PyPCAPKit v1.5.0

1.5.0 -- 2026-10-29

The largest release since 1.0, and the first recorded here as it happened rather than reconstructed. New extraction engines, ESP with payload decryption, SCTP and NGAP over SCTP, a library logger that no longer hijacks the consumer's, and a defect programme run through the issue tracker, citing issues and pull requests from #340 to #2257.

Preceded by 1.5.0a1 (2026-09-15), 1.5.0b1 to 1.5.0b3 (all 2026-09-19) and 1.5.0b4 to 1.5.0b14 (2026-09-20 to 2026-10-22), dated in UTC and all published as prereleases and so resolved only by pip install --pre. 1.5.0b1 half-shipped: the tag, the GitHub release and the Conda deployments landed, but PyPI rejected the wheel because twine check found a Sphinx-only :mod: role in README.rst, which pyproject.toml declares as the dynamic long description. 1.5.0b2 reshipped it -- an existing version cannot republish -- and 1.5.0b3 followed the CI change that stops a TestPyPI outage from costing a release its wheels (#497, #498).

pcapkit.const

Changed

• a breaking change to pcapkit.const.reg.apptype. AppType becomes a memberless base over one registry per transport protocol -- TCP, UDP, SCTP and DCCP -- because aenum refuses to subclass an enumeration that has members. isinstance(TCP.http, AppType) still holds and AppType.get(port, proto=...) proxies to the registry, so nothing under pcapkit.protocols changes. The rows IANA assigns no port, and those it assigns no transport protocol, stop being members; they become list-table docstrings on the registry that owns them. __members_proto__ is now a per-registry MultiDict keyed on port, so every service IANA registers on port 80 survives. get() answers with the canonical service, curated from /etc/services because IANA names no precedence, and get_all() reaches the aliases (#754).
• the %-formatted raise ValueError(...) calls in the generated pcapkit.const.reg.apptype.apptype, left by #759, are f-strings (#792). The remainder followed: the _missing_ guards in pcapkit.vendor.tcp.flags, .ftp.command and .http.method, AppType's __new__/__repr__/__str__, and the extend_enum fallbacks in get() and in the span-handling tail. The consider-using-f-string disable drops from tcp.flags and reg.apptype.apptype and stays on ftp.command and http.method, whose __repr__ still used %. Edited in the vendor templates and applied to the generated const files by hand, since a crawl would fetch IANA's live registry and rewrite unrelated rows (#798).
• the __repr__ methods #798 left on % (in pcapkit/const/ftp/command.py and pcapkit/const/http/method.py) are f-strings, so the disable drops from both files and both pcapkit/vendor/ templates. The other bespoke templates ({const,vendor}/ftp/return_code.py, {const,vendor}/http/status_code.py, vendor/http/frame.py) and vendor/default.py still carry it, so #804's claim that nothing in pcapkit/{const,vendor}/{ftp,http}/ needs it holds for this pair only; repr() output is unchanged (#804).
• test_const_enum_no_mint.py's is_manufactured() exemption for the hex-suffixed names #878 (below) preserves moves from a per-file to a per-name-shape one. The per-file exemption was shape-blind: rewriting a branch to 'Xyplex_%d' % value -- exactly the value-derived shape the predicate exists to flag -- left the sweep green. The check now exempts only a '..._0x%s' % hex(value)[2:].upper().zfill(4) expression, and the exact exempt_hits == 53 bound stays. Test-only. Closes #879 (#881).
• a breaking change to AppType.proto: it is the single transport of the registry the member lives in, not every transport IANA assigned the service, and register_apptype takes its transports as varargs (#806, #815). Aliases show in repr() and str(), and can be registered per transport (#807, #837).
• a breaking change to TransportProtocol: its base moves from aenum.IntFlag to aenum.IntEnum, so | between two members gives a plain int rather than a composite member (#808, #836).
• a breaking change to TLSKeyLabel: the hand-written class in pcapkit.protocols.misc.pcapng becomes the generated pcapkit.const.pcapng.tls_key_label.TLSKeyLabel (PCAPNG_TLSKeyLabel in pcapkit.const.pcapng), crawled from the IANA registry RFC 9850 creates (#886, #890), and the old path is removed (#1744, #1754).
• a breaking change to Method.get(): the method token is case-sensitive, per RFC 9110 Section 9.1, so Method.get('get') no longer resolves to GET (#896, #907). It also looks a key up by value, so BASELINE-CONTROL and VERSION-CONTROL resolve (#908, #915).
• a breaking change to ExtensionHeader: it is generated from IANA's IPv6 Extension Header Types registry rather than the Protocol Numbers registry's flag, and the two disagree on 147 (BIT-EMU) (#925, #926).
• the TCP and UDP AppType registries load on first use rather than at import (#1538, #1560).
• a breaking change to LLACode: Wilcard is spelled Wildcard and MH is MN, the names RFC 5568 gives codes 0 and 2, with no alias for either old name (#1848, #1872).
• a breaking change to tcp.flags.Flags: each member is its wire mask in the flags field, FIN 0x001 up to AE 0x100, rather than 1 << offset in IANA's most-significant-first bit numbering, which put FIN at 0x8000. int(tcp.connection) of a SYN/ACK is 0x012, as the header carries it, not 0x4800, and Flags(0x12) is SYN | ACK. The range guard narrows to the 12-bit flags field, 0 <= value <= 0xFFF. Code that stored or compared the old integers has to change; membership tests and names are unaffected (#2310).

