Data_Raw.protocol is documented as "Original enumeration of this protocol", but
whether it is actually populated for an unknown code depends on which layer
asked. Measured on the generated fixtures:
| layer |
unknown code |
Raw.info.protocol |
protochain |
| SCTP |
PPID 4243 |
4243 |
SCTP:Unassigned_4243 |
| IPv4 |
protocol 253 |
the enum |
IPv4:Use_for_experimentation_and_testing_253 |
| TCP |
port 22, unregistered |
None |
Ethernet:IPv4:TCP:Raw |
ex = extract(fin='examples/captures/tcp.pcap', nofile=True, store=True)
tcp = ex.frame[5].payload.payload.payload
tcp.info.dstport # ssh [22 - tcp|udp|sctp]
tcp.payload.info.protocol # None
Why
Protocol._import_next_layer passes alias=proto to whatever it constructs, and
Raw.read turns that into Data_Raw.protocol. Internet.__proto__ and
SCTP.__proto__ fall through to Raw via that call, so the code survives.
Transport._decode_next_layer resolves ports through cls.__proto__[ports[0]] /
[ports[1]] (pcapkit/protocols/transport/transport.py:112-114) and reaches
Raw by a route that never carries the alias, so TCP and UDP anonymise the port
they could not place.
Why it matters
The value is most useful precisely when the protocol is unknown — it is the only
record of what the payload claimed to be. A consumer walking frames cannot tell
"TCP payload on some port we do not decode" from "TCP payload on port 22" today,
while the equivalent SCTP and IPv4 cases both say so.
Note
Not a regression, and not what #417 changed. #417 makes the failure path
(beholder, i.e. a registered protocol whose parse raised) forward the alias
uniformly, which it previously did not — necessary there because SCTP's
unregistered path does keep the enumeration, so registering NGAP on PPID 60 would
otherwise have made a failed parse less informative than leaving the PPID
unregistered. That leaves the failure path consistent across layers and these
unknown-code paths still inconsistent with each other, which is this issue.
Fixing it means giving Transport._decode_next_layer the same alias forwarding
_import_next_layer does. tests/protocols/transport/test_tcp_runtime.py:85 and
tests/protocols/transport/test_sctp_unit.py:966 pin the two current behaviours
and are where the change would show.
Data_Raw.protocolis documented as "Original enumeration of this protocol", butwhether it is actually populated for an unknown code depends on which layer
asked. Measured on the generated fixtures:
Raw.info.protocol4243SCTP:Unassigned_4243IPv4:Use_for_experimentation_and_testing_253NoneEthernet:IPv4:TCP:RawWhy
Protocol._import_next_layerpassesalias=prototo whatever it constructs, andRaw.readturns that intoData_Raw.protocol.Internet.__proto__andSCTP.__proto__fall through toRawvia that call, so the code survives.Transport._decode_next_layerresolves ports throughcls.__proto__[ports[0]]/[ports[1]](pcapkit/protocols/transport/transport.py:112-114) and reachesRawby a route that never carries the alias, so TCP and UDP anonymise the portthey could not place.
Why it matters
The value is most useful precisely when the protocol is unknown — it is the only
record of what the payload claimed to be. A consumer walking frames cannot tell
"TCP payload on some port we do not decode" from "TCP payload on port 22" today,
while the equivalent SCTP and IPv4 cases both say so.
Note
Not a regression, and not what #417 changed. #417 makes the failure path
(
beholder, i.e. a registered protocol whose parse raised) forward the aliasuniformly, which it previously did not — necessary there because SCTP's
unregistered path does keep the enumeration, so registering NGAP on PPID 60 would
otherwise have made a failed parse less informative than leaving the PPID
unregistered. That leaves the failure path consistent across layers and these
unknown-code paths still inconsistent with each other, which is this issue.
Fixing it means giving
Transport._decode_next_layerthe same alias forwarding_import_next_layerdoes.tests/protocols/transport/test_tcp_runtime.py:85andtests/protocols/transport/test_sctp_unit.py:966pin the two current behavioursand are where the change would show.