Skip to content

Conversation

@LarsV33
Copy link

@LarsV33 LarsV33 commented Oct 26, 2025

This patch allows to initialize the PcapNgWriter with Hardware, OS, and User Application. This information is written to the pcapng SHB.

@guedou
Copy link
Member

guedou commented Oct 26, 2025

Thanks for this PR. Could you add unit tests, for example at

?

Also, can you point us with the documentation of these blocks?

This patch allows to set Hardware, OS, and User Application, when
creating a PcapNgWriter. These values will be written into the SHB.
@LarsV33 LarsV33 force-pushed the adding_shb_options_to_pcapng branch from d184fc9 to 41d1a2c Compare October 26, 2025 21:18
@LarsV33
Copy link
Author

LarsV33 commented Oct 26, 2025

Thanks for this PR. Could you add unit tests, for example at


?

I gave it a try. Without a reader hard to read back.

Also, can you point us with the documentation of these blocks?

This is part of the regular pcapng specification. These options are missing in the scapy implementation.

I guess the best pcapng spec is the upcoming rfc:
https://www.ietf.org/archive/id/draft-ietf-opsawg-pcapng-04.html#name-section-header-block

@codecov
Copy link

codecov bot commented Oct 27, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.86%. Comparing base (ef72e1d) to head (41d1a2c).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4865      +/-   ##
==========================================
+ Coverage   80.48%   80.86%   +0.37%     
==========================================
  Files         368      368              
  Lines       90255    90269      +14     
==========================================
+ Hits        72645    72998     +353     
+ Misses      17610    17271     -339     
Files with missing lines Coverage Δ
scapy/utils.py 73.57% <100.00%> (+0.92%) ⬆️

... and 22 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@guedou
Copy link
Member

guedou commented Oct 27, 2025

Thanks for pointing out the spec! I forgot about it.

The RawPcapNgReader already supports reading these options, that probably better to tweak it and use for the unit tests, see https://github.com/secdev/scapy/blob/master/scapy/utils.py#L1752

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants