TCP - Transmission Control Protocol

pcapkit.protocols.transport.tcp contains TCP only, which implements extractor for Transmission Control Protocol (TCP) [*], whose structure is described as below:

Octets

Bits

Name

Description

0

0

tcp.srcport

Source Port

2

16

tcp.dstport

Destination Port

4

32

tcp.seq

Sequence Number

8

64

tcp.ack

Acknowledgement Number (if ACK set)

12

96

tcp.hdr_len

Data Offset

12

100

Reserved (must be \x00)

12

103

tcp.flags.ns

ECN Concealment Protection (NS) [†]

13

104

tcp.flags.cwr

Congestion Window Reduced (CWR)

13

105

tcp.flags.ece

ECN-Echo (ECE)

13

106

tcp.flags.urg

Urgent (URG)

13

107

tcp.flags.ack

Acknowledgement (ACK)

13

108

tcp.flags.psh

Push Function (PSH)

13

109

tcp.flags.rst

Reset Connection (RST)

13

110

tcp.flags.syn

Synchronize Sequence Numbers (SYN)

13

111

tcp.flags.fin

Last Packet from Sender (FIN)

14

112

tcp.window_size

Size of Receive Window

16

128

tcp.checksum

Checksum

18

144

tcp.urgent_pointer

Urgent Pointer (if URG set)

20

160

tcp.options

TCP Options (if data offset > 5)

class pcapkit.protocols.transport.tcp.TCP(file=None, length=None, **kwargs)[source]

Bases: Transport[TCP, TCP]

This class implements Transmission Control Protocol.

This class currently supports parsing of the following protocols, which are registered in the self.__proto__ attribute:

This class currently supports parsing of the following TCP options, which are directly mapped to the pcapkit.const.tcp.option.Option enumeration:

This class currently supports parsing of the following Multipath TCP options, which are directly mapped to the pcapkit.const.tcp.mp_tcp_option.MPTCPOption enumeration:

property name: Literal['Transmission Control Protocol']

Name of current protocol.

property length: int

Header length of current protocol.

property src: AppType

Source port.

property dst: AppType

Destination port.

property connection: Flags

Connection flags.

classmethod register_option(code, meth)[source]

Register an option parser.

Parameters:
classmethod register_mp_option(code, meth)[source]

Register an MPTCP option parser.

Parameters:
read(length=None, **kwargs)[source]

Read Transmission Control Protocol (TCP).

Structure of TCP header [RFC 793]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Acknowledgement Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |           |U|A|P|R|S|F|                               |
| Offset| Reserved  |R|C|S|S|Y|I|            Window             |
|       |           |G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
  • length (int | None) – Length of packet data.

  • **kwargs (Any) – Arbitrary keyword arguments.

Return type:

TCP

Returns:

Parsed packet data.

make(srcport=0, dstport=0, seq_no=0, ack_no=0, ns=False, cwr=False, ece=False, urg=False, ack=False, psh=False, rst=False, syn=False, fin=False, window=65535, checksum=b'\\x00\\x00', urgent=0, options=None, payload=b'', **kwargs)[source]

Make (construct) packet data.

Parameters:
Return type:

TCP

Returns:

Constructed packet data.

classmethod _make_data(data)[source]

Create key-value pairs from data for protocol construction.

Parameters:

data (TCP) – protocol data

Return type:

dict[str, Any]

Returns:

Key-value pairs for protocol construction.

_read_tcp_options(size)[source]

Read TCP option list.

Parameters:

size (int) – length of option list

Return type:

OrderedMultiDict[Option, Option]

Returns:

Extracted TCP options.

Raises:

ProtocolError – If the threshold is NOT matching.

_read_mode_donone(schema, *, options)[source]

Read options request no process.

Parameters:
Return type:

UnassignedOption

Returns:

Parsed option data.

_read_mode_eool(schema, *, options)[source]

Read TCP End of Option List option.

Structure of TCP end of option list option [RFC 793]:

+--------+
|00000000|
+--------+
 Kind=0
Parameters:
Return type:

EndOfOptionList

Returns:

Parsed option data.

_read_mode_nop(schema, *, options)[source]

Read TCP No Operation option.

Structure of TCP maximum segment size option [RFC 793]:

+--------+
|00000001|
+--------+
 Kind=1
Parameters:
Return type:

NoOperation

Returns:

Parsed option data.

_read_mode_mss(schema, *, options)[source]

Read TCP max segment size option.

Structure of TCP maximum segment size option [RFC 793]:

+--------+--------+---------+--------+
|00000010|00000100|   max seg size   |
+--------+--------+---------+--------+
 Kind=2   Length=4
Parameters:
Return type:

MaximumSegmentSize

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_mode_ws(schema, *, options)[source]

Read TCP windows scale option.

Structure of TCP window scale option [RFC 7323]:

+---------+---------+---------+
| Kind=3  |Length=3 |shift.cnt|
+---------+---------+---------+
     1         1         1
Parameters:
Return type:

WindowScale

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 3.

_read_mode_sackpmt(schema, *, options)[source]

Read TCP SACK permitted option.

Structure of TCP SACK permitted option [RFC 2018]:

+---------+---------+
| Kind=4  | Length=2|
+---------+---------+
Parameters:
Return type:

SACKPermitted

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 2.

_read_mode_sack(schema, *, options)[source]

Read TCP SACK option.

Structure of TCP SACK option [RFC 2018]:

                  +--------+--------+
                  | Kind=5 | Length |
+--------+--------+--------+--------+
|      Left Edge of 1st Block       |
+--------+--------+--------+--------+
|      Right Edge of 1st Block      |
+--------+--------+--------+--------+
|                                   |
/            . . .                  /
|                                   |
+--------+--------+--------+--------+
|      Left Edge of nth Block       |
+--------+--------+--------+--------+
|      Right Edge of nth Block      |
+--------+--------+--------+--------+
Parameters:
Return type:

SACK

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT multiply of 8 plus 2.

_read_mode_echo(schema, *, options)[source]

Read TCP echo option.

Structure of TCP echo option [RFC 1072]:

+--------+--------+--------+--------+--------+--------+
| Kind=6 | Length |   4 bytes of info to be echoed    |
+--------+--------+--------+--------+--------+--------+
Parameters:
Return type:

Echo

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 6.

_read_mode_echore(schema, *, options)[source]

Read TCP echo reply option.

Structure of TCP echo reply option [RFC 1072]:

+--------+--------+--------+--------+--------+--------+
| Kind=7 | Length |    4 bytes of echoed info         |
+--------+--------+--------+--------+--------+--------+
Parameters:
Return type:

EchoReply

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 6.

_read_mode_ts(schema, *, options)[source]

Read TCP timestamps option.

Structure of TCP timestamp option [RFC 7323]:

+-------+-------+---------------------+---------------------+
|Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
+-------+-------+---------------------+---------------------+
    1       1              4                     4
Parameters:
Return type:

Timestamps

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 10.

_read_mode_poc(schema, *, options)[source]

Read TCP partial order connection service profile option.

Structure of TCP POC-Permitted option [RFC 1693][RFC 6247]:

+-----------+-------------+
|  Kind=9   |  Length=2   |
+-----------+-------------+
Parameters:
Return type:

PartialOrderConnectionPermitted

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 2.