Fixed

• constant lookups that rejected a value the registry defines. RouterAlert(0) is the only value RFC 2113 defines and the one IGMP, RSVP and MLD actually send, and it was discarded because the vendor crawler skipped a header row IANA's CSV does not have; IPX Socket(0) is that protocol's own default, so bytes(IPX(...)) crashed on its own defaults; and the FTP _missing_ overrides were plain methods rather than classmethods, so every unregistered value raised TypeError instead of extending the enumeration (#492, #503).
• the string-keyed get() in pcapkit.const.ftp.command and pcapkit.const.http.method tested membership with the raw key but registered key.upper(), so the first lowercase or mixed-case token raised TypeError: 'RETR' already in use. Reachable from wire data: pcapkit.protocols.application.ftp matches with re.I and passes the match verbatim, and RFC 959 Section 5 makes FTP commands case-insensitive, so retr file.txt was a valid request the library could not parse. get() and _missing_ now look the key up under the canonical upper-case name, so every casing resolves to the existing member; a duplicate GET would have lacked the real one's safe and idempotent attributes (#582, #583). http.method no longer folds case: RFC 9110 Section 9.1 makes the method token case-sensitive, so Method.get() matches it exactly (#896, above).
• get()'s documented default was ignored on the integer path across the generated pcapkit.const tree, because _missing_ cannot see the caller's default -- Hardware.get(99999, 0) raised ValueError instead of returning 0. The integer path now consults default before letting the error escape. -1, the placeholder the generated signature already carried, still separates "no default" from "a default"; #859 replaced it with an identity sentinel once the shared base #858 (below) put get() behind one call site. The sweep covers the integer registries generated from the shared template, not only those #584 named; pcapng OptionType and reg AppType carry a bespoke integer fallback and are deliberately left alone, since neither drops a default by raising. Not reachable from wire data, so a contract fix rather than a parse fix (#584).
• _missing_ in the Mobility Header flag enumerations (BindingACKFlag, BindingUpdateFlag, HandoverACKFlag, HandoverInitiateFlag) ended in return cls(value), the constructor that had just failed, so every in-range value that is not already a member re-entered _missing_ unbounded and raised RecursionError -- F(0), no flags set, and every composite such as BindingACKFlag(0x06). Defining _missing_ at all caused it, by shadowing the aenum Flag machinery that resolves exactly those values; pcapkit/const/tcp/flags.py had none and so never had the defect (it has one now, from #647 below, with the same tail). Each now ends in return super()._missing_(value), as pcapkit/vendor/default.py emits and most const modules (#647's new ones included) already did, so F(0) is an empty flag and BindingACKFlag(0x06) is S|D. Minting through extend_enum was rejected for a flag type: naming 0x06 Unassigned_0x06 would hide the composite and add a member per bit pattern. The range guard is untouched (#623).
• constant registries rejected an invalid value differently from the built-in enum, or did not reject it at all. Flags, ftp.command.CommandType and reg.apptype.TransportProtocol are IntFlag types with no _missing_, so aenum composed a pseudo-member for any integer: Flags(-1) returned 65520 (every TCP flag set, from a value no 16-bit field can hold) and Flags(-65536) none. ftp.command.Command, FEATCode and http.method.Method are StrEnum types whose _missing_ called value.upper() before checking the type, so an integer raised AttributeError. These now raise a bare ValueError, as enum.IntEnum does and the other modules already did. #647's proposal to replace those with pcapkit.utilities.exceptions.EnumError was deliberately rejected: EnumError is (BaseError, TypeError), not a ValueError, so it would diverge from the built-in, walk past the except ValueError in every generated get() body (silently undoing #584), and log CRITICAL from BaseError.__init__ once per discarded default. The one deliberate divergence is kept and pinned: mutable registries look up, miss, and extend_enum rather than raising, so Method('FROBNICATE'), ProtectionAuthority(1 << 70) and AppType.get(65000, proto=tcp) still register; the #775 and #860 entries below record how each came to return an unregistered member instead. The flag guards end in return super()._missing_(value), so in-range composites still decompose and #623 stays fixed; Flags accepts 0 <= value <= 0xFFFF. A new tests/const/test_const_enum_builtin_parity.py asserts that every registry raises the same exception type as a stdlib enum.IntEnum; it keys on aenum.Enum because an IntFlag is not an IntEnum subclass, which is how the IntFlag ones escaped the existing sweeps (#647).
