.ZigBeeAPSKey(*args: VT, **kwargs: VT)[source]¶
Bases:
DSBSecretsData model for ZigBEE APS Key secrets data.
Footnotes