secdev / secdev/scapy

Scapy IEEE 802.15.4 processing is based on version 2011?

Open
#4,947 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
12.6k
Forks
2.2k
Avg merge
1d 4h
Merged PRs (30d)
56

Description

Brief description

Comparing a Scapy application's parsing of a known good 802.15.4 PCAPNG (with latest Wireshark). Hex packet dumps match, so the frame boundaries are correct. Scapy is not correctly parsing (at least) the source addresses, destination addresses, PAN IDs, etc. from the frames.

Scapy appears to be coded to IEEE 802.15.4-2011? The capture adheres to IEEE 802.15.4-2020 (note fcf_framever= 2), whose frame control has new fields controlling sequence number suppression, Information Element presence, and new PAN ID suppression logic since 2011.

Scapy version

2.7.0

Python version

3.14.3

Operating system

Windows 11

Additional environment information

No response

How to reproduce

Scapy output... note PAN ID compression in the frame control field is set to True, yet a PAN ID is parsed which seems to also corrupt at least the source and destination address parsing.

###[ 802.15.4 ]###
fcf_reserved_1= 0
fcf_panidcompress= True
fcf_ackreq= False
fcf_pending= False
fcf_security= False
fcf_frametype= Data
fcf_srcaddrmode= Long
fcf_framever= 2
fcf_destaddrmode= Long
fcf_reserved_2= 3
seqnum = 108
###[ 802.15.4 Data ]###
dest_panid= 0xb17
dest_addr = 50:f2:6e:ac🇩🇪48:00:12
src_addr = 01:15:05:48:2e:72:10:00

0000 41 EF 6C 17 0B 12 00 48 DE AC 6E F2 50 00 10 72 A.l....H..n.P..r
0010 2E 48 05 15 01 09 5C EA BA 06 15 02 A0 2E FC 00 .H.............
0020 00 06 15 0B 58 02 11 04 00 04 15 0C 00 0A 08 03 ....X...........
0030 15 0E 7D 01 08 15 0F 10 27 00 50 6E 01 05 03 15 ..}.....'.Pn....
0040 12 17 00 00 3F 26 A0 0C 90 F4 01 00 00 17 00 7D ....?&.........}
0050 0A 0A 10 01 02 05 04 E8 03 00 00 43 09 05 57 69 ...........C..Wi
0060 53 55 4E 20 50 41 4E 04 A0 01 12 01 01 00 F8 SUN PAN........

Actual result

No response

Expected result
Related resources

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Scapy 2.7.0's IEEE 802.15.4 parsing and compare it against the supplied frame bytes and Wireshark output. Investigate frame version 2, PAN ID compression, sequence-number suppression, Information Element presence, and address fields; done means the destination and source addresses and PAN IDs are parsed correctly for the supplied 802.15.4-2020 capture.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.