• a breaking change to AppType.get(): an out-of-range port is refused rather than minted. Its except ValueError caught the range rejection from _missing_ and minted regardless, so AppType.get(-1, proto='tcp') returned an unreachable PORT_-1_tcp while TCP(-1) raised. It now tests _missing_ for None ("no row for this port") and lets the rejection through; a valid but unassigned port still minted, until #874 (below) made it an unregistered member. Transport._make_port() passes an unvalidated int, so TCP.make(srcport=99999) now raises where it minted junk; in 1.4.1, TCP(srcport=N) raised AttributeError for any bare int. Separately, the crawler rendered one _missing_ branch per registry row, so the spans IANA registers on more than one transport emitted the same condition twice and every registry answered with the first: AppType.get(6010, proto='udp') gave a member whose proto read tcp, 6666/udp answered ircu rather than reserved, and proto='sctp' minted x11 where IANA assigns nothing. A branch naming a transport now tests cls.__transport__; the branches naming none are unchanged (#764).
• a breaking change to AppType._dispatch(): it resolved a proto naming several transports by its lowest set bit, and tcp is lowest, so every composite containing it dispatched into the TCP registry -- silently, and undetectably to a caller checking equality, since AppType.__eq__ compares on port alone. TransportProtocol was still an aenum.IntFlag and a member's proto carried the whole set IANA assigned the service, so tcp | udp was an ordinary value to pass back in; the AppType.proto and TransportProtocol entries above record how #806 and #808 later retired both. Over every multi-transport member this misrouted port 888 (accessbuilder resolved to TCP's cddbp) and port 999 (puprouter resolved to TCP's garcon). It now raises ProtocolError, a ValueError subclass, so the documented contract holds. No library caller passes a composite (#759).
• get()'s string-key miss and every generated registry's _missing_ bounded-range branch called aenum.extend_enum() on an unrecognised value, so e.g. Hardware(40) minted a permanent member. Fixed at the shared sites in pcapkit/vendor/default.py, plus a new register(value, name) base classmethod for the caller-named path that still mints. Every generated registry is updated; the non-minting get() miss applies to all of them, but the _missing_ fix changes behaviour only for those with a bounded-range extend_enum branch. pcapkit/toolkit/scapy.py and pcapkit/toolkit/pyshark.py fed get() a string key with no default and now raise MissingKeyError instead of receiving a placeholder; the reader sites in hopopt.py/ipv6_opts.py convert the KeyError into ProtocolError. Riding along: pcapkit/toolkit/pyshark.py gains a FILTER_NAME_TO_LINKTYPE map (eth to ETHERNET, tr to IEEE802_5), consulted ahead of LinkType.get since pyshark reports a filter name, not a DLT name. The other minting call sites in _missing_, get and the hand-written mh.py and ngap.py were deferred; the register/register_alias sites are not deferred but the by-design caller-named path (#838).
• a breaking change to pcapkit.const.ipx.socket.Socket's _missing_: archived range branches that were strict subsets of a range tested earlier -- (0x0020, 0x003F) after (0x0001, 0x0BB8), and (0x4000, 0x4FFF) and (0x8000, 0xFFFF) after (0x0BB9, 0xFFFF) -- so they never fired. The generator pcapkit/vendor/ipx/socket.py now lists each subset range ahead of the range containing it. 36891 of the 65521 values that _missing_ resolves (56.3%) change name: 32 from Registered by Xerox to Experimental, 4095 from Dynamically Assigned to Dynamically Assigned Socket Numbers and 32764 from Dynamically Assigned to Statically Assigned Socket Numbers. No defined member changes and every value still resolves (#847).
• LinkType(209).name returned 'IPMB_LINUX', which tcpdump's own table marks "Legacy names (do not use)", because a 2024-05-04 regeneration emitted that row above the current I2C_LINUX = 209 and aenum gives a value to the member defined first. pcapkit/vendor/reg/linktype.py sinks a row whose note mentions "legacy" after every current row, so the current name is defined first; in the registry crawled for this release that affects value 209 alone. IPMB_LINUX stays a reachable alias (LinkType['IPMB_LINUX'] still resolves to 209). Not breaking: only the canonical name for the shared value moves (#848). The rule sinks only a row whose value another row also holds, counting values inside ranges, so a current row that merely mentions a legacy name stays first (#852, #854).
