Write out of pcap is incorrect when altering the length of an IE (dot11.py)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 12.6k
- Forks
- 2.2k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 56
Description
Brief description
I am not sure if this is expected behaviour or not, but writing back PCAP files gives an erroneous PCAP file when some part of the packet changes in length. In this case it's dot11.py and changing an IE length.
Full details provided below.
Scapy version
86f034b61f9f2d44225d8437ddd36472c7cf6257
Python version
3.12.2
Operating system
MacOS Sonoma 14.4
Additional environment information
No response
How to reproduce
Sample script:
from scapy.all import *
x = PcapReader("single-beacon.pcap")
nbcn = x.read_packet()
nbcn[Dot11Elt::{"ID":0}].info = b'some long SSID to change length'
nbcn[Dot11Elt::{"ID":0}].len = None
wrpcap("modified-beacon.pcap", nbcn)
Input pcap:
single-beacon.pcap.gz
Output pcap:
modified-beacon.pcap.gz
Error from Wireshark:
Expected beacon:
modified-beacon-correct.pcap.gz
No error in Wireshark:
Diff which seems to fix this:
diff --git a/scapy/packet.py b/scapy/packet.py
index 0e096b2c..e0b93bdf 100644
--- a/scapy/packet.py
+++ b/scapy/packet.py
@@ -497,6 +497,7 @@ class Packet(
self.raw_packet_cache = None
self.raw_packet_cache_fields = None
self.wirelen = None
+ self.firstlayer().wirelen = None
elif attr == "payload":
self.remove_payload()
self.add_payload(val)
Actual result
No response
Expected result
No response
Related resources
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in scapy/packet.py around the attribute-change handling shown in the issue, then reproduce the behavior with the provided PcapReader and wrpcap script. Verify that changing a Dot11Elt value and clearing its length produces a PCAP that Wireshark accepts, matching the supplied corrected output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100