docs: record the protocol, reassembly and crypto gaps on the Help Wanted page

[JarryShaw]

Catalogues what pcapkit does not implement, so the gaps are trackable instead of rediscovered. Every entry is verified against the code — a file:line or a specific missing name and number, never an inference from the docs.

docs/source/pep.rst only, +205/−13. Docs build: 91 warning/error lines before, 91 after, the two sets byte-identical and none naming pep.rst.

One correction to the commit message. It says the after-count was "still running", because it was when the commit was written. The confirmed 91/91 above supersedes that line; correcting it in place would have needed a force-push, which is not worth it.

Protocols

• DTLS has no dissector and no stub anywhere in the tree (find -iname '*dtls*' returns nothing; only TLS/SSL has one), yet it is named by SCTP chunk type 65, parameter 0x8006, error causes 100–103, and PPIDs 47/66/67/68/69/4242. All of it parses as opaque bytes. This is what blocks NGAP over PPID 66 (protocols: implement NGAP over SCTP, decoding aligned PER through pycrate #417), not NGAP itself.
• Registry values with no dissector behind them, measured by importing the tree rather than counted by eye: LinkType 3 of 219 · TransType 15 of 151 · EtherType 6 of 160 · AppType 2 ports of 8182 · SCTP PPID 0 of 75 (SCTP.__proto__ is literally {} at transport/sctp.py:344-347, with no in-tree register_sctp caller).
• Orphaned dissectors — OSPF and L2TP are implemented but bound to nothing (TransType 89 and 115 unbound, and both make __index__ raise). FTP_DATA exists with TCP port 20 unbound. HTTP is registered on port 80 only. EtherType 0x88A8 is unbound although VLAN already parses that shape.

Reassembly and analysis

• SCTP reassembly is entirely absent — grep -rni sctp pcapkit/foundation/ returns nothing — even though every field a reassembler needs is already exposed at sctp.py:1143-1157. Today only the first DATA chunk of a bundle is dispatched (sctp.py:517-524), and the only readers of flags.B/flags.E are in _make_chunk_data.
• I-DATA (RFC 8260, chunk type 64) is undissected: SCTP.__chunk__[Chunk(64)] is 'donone' and read() matches only Payload_Data, so an I-DATA-only packet yields no payload at all. FORWARD TSN 192 and I-FORWARD-TSN 194 likewise.
• Registering a fourth reassembler is inert. register_reassembly accepts any name, but Extractor instantiates three literal keys and ReassemblyManager is a fixed-field Info — verified by the TypeError on sctp=. So SCTP reassembly needs plumbing, not just an algorithm.
• Flow tracing is TCP-only, closes on FIN but not RST, and flows are unidirectional. No reassembly timeout or eviction exists anywhere and the buffer models carry no timestamp, while 72 KiB is preallocated per in-flight IP datagram id.

ESP cryptographic coverage

36 Cipher and 15 Integrity members against 5 suites each — and two of those ten are the no-ops ENCR_NULL and NONE. The page's existing "not implemented" list was incomplete; it now names AES-CTR, AES-CMAC-96, the AES-GMAC family, Camellia, RFC 8750 implicit-IV and RFC 9227 MGM, plus the two structural blockers: IntegritySuite stores its digest as a hashlib constructor name, and load_cryptography imports only the ciphers submodules.

Corrections to the page itself

The audit contradicted two things pep.rst previously asserted:

• The MH # TODO markers are not at the dispatch tables. All six sit at the end of each handler block (mh.py:1510,2310,2422,2986,3757,3871). The counts themselves check out (24/14, 71/20, 4/1), read and make are symmetric at 37 each, and mh.py:32-78 already imports 32 const/mh sub-registry enums it never uses — so the enumerations for the missing options exist already.
• Items checked and dismissed as already done rather than re-solicited: the 33-file stub list, the NDP/QUIC corrections, SCTP/ESP/PCAP-NG/logging/engines, and the module count. No read/make asymmetry exists anywhere in pcapkit/protocols/ — every UnsupportedCall there is a deliberate design decision.

Discussion posts

Comment	Placement
-18470228	in-thread under More Protocols, More!!! — DTLS, registered-but-not-dissected, ESP/MH corrections
-18470233	new top-level, Reassembly Beyond IP and TCP
-18470238	#251 — DTLS blocks PPID 66

The new top-level comment is justified rather than lazy: #106's seven topics are protocols, PCAP-NG, performance, logging, engines, tests and a progress meta-comment, none of which covers reassembly or flow tracing, and the post says so in its first line. Everything else went in-thread, per convention.

Note the posts deep-link to #dtls, #registered-but-not-dissected and #reassembly-beyond-ip-and-tcp, which do not exist on the live docs until this merges and Pages redeploys — the links resolve to the page meanwhile, just not to the section.

Seven code defects found while auditing, none fixed here

Filed separately rather than smuggled into a docs PR. The first is the most consequential:

1. __proto__ registry pollution — protocols/protocol.py:1300 indexes a defaultdict, so a lookup miss inserts the key. Reproduced: parsing one 24-byte IPv4 packet with proto=1 inserts TransType.ICMP -> Raw into the class-level, shared Internet.__proto__, after which register_transtype(TransType.ICMP, …) warns "already registered, overwriting". SCTP._import_next_layer overrides the base method precisely to avoid this and documents why at sctp.py:818-831 — a ready template for Frame, PCAPNG, Link, Internet, IPv6, TCP and UDP.
2. beholder's Raw fallback on payload-less schemas — already fixed on protocols: implement NGAP over SCTP, decoding aligned PER through pycrate #417, so main only.
3. register_apptype cannot register an SCTP-only service, raising RegistryError for ~41 AppType members whose proto is SCTP- or DCCP-only, while register_sctp is PPID-keyed.
4. ESP AEAD dispatch falls through — anything not ENCR_NULL or ENCR_AES_CBC is treated as AES-GCM. Safe today; adding AES-CCM or ChaCha20 to CIPHER_SUITES without touching decrypt/encrypt would silently mis-process it.
5. Cipher.get()/Integrity.get() invent members via extend_enum(…, -1) for an unknown string.
6. vendor/pcapng/filter_type.py:25 has DATA = {} with a TODO URL, so the generated enum has no members.
7. DPKT/Scapy trace output hits the mapping-vs-frame defect extraction.py:879-881 documents and excludes; interface: add the three missing engine constants, and guard dpkt/scapy tracing #412 is in flight over that area.

[Copilot]

🟢 Approval recommended

Documentation-only changes appear internally consistent and well-formed in RST, with no verified issues requiring follow-up.

Pull request overview

Updates the Help Wanted / gaps documentation in pep.rst to explicitly catalogue missing protocol dissectors, reassembly limitations, and ESP crypto coverage constraints, with concrete code pointers so gaps are trackable and not rediscovered.

Changes:

• Adds and expands sections describing SCTP reassembly absence, DTLS non-existence, and “registered-but-not-dissected” registry coverage gaps.
• Rewrites the ESP algorithm-coverage subsection to enumerate the practical supported suites vs. the larger IANA registries, including structural blockers.
• Updates performance/help-wanted notes (“Maybe Even Faster?”) with specific profiling findings and adds a dedicated “Reassembly Beyond IP and TCP” section.

File summaries

File	Description
docs/source/pep.rst	Expands the Help Wanted page with verified, code-referenced protocol/reassembly/crypto gaps and updated benchmarking notes.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.