• a breaking change to more const registries' _missing_: applies the owner's mint/unmint ruling (settled on #847, confirmed on #775: a final, concrete assigned name mints, and a notation for readers does not) across the _missing_ files still calling extend_enum. Most convert wholly, each minting a bare status word (Unassigned, Reserved [...], Reserved for Private/Experimental Use, Unspecified in the IANA registry, Deprecated), which the ruling treats as a notation rather than an assignment. Some are mixed: EtherType's DEC Unassigned and "Old Xerox Experimental values. Invalid as an Ethertype since 1983." branches convert, while vendor-company names (Xyplex, Motorola, Walker Richer & Quinn and others) keep minting, since a proprietary protocol has no public name beyond the company's; IEEE802_3_Length_Field and Berkeley_Trailer_encap_IP also keep minting but are not company names. Socket (ipx)'s allocation-policy names (Experimental, Dynamically Assigned Socket Numbers, Statically Assigned Socket Numbers, Dynamically Assigned) convert, while Registered by Xerox keeps minting, a real ownership fact. Left alone are CGAType, whose Tag_<hex> mint is not an IANA-style range, and the files holding the classes #860 moves onto EnumRegistry (the AppType, StatusCode, ftp.return_code, ftp.command, Method and OptionType modules; #869 and #874, below). Each conversion changes both the vendor crawler and the generated file, per #838's and #858's precedent. The worked examples in docs/source/contributing/conventions/mint-criterion.rst keep Registered by Xerox under Mint (#861).
• a breaking change to EtherType's _missing_ ordering: values 0x0101-0x01FF now resolve to their Old Xerox Experimental name instead of an IEEE802_3_Length_Field_0x0101-style one. The generated method tested 0x0000 <= value <= 0x05DC (IEEE802.3 Length Field) first, and the Old Xerox range sits wholly inside it, so that branch was unreachable. Unlike #841's IPX fix, these bounds come from the live IANA CSV, so the fix is general: pcapkit/vendor/reg/ethertype.py's process() collects range rows and a new EtherType._insert_range places each ahead of the first already-placed range that fully contains it, leaving non-overlapping pairs in CSV order; this pair is the only containment among the CSV's ranges. Closes #862 (#865).
• a breaking change to Method: __new__ called str.__new__(cls) with no argument, so every registered member's str payload was empty regardless of value -- str(Method.GET) == '' and Method.GET == 'GET' was False; .value was always correct. #869 (above) had fixed the unregistered path only, leaving str(Method('frob')) == 'frob' beside str(Method.GET) == ''. Fixed to str.__new__(cls, value), mirroring Command.__new__, in the generator (pcapkit/vendor/http/method.py) and the generated module. No sibling hand-rolled __new__ has the defect (OptionType/AppType deliberately store a display string). Consequences, all corrections: Method.GET == 'GET' is True; bool(Method.GET) flips False to True; json.dumps(Method.GET) emits "GET" not ""; sorted() is lexicographic rather than input-order-stable; and {m: ... for m in Method} gains an entry per member where it had one, because every member previously hashed as '' and compared equal. Nothing under pcapkit/protocols relied on the old behaviour. Closes #870 (#871).
• a breaking change to TransportProtocol and AppType: step 2 of #860, the AppType half (the other bespoke registries were #869, above). AppType and its transport subclasses move onto EnumRegistry and both mint sites -- _missing_'s range branches and get()'s own mint (PORT_{port}_{transport} -> 'unknown') -- now build through a new _unregistered_member override that reconstructs svc/port/proto, per the owner's ruling that only IANA-registered values are legitimate and that get() lacks the information to create new ones. Every branch converts, including those naming a real service assigned to a whole port span (x11, active-net, satvid-datalnk, vrml-multi-use, ircu, swx, flex-lm); unlike FEATCode's fix (#869, above) there is no import-time self-mutation to cure by declaring members statically, so these stay deliberately unregistered lookups. AppType gains a working register(); the base's would have built a member