_read_mode_pocsp(schema, *, options)[source]

Read TCP partial order connection service profile option.

Structure of TCP POC-SP option [RFC 1693][RFC 6247]:

                          1 bit        1 bit    6 bits
+----------+----------+------------+----------+--------+
|  Kind=10 | Length=3 | Start_flag | End_flag | Filler |
+----------+----------+------------+----------+--------+
Parameters:
Return type:

PartialOrderServiceProfile

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 3.

_read_mode_cc(schema, *, options)[source]

Read TCP connection count option.

Structure of TCP CC option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001011|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=11  Length=6
Parameters:
Return type:

CC

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 6.

_read_mode_ccnew(schema, *, options)[source]

Read TCP connection count (new) option.

Structure of TCP CC.NEW option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001100|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=12  Length=6
Parameters:
Return type:

CCNew

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 6.

_read_mode_ccecho(schema, *, options)[source]

Read TCP connection count (echo) option.

Structure of TCP CC.ECHO option [RFC 1644]:

+--------+--------+--------+--------+--------+--------+
|00001101|00000110|    Connection Count:  SEG.CC      |
+--------+--------+--------+--------+--------+--------+
 Kind=13  Length=6
Parameters:
Return type:

CCEcho

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 6.

_read_mode_chkreq(schema, *, options)[source]

Read TCP Alternate Checksum Request option.

Structure of TCP CHKSUM-REQ [RFC 1146][RFC 6247]:

+----------+----------+----------+
|  Kind=14 | Length=3 |  chksum  |
+----------+----------+----------+
Parameters:
Return type:

AlternateChecksumRequest

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 3.

_read_mode_chksum(schema, *, options)[source]

Read Alternate Checksum Data option.

Structure of TCP CHKSUM [RFC 1146][RFC 6247]:

+---------+---------+---------+     +---------+
| Kind=15 |Length=N |  data   | ... |  data   |
+---------+---------+---------+     +---------+
Parameters:
Return type:

AlternateChecksumData

Returns:

Parsed option data.

_read_mode_sig(schema, *, options)[source]

Read MD5 Signature option.

Structure of TCP SIG option [RFC 2385]:

+---------+---------+-------------------+
| Kind=19 |Length=18|   MD5 digest...   |
+---------+---------+-------------------+
|                                       |
+---------------------------------------+
|                                       |
+---------------------------------------+
|                                       |
+-------------------+-------------------+
|                   |
+-------------------+
Parameters:
Return type:

MD5Signature

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 18.

_read_mode_qs(schema, *, options)[source]

Read Quick-Start Response option.

Structure of TCP QSopt [RFC 4782]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Kind      |  Length=8     | Resv. | Rate  |   TTL Diff    |
|               |               |       |Request|               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   QS Nonce                                | R |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
Return type:

QuickStartResponse

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 8.

_read_mode_timeout(schema, *, options)[source]

Read User Timeout option.

Structure of TCP TIMEOUT [RFC 5482]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Kind = 28   |   Length = 4  |G|        User Timeout         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
Return type:

UserTimeout

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 4.

_read_mode_ao(schema, *, options)[source]

Read Authentication option.

Structure of TCP AOopt [RFC 5925]:

+------------+------------+------------+------------+
|  Kind=29   |   Length   |   KeyID    | RNextKeyID |
+------------+------------+------------+------------+
|                     MAC           ...
+-----------------------------------...

...-----------------+
...  MAC (con't)    |
...-----------------+
Parameters:
Return type:

Authentication

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT larger than or equal to 4.

_read_mode_mp(schema, *, options)[source]

Read Multipath TCP option.

Structure of MP-TCP [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|                       |
+---------------+---------------+-------+                       |
|                     Subtype-specific data                     |
|                       (variable length)                       |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCP

Returns:

Parsed option data.

_read_mode_fastopen(schema, *, options)[source]

Read Fast Open option.

Structure of TCP FASTOPEN [RFC 7413]:

                                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                |      Kind     |    Length     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
~                            Cookie                             ~
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:
Return type:

FastOpenCookie

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT valid.

_read_mptcp_unknown(schema, *, options)[source]

Read unknown MPTCP subtype.

Parameters:
Return type:

MPTCPUnknown

Returns:

Parsed option data.

_read_mptcp_capable(schema, *, options)[source]

Read Multipath Capable option.

Structure of MP_CAPABLE [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |    Length     |Subtype|Version|A|B|C|D|E|F|G|H|
+---------------+---------------+-------+-------+---------------+
|                   Option Sender's Key (64 bits)               |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
|                  Option Receiver's Key (64 bits)              |
|                     (if option Length == 20)                  |
|                                                               |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCPCapable

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 12 or 20.

_read_mptcp_join(schema, *, options)[source]

Read Join Connection option.

Parameters:
Return type:

MPTCPJoin

Returns:

Parsed option data.

Raises:

ProtocolError – If the option is not given on a valid SYN/ACK packet.

_read_mptcp_dss(schema, *, options)[source]

Read Data Sequence Signal (Data ACK and Data Sequence Mapping) option.

Structure of DSS [RFC 8684, section 3.3, figure 9]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |    Length     |Subtype| (reserved) |F|m|M|a|A|
+---------------+---------------+-------+----------------------+
|                                                              |
|           Data ACK (4 or 8 octets, depending on flags)       |
|                                                              |
+--------------------------------------------------------------+
|                                                              |
|   Data sequence number (4 or 8 octets, depending on flags)   |
|                                                              |
+--------------------------------------------------------------+
|              Subflow Sequence Number (4 octets)              |
+-------------------------------+------------------------------+
|  Data-Level Length (2 octets) |      Checksum (2 octets)     |
+-------------------------------+------------------------------+
Parameters:
Return type:

MPTCPDSS

Returns:

Parsed option data.

_read_mptcp_addaddr(schema, *, options)[source]

Read Add Address option.

Structure of ADD_ADDR [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |     Length    |Subtype| IPVer |  Address ID   |
+---------------+---------------+-------+-------+---------------+
|          Address (TCP - 4 octets / IPv6 - 16 octets)         |
+-------------------------------+-------------------------------+
|   Port (2 octets, optional)   |
+-------------------------------+
Parameters:
Return type:

MPTCPAddAddress

Returns:

Parsed option data.

Raises:

ProtocolError – Invalid IP version and/or addresses.

_read_mptcp_remove(schema, *, options)[source]

Read Remove Address option.

Structure of REMOVE_ADDR [RFC 8684, section 3.4.2, figure 13]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-------+---------------+
|     Kind      |  Length = 3+n |Subtype|(resvd)|   Address ID  | ...
+---------------+---------------+-------+-------+---------------+
                           (followed by n-1 Address IDs, if required)
Parameters:
Return type:

MPTCPRemoveAddress

Returns:

Parsed option data.

Raises:

ProtocolError – If the length is smaller than 3.

Note

Length = 3 + n, per the figure above: the 3 is Kind (1) + Length (1) + subtype-and-reserved (1), and each of the n Address IDs is one further octet. addr_id sizes its list as pkt['length'] - 3 from exactly this, which is why _make_mptcp_remove’s constant length=4 (fixed in #576) also mis-sized the parse rather than only the pack.