with svc='<null>'. The breaking part: TransportProtocol moves from power-of-two values (tcp=1, udp=2, sctp=4, dccp=8) to sequential auto() (sctp=3, dccp=4), per the owner's follow-up ruling once |-joined composites stopped being parsed. AppType.get() treats whatever int it is given as a whole, so the renumbering changes what specific integers mean: on AppType.get(80, proto=...), a bare 4 resolved to SCTP.http on main and now silently resolves to DCCP.unknown, because a real member sits at 4 under both numberings; a bare 8 used to mint DCCP.PORT_80_dccp and now raises ValueError. The composed-value case is deliberately untested, per the owner's ruling that a breaking change already retired that path (#874).
• closes the remaining scope of #775: EtherType and Socket, the last registries whose _missing_ minted a permanent member, now return a non-registering cls._unregistered_member(value, name). The issue's AST census of extend_enum in _missing_/get is down to the single CGAType carve-out (its mint is not an IANA-style range). EtherType(0x0888) used to add a member to __members__ and return the identical object on a repeat; it now returns <EtherType.Xyplex_0x0888: 2184> with __members__ unchanged, absent from _value2member_map_, equal but not identical across lookups -- likewise Socket(0x0010). The regenerated EtherType was not checked against the live IANA CSV, only against the committed fixture. Keeping each branch's hex-suffixed name reintroduces the value-derived shape test_const_enum_no_mint.py's is_manufactured() sweep forbids; rather than weaken the predicate, a narrow exemption covers exactly these files, since the collision the check guards against cannot occur once _unregistered_member never registers (#878).
• OptionType.register() and Command.register() built members that get() could not find again, and OptionType.register_alias() raised not a registered OptionType for every argument. Both registries now round-trip through get(), in the generated files and the vendor templates (#1311, #1330, #1369).
• the Quick-Start function registries rejected 9 to 15, though RFC 4782 gives the Function field four bits; the whole 4-bit range now resolves (#1350, #1353).
• every three-digit FTP reply and HTTP status code resolves, including those no registry row names (#1443, #1444).
• the AppType registry's dict union is defined only on interpreters whose dict has one (#1694, #1703).
• NGAP's ProcedureCode and ProtocolIE are generated into pcapkit.const.ngap from pycrate's compiled NGAP specification, with no network fetch. An unseen value gets a non-registering member, where every unknown key used to mint a member at the shared value -1 and so aliased every other (#880, #899).
• FEATCode.get() matches case-insensitively, as RFC 5797 Section 2 defines FEAT codes; the registry-wide case-sensitivity audit found no other registry that needed to fold (#903, #913).
• register refuses what get refuses. TCP.register(70000, 'x') and Hardware.register(70000, 'x') minted a member that get then returned, because no registry overrode the _validate_value hook register calls. Each generated registry, AppType included, now overrides it with the check its _missing_ makes, raising EnumValueError. get(value, default) on a value the hook refuses still returns default and logs nothing (#1792, #1818, #1816, #1823; the quiet miss is #1845, #1873, under pcapkit.corekit). AppType.register() and OptionType.register() keep that rejection loud inside a quiet get, as EnumRegistry.register() does (#1916, #1927).
• Command.get() refuses a key that is not a str with EnumValueError, as Method.get() does. get(b'\x01') minted a member keyed by bytes, and get(-1) raised AttributeError whatever its default (#1824, #1826).
• IANA's port spans that name no transport answer AppType.get() with the asking registry's transport rather than TransportProtocol.undefined, as its unknown fallback for a port in no span already did: TCP.get(8012) is unassigned [tcp]. A port IANA lists on other transports only stays unknown: 8011 is reserved [tcp] and bier-echo [udp], and unknown [dccp] and unknown [sctp]. Lookups still mint nothing (#860) and an out-of-range port still raises (#2048, #2052).
• Method._missing_ resolves an HTTP method whose registered name differs from its own value, so Method('baseline-control') and Method('version-control') give BASELINE_CONTROL and VERSION_CONTROL rather than minting an unregistered member: the lookup falls back to the value map on the upper-cased value before it mints. Method.get() stays case-sensitive (#2284, #2351).