The guard permits 3, i.e. n = 0, which the figure does not describe – it shows one Address ID plus “n-1 Address IDs, if required”. Left as it stands: tightening it to reject an empty list is a behaviour change beyond #576’s scope, and a zero-ID REMOVE_ADDR now at least round-trips honestly instead of declaring an octet it never packed.

_read_mptcp_prio(schema, *, options)[source]

Read Change Subflow Priority option.

Structure of MP_PRIO [RFC 6824, section 3.3.8, figure 11]:

                      1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+--------------+
|     Kind      |     Length    |Subtype|     |B| AddrID (opt) |
+---------------+---------------+-------+-----+-+--------------+
Parameters:
Return type:

MPTCPPriority

Returns:

Parsed option data.

Raises:

ProtocolError – If the length is neither 3 nor 4.

Note

The figure above is RFC 6824’s, deliberately, because it is the one with an Address ID in it and this method accepts both forms. RFC 8684 section 3.3.8 figure 11 draws MP_PRIO as 3 octets and nothing more – Kind (1) + Length (1) + subtype/reserved/B (1) – since section 5 of that document “specifies the removal of the AddrID field [RFC6824] in the MP_PRIO option”, closing a theoretical attack in which a subflow could be forced into backup mode. The 4-octet RFC 6824 form is therefore legacy, and the guard stays permissive so that traffic carrying it still parses.

_make_mptcp_prio declared a constant length=4 until #576, which meant the construction side could only ever emit the legacy form – and emitted it with an all-zero phantom Address ID when the caller supplied none, because MPTCPPriority’s addr_id is conditional on that very length being 4.

_read_mptcp_fail(schema, *, options)[source]

Read Fallback option.

Structure of MP_FAIL [RFC 6824]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+----------------------+
|     Kind      |   Length=12   |Subtype|      (reserved)      |
+---------------+---------------+-------+----------------------+
|                                                              |
|                 Data Sequence Number (8 octets)              |
|                                                              |
+--------------------------------------------------------------+
Parameters:
Return type:

MPTCPFallback

Returns:

Parsed option data.

Raises:

ProtocolError – If the length is NOT 12.

_read_mptcp_fastclose(schema, options)[source]

Read Fast Close option.

Structure of MP_FASTCLOSE [RFC 8684, section 3.5, figure 14]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |    Length     |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                      Option Receiver's Key                    |
|                            (64 bits)                          |
|                                                               |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCPFastclose

Returns:

Parsed option data.

Raises:

ProtocolError – If the length is NOT 12.

Note

The figure above is RFC 8684 section 3.5 figure 14, and the option it draws is 12 octets: Kind (1) + Length (1) + subtype-and-reserved (2, being 4 subtype bits and 12 reserved) + the option receiver’s key (64 bits, 8). Note that section 3.5 is Fast Close; section 3.7 is Fallback (MP_FAIL), which #576’s own text cited here by mistake.

Three sites disagreed on this number before #576, all three now reading 12: this guard required 16, an octet count nothing in the RFC produces for MP_FASTCLOSE; _make_mptcp_fastclose declared the correct 12 but the schema packed only 11, missing the reserved octet entirely. The net effect was that constructing an MP_FASTCLOSE through TCP raised ProtocolError from this very guard – the maker’s correct length failing the parser’s wrong check – which is why tcp-mptcp/MP_FASTCLOSE sat in EXPECTED_FAILURES.

_read_join_syn(schema, *, options)[source]

Read Join Connection option for Initial SYN.

Structure of MP_JOIN-SYN [RFC 8684, section 3.2, figure 5]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 12  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                   Receiver's Token (32 bits)                  |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCPJoinSYN

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 12.

_read_join_synack(schema, options)[source]

Read Join Connection option for Responding SYN/ACK.

Structure of MP_JOIN-SYN/ACK [RFC 8684, section 3.2, figure 6]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----+-+---------------+
|     Kind      |  Length = 16  |Subtype|     |B|   Address ID  |
+---------------+---------------+-------+-----+-+---------------+
|                                                               |
|                Sender's Truncated HMAC (64 bits)              |
|                                                               |
+---------------------------------------------------------------+
|                Sender's Random Number (32 bits)               |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCPJoinSYNACK

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 16.

Note

The accepted length is 16, which is what the figure above – and RFC 8684 section 3.2 figure 6, which it reproduces – states, and what MPTCPJoinSYNACK actually packs and unpacks: Kind (1) + Length (1) + subtype/flags (1) + Address ID (1) + the truncated HMAC (8) + the random number (4).

This guard required 20 until #576 – a value that appears in neither the figure nor the schema, and that contradicted this method’s own docstring. Together with _make_join_synack’s length=12 it made the SYN/ACK form unusable in both directions at once: the maker could not produce a length this guard accepted, and a spec-correct 16-octet option off the wire was rejected as an invalid format.

_read_join_ack(schema, *, options)[source]

Read Join Connection option for Third ACK.

Structure of MP_JOIN-ACK [RFC 8684, section 3.2, figure 7]:

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+-------+-----------------------+
|     Kind      |  Length = 24  |Subtype|      (reserved)       |
+---------------+---------------+-------+-----------------------+
|                                                               |
|                                                               |
|                   Sender's HMAC (160 bits)                    |
|                                                               |
|                                                               |
+---------------------------------------------------------------+
Parameters:
Return type:

MPTCPJoinACK

Returns:

Parsed option data.

Raises:

ProtocolError – If length is NOT 24.

_make_tcp_options(options)[source]

Make options for TCP.

Parameters:

options (list[Option | tuple[Option, dict[str, Any]] | bytes] | OrderedMultiDict[Option, Option]) – TCP options

Return type:

tuple[list[Option | bytes], int]

Returns:

Tuple of options and total length of options.

_make_mode_donone(code, opt=None, *, data=b'', **kwargs)[source]

Make TCP unassigned option.

Parameters:
Return type:

UnassignedOption

Returns:

Constructed option schema.

_make_mode_eool(code, opt=None, **kwargs)[source]

Make TCP End of Option List option.

Parameters:
Return type:

EndOfOptionList

Returns:

Constructed option schema.

_make_mode_nop(code, opt=None, **kwargs)[source]

Make TCP NoOperation option.

Parameters:
Return type:

NoOperation

Returns:

Constructed option schema.

_make_mode_mss(code, opt=None, *, mss=65535, **kwargs)[source]

Make TCP maximum segment size option.

Parameters:
Return type:

MaximumSegmentSize

Returns:

Constructed option schema.

_make_mode_ws(code, opt=None, *, shift=0, **kwargs)[source]

Make TCP window scale option.

Parameters:
  • code (Option) – option code

  • opt (WindowScale | None) – option data

  • shift (int) – window scale shift count

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

WindowScale

Returns:

Constructed option schema.

_make_mode_sackpmt(code, opt=None, **kwargs)[source]

Make TCP SACK permitted option.

Parameters:
Return type:

SACKPermitted

Returns:

Constructed option schema.

_make_mode_sack(code, opt=None, *, sack=None, **kwargs)[source]

Make TCP SACK option.

Parameters:
Return type:

SACK

Returns:

Constructed option schema.

_make_mode_echo(code, opt=None, *, data=b'\\x00\\x00\\x00\\x00', **kwargs)[source]

Make TCP echo option.

Parameters:
  • code (Option) – option code

  • opt (Echo | None) – option data

  • data (bytes) – 4 bytes of info to be echoed

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

Echo

Returns:

Constructed option schema.

_make_mode_echore(code, opt=None, *, data=b'\\x00\\x00\\x00\\x00', **kwargs)[source]

Make TCP echo reply option.

Parameters:
  • code (Option) – option code

  • opt (EchoReply | None) – option data

  • data (bytes) – 4 bytes of echoed info

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

EchoReply

Returns:

Constructed option schema.

_make_mode_ts(code, opt=None, *, tsval=0, tsecr=0, **kwargs)[source]

Make TCP timestamps option.

Parameters:
  • code (Option) – option code

  • opt (Timestamps | None) – option data

  • tsval (int) – timestamp value

  • tsecr (int) – timestamp echo reply

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

Timestamps

Returns:

Constructed option schema.

_make_mode_poc(code, opt=None, **kwargs)[source]

Make TCP partial order connection option.

Parameters:
Return type:

PartialOrderConnectionPermitted

Returns:

Constructed option schema.

_make_mode_pocsp(code, opt=None, *, start=False, end=False, **kwargs)[source]

Make TCP partial order connection service profile option.

Parameters:
Return type:

PartialOrderServiceProfile

Returns:

Constructed option schema.

_make_mode_cc(code, opt=None, *, count=0, **kwargs)[source]

Make TCP connection count option.

Parameters:
  • code (Option) – option code

  • opt (CC | None) – option data

  • count (int) – connection count

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

CC

Returns:

Constructed option schema.

_make_mode_ccnew(code, opt=None, *, count=0, **kwargs)[source]

Make TCP connection count new option.

Parameters:
  • code (Option) – option code

  • opt (CCNew | None) – option data

  • count (int) – connection count

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

CCNew

Returns:

Constructed option schema.

_make_mode_ccecho(code, opt=None, *, count=0, **kwargs)[source]

Make TCP connection count echo option.

Parameters:
  • code (Option) – option code

  • opt (CCEcho | None) – option data

  • count (int) – connection count

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

CCEcho

Returns:

Constructed option schema.

_make_mode_chkreq(code, opt=None, *, algorithm=<Checksum.TCP_checksum: 0>, algorithm_default=None, algorithm_namespace=None, algorithm_reversed=False, **kwargs)[source]

Make TCP alternate checksum request option.

Parameters:
Return type:

AlternateChecksumRequest

Returns:

Constructed option schema.

_make_mode_chksum(code, opt=None, *, data=b'', **kwargs)[source]

Make TCP alternate checksum data option.

Parameters:
Return type:

AlternateChecksumData

Returns:

Constructed option schema.

_make_mode_sig(code, opt=None, *, digest=b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', **kwargs)[source]

Make TCP MD5 signature option.

Parameters:
Return type:

MD5Signature

Returns:

Constructed option schema.

_make_mode_qs(code, opt=None, *, rate=0, diff=0, nonce=0, **kwargs)[source]

Make TCP quick start response option.

Parameters:
  • code (Option) – option code

  • opt (QuickStartResponse | None) – option data

  • rate (int) – rate (in kbps)

  • diff (timedelta | int) – time to live (in seconds) difference

  • nonce (int) – nonce value

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

QuickStartResponse

Returns:

Constructed option schema.

_make_mode_timeout(code, opt=None, *, timeout=0, **kwargs)[source]

Make TCP user timeout option.

Parameters:
Return type:

UserTimeout

Returns:

Constructed option schema.

_make_mode_ao(code, opt=None, *, key_id=0, next_key_id=0, mac=b'', **kwargs)[source]

Make TCP authentication option.

Parameters:
  • code (Option) – option code

  • opt (Authentication | None) – option data

  • key_id (int) – key ID

  • next_key_id (int) – next key ID

  • mac (bytes) – MAC value

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

Authentication

Returns:

Constructed option schema.

_make_mode_mp(code, opt=None, *, subtype=<MPTCPOption.MP_CAPABLE: 0>, subtype_default=None, subtype_namespace=None, subtype_reversed=False, **kwargs)[source]

Make multipath TCP option.

Parameters:
Return type:

MPTCP

Returns:

Constructed option schema.

_make_mode_fastopen(code, opt=None, *, cookie=None, **kwargs)[source]

Make TCP Fast Open option.

Parameters:
Return type:

FastOpenCookie

Returns:

Constructed option schema.

_make_mptcp_unknown(subtype, opt=None, *, data=b'\\x00', **kwargs)[source]

Make unknown multipath TCP option.

Parameters:
Return type:

MPTCPUnknown

Returns:

Constructed option schema.

_make_mptcp_capable(subtype, opt=None, *, version=0, flag_req=False, flag_ext=False, flag_hsa=False, skey=0, rkey=0, **kwargs)[source]

Make multipath TCP capable option.

Parameters:
  • subtype (MPTCPOption) – MPTCP subtype

  • opt (MPTCPCapable | None) – option data

  • version (int) – MPTCP version

  • flag_req (bool) – checksum required flag

  • flag_ext (bool) – extensability flag

  • flag_hsa (bool) – use of HMAC-SHA1 flag

  • skey (int) – option sender’s key

  • rkey (int | None) – option receiver’s key

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

MPTCPCapable

Returns:

Constructed option schema.

_make_mptcp_join(subtype, opt=None, **kwargs)[source]

Make multipath TCP join option.

Parameters:
Return type:

MPTCPJoin

Returns:

Constructed option schema.

_make_mptcp_dss(subtype, opt=None, *, data_fin=False, ack=None, dsn=None, ssn=None, dl_len=None, checksum=None, **kwargs)[source]

Make multipath TCP DSS option.

Parameters:
  • subtype (MPTCPOption) – MPTCP subtype

  • opt (MPTCPDSS | None) – option data

  • data_fin (bool) – DATA_FIN flag

  • ack (int | None) – Data ACK

  • dsn (int | None) – data sequence number

  • ssn (int | None) – subflow sequence number

  • dl_len (int | None) – data-level length

  • checksum (bytes | None) – checksum

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

MPTCPDSS

Returns:

Constructed option schema.

_make_mptcp_addaddr(subtype, opt=None, *, addr_id=0, addr='0.0.0.0', port=None, **kwargs)[source]

Make multipath TCP add address option.

Parameters:
Return type:

MPTCPAddAddress

Returns:

Constructed option schema.

_make_mptcp_remove(subtype, opt=None, *, addr_id=None, **kwargs)[source]

Make multipath TCP remove address option.

Parameters:
Return type:

MPTCPRemoveAddress

Returns:

Constructed option schema.

_make_mptcp_prio(subtype, opt=None, *, backup=False, addr_id=None, **kwargs)[source]

Make multipath TCP priority option.

Parameters:
Return type:

MPTCPPriority

Returns:

Constructed option schema.

_make_mptcp_fail(subtype, opt=None, *, dsn=0, **kwargs)[source]

Make multipath TCP fail option.

Parameters:
Return type:

MPTCPFallback

Returns:

Constructed option schema.