pcapkit.corekit

Added

• tests/corekit/test_fields_numbers_width_repair.py, covering each octet boundary in its own method, since the defect is a pattern and a single case would pass against a fix that special-cased the reported width (#599).
• FieldBaseShortReadPaddingSideTests, covering both byte orders at 2, 4 and 8 octets and every truncation point, including the figures #604 reports, plus guard rails for a full read and for a read against an empty buffer, the #431 behaviour the option and list loops depend on (#604).
• EnumLookup, the base carrying get and get_all that EnumRegistry and the non-registry enumerations share (#877, #906, #921, #932). Its get raises pcapkit exceptions in the shape of the stdlib Enum: a name miss raises EnumKeyError, a KeyError (#923, #927).
• MultiInfo and OrderedMultiInfo, immutable Info subclasses that are also a MultiDict and an OrderedMultiDict, so a repeated key keeps every value. The data models' option lists use them (#1484, #1523).
• pcapkit.corekit.fields.byteorder, holding packet_byteorder and byteorder_callback, the byte-order helpers the PCAP and PCAP-NG schemas share (#1528, #1711, #1715).
• can_seek(), whether a stream really seeks: on Windows a pipe answers seekable() with True while its seek does nothing. It trusts seekable() only for a regular file or a stream with no descriptor. Extractor wraps any other stream in SeekableReader, so pcapkit - reads a Windows pipe (#2097, #2104), and advance() skips a record on one by reading (#2108, #2118, 93a6173ae).

Changed

• Probe, CipherSuite and IntegritySuite are Info subclasses rather than typing.NamedTuple. They are Mappings now, so len() and iteration yield field names rather than values. TCPSegment in pcapkit.toolkit.pcap stays a typing.NamedTuple, since it is built for every TCP frame and an Info costs more to construct.
• ModuleDescriptor.klass reads an already-imported module out of sys.modules rather than re-entering importlib.import_module, since next layer dispatch resolves a descriptor there on a per-frame path. Neither a registry hit holding a ModuleDescriptor nor a miss writes the resolved class back: a memoised hit went stale on importlib.reload (#1559), and recording a miss in a class-level collections.defaultdict is the defect #421/#426 fixed at this layer, #425/#428 for the option, chunk and block registries, and #555/#560 at the schema layer. A resolution now costs ~117 ns rather than ~436 ns, which is not measurable in extract() wall clock. The change is taken for its shape: sys.modules stays the only module cache, whereas a memo of the class would serve the pre-reload class after an importlib.reload forever and fail isinstance against the live one. Proposed by @Ts-Boom in #563; the implementation differs because that one added a second, never-invalidated cache of resolved classes (#574).
• SeekableReader.truncate() raises instead of returning a size, and the misspelled writeable() is now writable(). Both break external callers; nothing inside the package calls either. io.IOBase documents one gate over two methods -- "If False, write() and truncate() will raise OSError" -- and this reader's writable() answers False, yet truncate returned its new size, where open(path, 'rb').truncate() raises. The refusal is UnsupportedOperation('truncate'), the same one write raises; pcapkit's subclasses io.UnsupportedOperation. The old resizing is kept as the private _truncate_buffer: it resizes a private lookback window, not the stream, and it is the only route to the "position sits before the window" state that seek and the buffered read paths must refuse, for which #643 and #644 landed tests. writeable() was never an override of anything, so io, shutil and third parties never saw it, and the value reported is unchanged (#645).
• a breaking change to @final, now enforced at runtime on Info and Schema. info_final and schema_final both end return final(cls), so every finalised class carried typing.final's __final__ marker and nothing read it. @final alone on an Info or Schema subclass -- without @info_final or @schema_final -- now raises InfoError or SchemaError at first construction, the class being marked final but never finalised and so carrying no generated __init__. __init_subclass__ cannot catch that, since final applies after class creation, so the check sits in the existing one-shot FinalisedState.NONE branch and a finalised class pays nothing. Deriving from a finalised class raises too, from new Info.__init_subclass__() and Schema.__init_subclass__() hooks (before, only EnumSchema had one). SchemaError is a ValueError, so code catching TypeError around a subclass declaration will not see it. @info_final @final and @final @info_final both finalise silently; the re-entry check keys on __finalised__ rather than __final__, because only the former records the decorator having run. @info_final twice warns and returns the class unchanged. pcapkit.utilities.compat takes final from typing_extensions below 3.11 rather than 3.8, because typing.final only records __final__ from 3.11. The guard cannot fire on the library's own classes (#778).
• a breaking change to Info.to_dict(): it returns an OrderedMultiDict at every level rather than a dict, so a key that repeats, such as a second IPv6 extension header of one type, survives a from_dict(to_dict()) rebuild. type(d) is dict no longer holds (#1453, #1466, #1484, #1523).
• a breaking change to pcapkit.utilities.decorators: it moves to pcapkit.corekit.decorators, with no re-export. seekset, beholder and prepare are no longer importable from pcapkit.utilities, and the module logs as pcapkit.corekit.decorators (#1735, #1737).
• a breaking change to the sentinels: all live in pcapkit.corekit.sentinels, which exports the objects NULL, NO_VALUE and NO_DEFAULT and their common base Sentinel, but not their types, and NoValue is spelled NO_VALUE (#916, #911, #922, #937, #939). No moved name keeps a re-export, so NoValueType has only that home, not its 1.4.x one in pcapkit.corekit.fields.field (#1744, #1754).