_make_mptcp_fastclose(subtype, opt=None, *, key=0, **kwargs)[source]

Make multipath TCP fastclose option.

Parameters:
Return type:

MPTCPFastclose

Returns:

Constructed option schema.

_make_join_syn(subtype, opt=None, *, backup=False, addr_id=0, token=0, nonce=0, **kwargs)[source]

Make multipath TCP join SYN option.

Parameters:
  • subtype (MPTCPOption) – MPTCP subtype

  • opt (MPTCPJoinSYN | None) – option data

  • backup (bool) – backup flag

  • addr_id (int) – address ID

  • token (int) – receiver’s token

  • nonce (int) – sender’s random number

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

MPTCPJoinSYN

Returns:

Constructed option schema.

_make_join_synack(subtype, opt=None, *, backup=False, addr_id=0, hmac=b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', nonce=0, **kwargs)[source]

Make multipath TCP join SYN/ACK option.

Parameters:
  • subtype (MPTCPOption) – MPTCP subtype

  • opt (MPTCPJoinSYNACK | None) – option data

  • backup (bool) – backup flag

  • addr_id (int) – address ID

  • hmac (bytes) – sender’s truncated HMAC

  • nonce (int) – sender’s random number

  • **kwargs (Any) – arbitrary keyword arguments

Return type:

MPTCPJoinSYNACK

Returns:

Constructed option schema.

_make_join_ack(subtype, opt=None, *, hmac=b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', **kwargs)[source]

Make multipath TCP join ACK option.

Parameters:
Return type:

MPTCPJoinACK

Returns:

Constructed option schema.

__proto__: DefaultDict[int, ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]]

Protocol index mapping for decoding next layer, c.f. self._decode_next_layer & self._import_next_layer.

Type:

DefaultDict[int, ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]]

__option__: DefaultDict[int, str | tuple[Callable[[Option, OrderedMultiDict[Option, Option]], Option], Callable[[Option, Option | None, Any], Option]]]

Option code to method mapping, c.f. _read_tcp_options() and _make_tcp_options(). Method names are expected to be referred to the class by _read_mode_${name} and _make_mode_${name}, and if such name not found, the value should then be a method that can parse the option by itself.

Type:

DefaultDict[Enum_Option, str | tuple[OptionParser, OptionConstructor]]

__mp_option__: DefaultDict[int, str | tuple[Callable[[MPTCP, OrderedMultiDict[Option, Option]], MPTCP], Callable[[MPTCPOption, MPTCP | None, Any], MPTCP]]]

Option code to method mapping, c.f. _read_mode_mp() and _make_mode_mp(). Method names are expected to be referred to the class by _read_mptcp_${name} and _make_mptcp_${name}, and if such name not found, the value should then be a method that can parse the option by itself.

Type:

DefaultDict[Enum_MPTCPOption, str | tuple[MPOptionParser, MPOptionConstructor]]

classmethod __index__()[source]

Numeral registry index of the protocol.

Return type:

TransType

Returns:

Numeral registry index of the protocol in IANA.

Header Schemas

class pcapkit.protocols.schema.transport.tcp.TCP(*args: _VT, **kwargs: _VT)[source]

Bases: Schema

Header schema for TCP packet.

srcport: AppType = <PortEnumField srcport>

Source port.

dstport: AppType = <PortEnumField dstport>

Destination port.

seq: int = <UInt32Field seq>

Sequence number.

ack: int = <UInt32Field ack>

Acknowledgement number.

offset: OffsetFlag = <BitField offset>

Data offset.

flags: Flags = <BitField flags>

TCP flags.

window: int = <UInt16Field window>

Window size.

checksum: bytes = <BytesField checksum>

Checksum.

urgent: int = <UInt16Field urgent>

Urgent pointer.

options: list[Option] = <OptionField options>

Options.

padding: bytes = <PaddingField padding>

Padding.

payload: bytes = <PayloadField payload>

Payload.

class pcapkit.protocols.schema.transport.tcp.Flags[source]

Bases: TypedDict

TCP flags.

cwr: int

Congestion window reduced.

ece: int

ECN-Echo.

urg: int

Urgent pointer.

ack: int

Acknowledgment.

psh: int

Push function.

rst: int

Reset connection.

syn: int

Synchronize sequence numbers.

fin: int

Last packet from sender.

class pcapkit.protocols.schema.transport.tcp.Option(dict_=None, **kwargs)[source]

Bases: EnumSchema[Option]

Header schema for TCP options.

kind: Option = <EnumField kind>

Option kind.

length: int = <ConditionalField length>

Option length.

post_process(packet)[source]

Revise schema data after unpacking process.

Parameters:

packet (dict[str, Any]) – Unpacked data.

Return type:

Schema

Returns:

Revised schema.

class pcapkit.protocols.schema.transport.tcp.UnassignedOption(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP unassigned options.

data: bytes = <BytesField data>

Option data.

class pcapkit.protocols.schema.transport.tcp.EndOfOptionList(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP end of option list.

class pcapkit.protocols.schema.transport.tcp.NoOperation(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP no operation.

class pcapkit.protocols.schema.transport.tcp.MaximumSegmentSize(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP max segment size option.

mss: int = <UInt16Field mss>

Maximum segment size.

class pcapkit.protocols.schema.transport.tcp.WindowScale(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP window scale option.

shift: int = <UInt8Field shift>

Window scale (shift count).

class pcapkit.protocols.schema.transport.tcp.SACKPermitted(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP SACK permitted option.

class pcapkit.protocols.schema.transport.tcp.SACK(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP SACK option.

sack: list[SACKBlock] = <ListField sack>

Selected ACK data.

class pcapkit.protocols.schema.transport.tcp.Echo(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP echo option.

data: bytes = <BytesField data>

Info to be echoed.

class pcapkit.protocols.schema.transport.tcp.EchoReply(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP echo reply option.

data: bytes = <BytesField data>

Echoed info.

class pcapkit.protocols.schema.transport.tcp.Timestamps(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP timestamps option.

value: int = <UInt32Field value>

Timestamp value.

reply: int = <UInt32Field reply>

Timestamp echo reply.

class pcapkit.protocols.schema.transport.tcp.PartialOrderConnectionPermitted(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP partial order connection permitted option.

class pcapkit.protocols.schema.transport.tcp.PartialOrderServiceProfile(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP partial order connection service profile option.

profile: POCProfile = <BitField profile>

Profile data.

class pcapkit.protocols.schema.transport.tcp.CC(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP CC option.

count: int = <UInt32Field count>

Connection count.

class pcapkit.protocols.schema.transport.tcp.CCNew(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP connection count (new) option.

count: int = <UInt32Field count>

Connection count.

class pcapkit.protocols.schema.transport.tcp.CCEcho(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP connection count (echo) option.

count: int = <UInt32Field count>

Connection count.

class pcapkit.protocols.schema.transport.tcp.AlternateChecksumRequest(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP alternate checksum request option.

algorithm: Checksum = <EnumField algorithm>

Checksum algorithm.

class pcapkit.protocols.schema.transport.tcp.AlternateChecksumData(kind, length, data)[source]

Bases: Option

Header schema for TCP alternate checksum data option.

data: bytes = <BytesField data>

Checksum data.

class pcapkit.protocols.schema.transport.tcp.MD5Signature(kind, length, digest)[source]

Bases: Option

Header schema for TCP MD5 signature option.

digest: bytes = <BytesField digest>

MD5 digest.

class pcapkit.protocols.schema.transport.tcp.QuickStartResponse(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP quick start response option.

flags: QuickStartFlags = <BitField flags>

Flags.

diff: int = <UInt8Field diff>

TTL difference.

nonce: QuickStartNonce = <BitField nonce>

QS nonce.

class pcapkit.protocols.schema.transport.tcp.UserTimeout(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP user timeout option.

info: TimeoutInfo = <BitField info>

Granularity and user timeout.

class pcapkit.protocols.schema.transport.tcp.Authentication(*args: _VT, **kwargs: _VT)[source]

Bases: Option

Header schema for TCP authentication option.

key_id: int = <UInt8Field key_id>

Key ID.

next_key_id: int = <UInt8Field next_key_id>

Next key ID.

mac: bytes = <BytesField mac>

MAC value.

class pcapkit.protocols.schema.transport.tcp.FastOpenCookie(*args: _VT, **kwargs: _VT)[source]

Bases: Option

“Header schema for TCP Fast Open option.

cookie: bytes = <ConditionalField cookie>

Cookie.

class pcapkit.protocols.schema.transport.tcp.MPTCP(dict_=None, **kwargs)[source]

Bases: EnumSchema[MPTCPOption]

Header schema for Multipath TCP options.

kind: Option = <EnumField kind>

Option kind.

length: int = <UInt8Field length>

MPTCP length.

subtype: MPTCPOption

MPTCP subtype.

class pcapkit.protocols.schema.transport.tcp.MPTCPUnknown(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for unknown Multipath TCP option.

test: MPTCPSubtypeUnknown = <BitField test>

Subtype and data.

data: bytes = <BytesField data>

Data.

class pcapkit.protocols.schema.transport.tcp.MPTCPCapable(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP capable option.

test: MPTCPSubtypeCapable = <BitField test>

Subtype and version.

flags: MPTCPCapableFlags = <BitField flags>

Flags.

skey: int = <UInt64Field skey>

Option sender’s key.

rkey: int = <ConditionalField rkey>

Option receiver’s key.

RFC 8684 section 3.1 gives MP_CAPABLE as 12 octets without this key and 20 octets with it, so the field is present only for the latter – not, as it read until #567, for every length except 32, which is not an MP_CAPABLE length either RFC form uses.

class pcapkit.protocols.schema.transport.tcp.MPTCPJoin(dict_=None, **kwargs)[source]

Bases: MPTCP

Header schema for Multipath TCP join option.

class pcapkit.protocols.schema.transport.tcp.MPTCPJoinSYN(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCPJoin

Header schema for Multipath TCP join option for SYN connection.

test: MPTCPSubtypeJoin = <BitField test>

Subtype and flags.

addr_id: int = <UInt8Field addr_id>

Address ID.

token: int = <UInt32Field token>

Receiver’s token.

nonce: int = <UInt32Field nonce>

Sender’s random number.

class pcapkit.protocols.schema.transport.tcp.MPTCPJoinSYNACK(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCPJoin

Header schema for Multipath TCP join option for SYN/ACK connection.

test: MPTCPSubtypeJoin = <BitField test>

Subtype and flags.

addr_id: int = <UInt8Field addr_id>

Address ID.

hmac: bytes = <BytesField hmac>

Sender’s truncated HMAC

nonce: int = <UInt32Field nonce>

Sender’s random number.

class pcapkit.protocols.schema.transport.tcp.MPTCPJoinACK(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCPJoin

Header schema for Multipath TCP join option for ACK connection.

test: MPTCPSubtype = <BitField test>

Subtype.

reserved: bytes = <PaddingField reserved>

Reserved.

hmac: bytes = <BytesField hmac>

Sender’s HMAC.

class pcapkit.protocols.schema.transport.tcp.MPTCPDSS(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP DSS option.

test: MPTCPSubtype = <BitField test>

Subtype and flags.

flags: MPTCPDSSFlags = <BitField flags>

Flags.

ack: int = <SwitchField ack>

Data ACK.

4 octets when A is set, 8 when a is set as well, absent otherwise – RFC 8684 section 3.3 figure 9. Both the presence test and the width live in mptcp_dss_ack_selector(), whose note records what this field declared until #576 and why the switch form is kept.

dsn: int = <SwitchField dsn>

Data sequence number.

4 octets when M is set, 8 when m is set as well, absent otherwise – RFC 8684 section 3.3 figure 9. C.f. mptcp_dss_dsn_selector().

ssn: int = <ConditionalField ssn>

Subflow sequence number.

dl_len: int = <ConditionalField dl_len>

Data level length.

checksum: bytes = <ConditionalField checksum>

Checksum.

class pcapkit.protocols.schema.transport.tcp.MPTCPAddAddress(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP add address option.

test: MPTCPSubtypeAddAddress = <BitField test>

Subtype and IP version.

addr_id: int = <UInt8Field addr_id>

Address ID.

address: IPv4Address | IPv6Address = <SwitchField address>

Address.

port: int = <ConditionalField port>

Port.

class pcapkit.protocols.schema.transport.tcp.MPTCPRemoveAddress(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP remove address option.

test: MPTCPSubtype = <BitField test>

Subtype.

addr_id: list[int] = <ListField addr_id>

Address ID.

class pcapkit.protocols.schema.transport.tcp.MPTCPPriority(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP priority option.

test: MPTCPSubtypePriority = <BitField test>

Subtype.

addr_id: int = <ConditionalField addr_id>

Address ID.

class pcapkit.protocols.schema.transport.tcp.MPTCPFallback(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP fallback option.

test: MPTCPSubtype = <BitField test>

Subtype.

dsn: int = <UInt64Field dsn>

Data sequence number.

class pcapkit.protocols.schema.transport.tcp.MPTCPFastclose(*args: _VT, **kwargs: _VT)[source]

Bases: MPTCP

Header schema for Multipath TCP fastclose option.

test: MPTCPSubtype = <BitField test>

Subtype.

reserved: bytes = <PaddingField reserved>

Reserved.

RFC 8684 section 3.5 figure 14 spends a whole 32-bit row on Kind/Length/Subtype/(reserved), i.e. the subtype’s 4 bits are followed by 12 reserved bits, not 4 – so the subtype-and-reserved part is 2 octets and the option is 12 octets in total. Until #576 this field did not exist and test was the only octet between length and key, so the schema packed 11 octets against a length of 12. Declared the same way MPTCPJoinACK declares its own reserved octet, for the same reason: a wider test would make the reserved bits look like part of the subtype namespace.

key: int = <UInt64Field key>

Option receiver’s key.