Fixed

• stdlib exceptions leaking out where the library's own were promised: a malformed IP field value raised a bare ValueError instead of FieldValueError (#465); a bool address was silently packed as 0.0.0.1 or 0.0.0.0, bool being an int subclass (#491, #500); and @prepare discarded extra arguments silently and treated a declared zero length as end of stream, which is now distinguished from a genuinely exhausted one and raises StreamEOFError (#454, #458).
• FieldBase.unpack() zero-padded up to a field's declared length with rjust() however little data buffer held; a ~40-octet PCAP-NG Decryption Secrets Block with a bogus inner length forced a multi-gigabyte allocation, since length is often wire-derived. A declared length past 262144 octets -- libpcap's MAXIMUM_SNAPLEN and this package's default snaplen -- that the buffer cannot back now raises FieldValueError; the option and list loops' tolerance for a short read past a truncated area (#431) is far under that ceiling and untouched (#554).
• that ceiling bounds one field, and a packet holds many, so the sum of a parse's zero padding was still unbounded: 200 minimal PCAP-NG Decryption Secrets Blocks (4,800 wire octets, each declaring secrets_length 262,142 against two supplied octets) retained 50.0 MiB, 10,922x per block, with the per-field guard never firing. FieldBase.unpack() now keeps a per-context ledger of octets supplied against octets synthesised, and raises FieldValueError once the total of shortfalls past 65,536 octets passes 262144 + 16 * supplied. The same 200 blocks retain 0.2 MiB (54.6x). A shortfall of 65,536 octets or fewer, the span of a 16-bit wire length, is padded unconditionally and charged to nothing, so no snapshot-truncated capture is subject to the budget; without that band the same legitimate frame parsed differently depending on what had been parsed before. What this does not close: a length declared by a 16-bit field can still be repeated without limit, and at this layer a crafted file is indistinguishable from a legitimate snapshot-truncated capture of offload-sized segments; separating them needs the frame's own incl_len/orig_len. Nothing resets the ledger, so it bounds everything a context has parsed rather than one file (#573).
• which exception a malformed TCP SACK option raised depended on unrelated process state: a clean interpreter raised ProtocolError as documented, but a process that had popped pcapkit.corekit.fields.misc from sys.modules (as the #439 ABC-cache regression tests do in every setUp/tearDown) raised FieldValueError from a different layer, before the documented check (#525). ListField.unpack() resolved SchemaField through a function-local import re-run on every call; a module reimported mid-process is a second, distinct class, so isinstance misclassified the field and billed each item by its declared length instead of what it consumed. Any caller relying on the previously-observed FieldValueError now gets ProtocolError, deterministically, matching the docstring.
• a NumberField whose length was a callable could not pack or parse at any width struct has a native integer code for. length is -1 until the callable resolves, -1 has no native code, and the template builder raised _need_process for it and never cleared it -- a latch. Resolving the real width rebuilt the template but left the latch set, so pre_process handed bytes to a template that had become >Q (struct.error: required argument is not an integer), and parsing failed in mirror by calling int.from_bytes on an integer struct.unpack had produced. The flag is now recomputed from the width in force, which also keeps a callable resolving to a width with no native code (3 octets) byte-packed. Every native width (1, 2, 4 and 8 octets) was affected, not only the 8 reported, on NumberField and EnumField alike. This made every extended 8-octet MPTCP DSS form unbuildable, those widths being chosen at runtime from the DSS flags; #585 worked around it in the TCP schema alone (#591).