Type Stubs

class pcapkit.protocols.schema.transport.tcp.OffsetFlag[source]

Bases: TypedDict

TCP offset field flag.

offset: int

Data offset.

ns: int

ECN-nonce concealment protection.

class pcapkit.protocols.schema.transport.tcp.Flags[source]

Bases: TypedDict

TCP flags.

cwr: int

Congestion window reduced.

ece: int

ECN-Echo.

urg: int

Urgent pointer.

ack: int

Acknowledgment.

psh: int

Push function.

rst: int

Reset connection.

syn: int

Synchronize sequence numbers.

fin: int

Last packet from sender.

class pcapkit.protocols.schema.transport.tcp.POCProfile[source]

Bases: TypedDict

TCP partial order connection service profile.

start: int

Start flag.

end: int

End flag.

class pcapkit.protocols.schema.transport.tcp.QuickStartFlags[source]

Bases: TypedDict

TCP quick start flags.

rate: int

Rate request.

class pcapkit.protocols.schema.transport.tcp.QuickStartNonce[source]

Bases: TypedDict

TCP quick start nonce.

nonce: int

Nonce.

class pcapkit.protocols.schema.transport.tcp.TimeoutInfo[source]

Bases: TypedDict

User timeout information.

granularity: int

Granularity.

timeout: int

Timeout value.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypeTest[source]

Bases: TypedDict

TCP MPTCP subtype.

length: int

Length.

subtype: int

Subtype.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypeUnknown[source]

Bases: TypedDict

TCP unknown MPTCP subtype field.

subtype: int

Subtype.

data: int

Data.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypeCapable[source]

Bases: TypedDict

MPTCP Capable subtype field.

subtype: int

Subtype.

version: int

Version.

class pcapkit.protocols.schema.transport.tcp.MPTCPCapableFlags[source]

Bases: TypedDict

MPTCP Capable flags.

req: int

Checksum required.

ext: int

Extensibility flag.

hsa: int

Use of HMAC-SHA1.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypeJoin[source]

Bases: TypedDict

MPTCP Join subtype field.

subtype: int

Subtype.

backup: int

Backup flag.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtype[source]

Bases: TypedDict

MPTCP subtype field.

subtype: int

Subtype.

class pcapkit.protocols.schema.transport.tcp.MPTCPDSSFlags[source]

Bases: TypedDict

MPTCP-DSS flags.

F: int

DATA_FIN flag.

m: int

Data sequence number is 8 octets (if not set, DSN is 4 octets).

M: int

Data Sequence Number (DSN), Subflow Sequence Number (SSN), Data-Level Length, and Checksum present.

a: int

Data ACK is 8 octets (if not set, Data ACK is 4 octets).

A: int

Data ACK present.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypeAddAddress[source]

Bases: TypedDict

MPTCP Add Address subtype field.

subtype: int

Subtype.

version: int

IP version.

class pcapkit.protocols.schema.transport.tcp.MPTCPSubtypePriority[source]

Bases: TypedDict

MPTCP Priority subtype field.

subtype: int

Subtype.

backup: int

Backup flag.

Auxiliary Functions

pcapkit.protocols.schema.transport.tcp.mptcp_data_selector(pkt)[source]

Selector function for _MPTCP.data field.

Parameters:

pkt (dict[str, Any]) – Packet data.

Return type:

FieldBase

Returns:

A SchemaField wrapped MPTCP subclass instance.

pcapkit.protocols.schema.transport.tcp.mptcp_add_address_selector(pkt)[source]

Selector function for MPTCPAddAddress.address field.

Parameters:

pkt (dict[str, Any]) – Packet data.

Return type:

FieldBase

Returns:

pcapkit.protocols.schema.transport.tcp.mptcp_dss_ack_selector(pkt)[source]

Selector function for MPTCPDSS.ack field.

RFC 8684 section 3.3 figure 9 gives the Data ACK as “4 or 8 octets, depending on flags”: present only when A is set, and 8 octets wide only when a is also set – “a = Data ACK is 8 octets (if not set, Data ACK is 4 octets)”.

Parameters:

pkt (dict[str, Any]) – Packet data.

Return type:

FieldBase

Returns:

  • If A is clear, a NoValueField instance – the field is absent from the wire.

  • If A is set and a is set, a UInt64Field instance.

  • If A is set and a is clear, a UInt32Field instance.

Note

This is a SwitchField selector rather than a ConditionalField wrapping NumberField(length=lambda pkt: ...), which is what it was until #576.

The width lambda read 8 if pkt['flags']['a'] else 0 – 0, not 4 – so an unextended Data ACK packed no octets at all while the length octet still counted 4 for it. That is the defect #576 records: the option went onto the wire 4 (or 8, with dsn too) octets shorter than it declared, and the ack value the caller supplied was simply not present.

Correcting the lambda to 8 if ... else 4 would not have worked at the time, because NumberField could not pack a callable length at all: it called build_template once at __init__ with the placeholder length -1, which latched _need_process = True, and nothing cleared that flag when __call__ later resolved the real length and rebuilt the template as >I/>Q. pre_process then handed struct.pack() bytes for an integer template and it raised struct.error: required argument is not an integer. Measured on the 8-octet form, which the old lambda did reach: _make_mptcp_dss(DSS, ack=1 << 40) raised exactly that.

That half is now history: #598 fixed it, in pcapkit.corekit.fields.numbers where this note used to say the fix belonged, by recomputing _need_process from the width actually in force instead of once from the placeholder. A callable-length NumberField packs and unpacks both the 4- and the 8-octet form today, so ConditionalField(NumberField(length=...), lambda pkt: pkt['flags']['A']) would express this field correctly. Nor was wire absence ever the obstacle: MPTCPDSS.ssn, MPTCPDSS.dl_len and MPTCPDSS.checksum are each a ConditionalField on the sibling M flag, so this very class already leans on that wrapper to keep a field off the wire.

The SwitchField form is kept anyway, for a narrower reason about composition rather than about absence. A ConditionalField’s length forwards to the wrapped field unconditionally, never consulting the condition, so reading it while the condition is false – the wrapped field then still unresolved, at its -1 placeholder – raises struct.error: bad char in struct format. Nothing here meets that only because Schema’s pack and unpack special-case ConditionalField by name and skip the wrapped field outright before any length is read. A SwitchField needs no such special case: its selector always hands back an already-concrete field, NoValueField included, so its length is safe wherever it is read. Swapping the two would be a behaviour change, not a tidy-up, and #603 does not make it.

pcapkit.protocols.schema.transport.tcp.mptcp_dss_dsn_selector(pkt)[source]

Selector function for MPTCPDSS.dsn field.

RFC 8684 section 3.3 figure 9 gives the Data Sequence Number as “4 or 8 octets, depending on flags”: present only when M is set, and 8 octets wide only when m is also set – “m = Data Sequence Number is 8 octets (if not set, DSN is 4 octets)”.

Parameters:

pkt (dict[str, Any]) – Packet data.

Return type:

FieldBase

Returns:

  • If M is clear, a NoValueField instance – the field is absent from the wire.

  • If M is set and m is set, a UInt64Field instance.

  • If M is set and m is clear, a UInt32Field instance.

Note

Identical in shape to mptcp_dss_ack_selector(), and it replaces the identical defect: NumberField(length=lambda pkt: 8 if pkt['flags']['m'] else 0, ...). See that function’s note for why the 0 was wrong, why a corrected lambda would not have packed either at the time, and why the SwitchField form is kept now that #598 has made a callable length work. C.f. #576, #598.

Data Models

class pcapkit.protocols.data.transport.tcp.TCP(*args: VT, **kwargs: VT)[source]

Bases: Protocol

Data model for TCP packet.

srcport: AppType

Source port.

dstport: AppType

Destination port.

seq: int

Sequence number.

ack: int

Acknowledgment number.

hdr_len: int

Data offset.

flags: Flags

Flags.

window_size: int

Window size.

checksum: bytes

Checksum.

urgent_pointer: int

Urgent pointer.

options: OrderedMultiDict[Option, Option]

TCP options.

connection: Flags

Connection control flags.

class pcapkit.protocols.data.transport.tcp.Flags(*args: VT, **kwargs: VT)[source]

Bases: Data

Data model for TCP flags.

cwr: bool

Congestion window reduced.

ece: bool

ECN-Echo.

urg: bool

Urgent.

ack: bool

Acknowledgment.

psh: bool

Push function.

rst: bool

Reset connection.

syn: bool

Synchronize sequence numbers.

fin: bool

Last packet from sender.

class pcapkit.protocols.data.transport.tcp.Option(dict_=None, **kwargs)[source]

Bases: Data

Data model for TCP options.

kind: Option

Option kind.

length: int

Option length.

class pcapkit.protocols.data.transport.tcp.UnassignedOption(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for unassigned TCP option.

data: bytes

Option data.

class pcapkit.protocols.data.transport.tcp.EndOfOptionList(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP end of option list option.

class pcapkit.protocols.data.transport.tcp.NoOperation(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP no operation option.

class pcapkit.protocols.data.transport.tcp.MaximumSegmentSize(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP maximum segment size option.

mss: int

Maximum segment size.

class pcapkit.protocols.data.transport.tcp.WindowScale(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP window scale option.

shift: int

Window scale.

class pcapkit.protocols.data.transport.tcp.SACKPermitted(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP SACK permitted option.

class pcapkit.protocols.data.transport.tcp.SACK(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP SACK option.

sack: tuple[SACKBlock, ...]

SACK blocks.

class pcapkit.protocols.data.transport.tcp.Echo(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP echo option.

data: bytes

Echo data.

class pcapkit.protocols.data.transport.tcp.EchoReply(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP echo reply option.

data: bytes

Echo data.

class pcapkit.protocols.data.transport.tcp.Timestamps(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP timestamp option.

timestamp: int

Timestamp .

echo: int

Echo data.

class pcapkit.protocols.data.transport.tcp.PartialOrderConnectionPermitted(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP partial order connection permitted option.

class pcapkit.protocols.data.transport.tcp.PartialOrderServiceProfile(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP partial order connection profile option.

start: bool

Start flag.

end: bool

End flag.

class pcapkit.protocols.data.transport.tcp.CC(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP CC option.

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.CCNew(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP CC.NEW option.

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.CCEcho(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP CC.ECHO option.

cc: int

Connection count.

class pcapkit.protocols.data.transport.tcp.AlternateChecksumRequest(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP alternate checksum request option.

chksum: Checksum

Checksum algorithm.

class pcapkit.protocols.data.transport.tcp.AlternateChecksumData(kind, length, data)[source]

Bases: Option

Data model for TCP alternate checksum data option.

data: bytes

Checksum data.

class pcapkit.protocols.data.transport.tcp.MD5Signature(kind, length, digest)[source]

Bases: Option

Data model for TCP MD5 signature option.

digest: bytes

MD5 signature.

class pcapkit.protocols.data.transport.tcp.QuickStartResponse(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP quick start response option.

req_rate: int

Rate request.

ttl_diff: int

TTL difference.

nonce: int

QS nonce.

class pcapkit.protocols.data.transport.tcp.UserTimeout(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP user timeout option.

timeout: timedelta

User timeout.

class pcapkit.protocols.data.transport.tcp.Authentication(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP authentication option.

key_id: int

Key ID.

next_key_id: int

Receive next key ID.

mac: bytes

MAC.

class pcapkit.protocols.data.transport.tcp.FastOpenCookie(*args: VT, **kwargs: VT)[source]

Bases: Option

Data model for TCP fast open cookie option.

cookie: bytes

Cookie.

class pcapkit.protocols.data.transport.tcp.MPTCP(dict_=None, **kwargs)[source]

Bases: Option

Data model for TCP MPTCP option.

subtype: MPTCPOption

Subtype.

class pcapkit.protocols.data.transport.tcp.MPTCPUnknown(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP unknown MPTCP option.

data: bytes

Data.

class pcapkit.protocols.data.transport.tcp.MPTCPCapable(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP MP_CAPABLE option.

version: int

Version.

flags: MPTCPCapableFlag

Flags.

skey: int

Option sender’s key.

rkey: int | None

Option receiver’s key.

class pcapkit.protocols.data.transport.tcp.MPTCPJoin(dict_=None, **kwargs)[source]

Bases: MPTCP

Data model for TCP MP_JOIN option.

connection: Flags

Connection type.

class pcapkit.protocols.data.transport.tcp.MPTCPJoinSYN(*args: VT, **kwargs: VT)[source]

Bases: MPTCPJoin

Data model for TCP MP_JOIN-SYN option.

backup: bool

Backup path flag.

addr_id: int

Address ID.

token: int

Receiver’s token.

nonce: int

Sendder’s random number.

class pcapkit.protocols.data.transport.tcp.MPTCPJoinSYNACK(*args: VT, **kwargs: VT)[source]

Bases: MPTCPJoin

Data model for TCP MP_JOIN-SYNACK option.

backup: bool

Backup path flag.

addr_id: int

Address ID.

hmac: bytes

Sender’s truncated HMAC.

nonce: int

Sendder’s random number.

class pcapkit.protocols.data.transport.tcp.MPTCPJoinACK(*args: VT, **kwargs: VT)[source]

Bases: MPTCPJoin

Data model for TCP MP_JOIN-ACK option.

hmac: bytes

HMAC value.

class pcapkit.protocols.data.transport.tcp.MPTCPDSS(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP DSS option.

data_fin: bool

DATA_FIN flag.

ack: int | None

Data ACK.

dsn: int | None

Data sequence number.

ssn: int | None

Subflow sequence number.

dl_len: int | None

Data-level length.

checksum: bytes | None

Checksum.

class pcapkit.protocols.data.transport.tcp.MPTCPAddAddress(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP ADD_ADDR option.

version: int

IP version.

addr_id: int

Address ID.

addr: IPv4Address | IPv6Address

Address.

port: int | None

Port number.

class pcapkit.protocols.data.transport.tcp.MPTCPRemoveAddress(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP REMOVE_ADDR option.

addr_id: tuple[int, ...]

Address ID.

class pcapkit.protocols.data.transport.tcp.MPTCPPriority(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP MP_PRIO option.

backup: bool

Backup path flag.

addr_id: int | None

Address ID.

class pcapkit.protocols.data.transport.tcp.MPTCPFallback(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP MP_FAIL option.

dsn: int

Data sequence number.

class pcapkit.protocols.data.transport.tcp.MPTCPFastclose(*args: VT, **kwargs: VT)[source]

Bases: MPTCP

Data model for TCP MP_FASTCLOSE option.

rkey: int

Option receiver’s key.

Footnotes