• NumberField.pre_process() sized a value with floor division dressed as a ceiling. When a field is packed while length is still the -1 placeholder, the width came from math.ceil(value.bit_length() // 8); the // had already floored, so math.ceil did nothing and the width was one octet short: 256 at one octet, 65536 at two, 16777216 at three. The reach is wider than "just past a boundary": every bit length that is not a multiple of eight is wrong, so 1 (bit length 1, floored to zero octets) and every value from 1 to 127 failed too. It is now the ceiling it was meant to be. The repair is reached only by packing a field the caller never resolved (a schema resolves every field first), which is why #591's suite, whose values all had byte-aligned bit lengths, missed it; #591's fix neither caused nor masked it. Deliberately left alone: a signed field is sized without room for its sign bit, so an unresolved signed field still cannot pack 128. The same typo in the ILNP nonce option builders is a separate change (#599).
• FieldBase.unpack() padded a short read on the wrong side. When a buffer falls short of the declared length -- the accommodation that lets a snapshot-truncated capture parse (#431) -- the shortfall was zero-filled with rjust(), placing the zeros at the front, as if the octets never read were the leading ones; a short read has lost the trailing ones. It is now ljust(), correct for both byte orders: one octet of a four-octet little-endian 120 read as 2013265920, and three octets of a four-octet big-endian 0x01020304 as 0x10203. A full read is untouched (#604).
• SeekableReader.truncate() put its padding where the reader's bookkeeping says the content is, and read then returned one octet fewer than the buffer held. Same family as #604, but separate defects. The buffer keeps content at [0:_buffer_cur] with padding behind it, so a reduction must keep the octets it has and an extension must append at the tail; temp[-size:] sliced the buffer rather than the content, keeping trailing padding and discarding octets read, and temp.rjust(size) prefixed the zeros. Separately, read capped at min(size, self._buffer_cur - 1), one short at the start and reaching into padding further in, and made up the shortfall from the stream past the skipped octet. The reported symptom needed both: read(4), truncate(8), seek(0), read(8) over b'abcde' returned b'\x00\x00\x00e' and now returns b'abcde'. Further contract faults are fixed with it: the position was reset to the buffer start rather than left alone; an omitted size resized to 0 rather than the current position; and _buffer_cur was left addressing octets a reduced buffer no longer had, so the next read raised ValueError: memoryview assignment: lvalue and rvalue have different structures from _write_buffer. truncate(0) raised the same by a second route (buf[-self._buffer_size:] is buf[-0:], the whole buffer), so _write_buffer now counts from the front; that state is reachable only through truncate. A reduction also advances _buffer_set past the dropped octets, keeping _buffer_set + _buffer_cur equal to how far the stream has been consumed, which seek reads as its licence to fetch more; clamping _buffer_cur alone made that sum under-report, and the next forward seek silently spliced in octets from the wrong offset (read(8), truncate(3), seek(6), read(1) over b'abcdefghijklmnop' returned b'l' where b'g' sits at offset 6). Latent rather than live: nothing here calls truncate, though it is public (#622).
• the 16-bit band the #573 entry above records as deliberately left open: a length declared by a 16-bit wire field could still be repeated without limit. The crafted PCAP-NG of 2,000 Enhanced Packet Blocks, each with an option declaring 65,535 octets against four real ones, synthesised 1,637x its size in zeros and now synthesises none, with every frame and option still parsed. The bound is taken one layer up, where the missing information exists: a PCAP-NG block's Block Total Length is authoritative and cross-checked against its trailing copy, so the option area is that length less the fixed fields, captured_len and its padding, and an option declaring more payload than the area has left is malformed. A snapshot-truncated capture says so through captured_len and leaves its options whole, so it never trips this -- which the #571 len(buffer) < length rejection could not distinguish, and why it was declined. A new bounded_option clamps the payload to the octets the area has left and warns with SchemaWarning; it is applied to every variable-width option and record payload in the PCAP-NG schema, and deliberately not to the block-level payload fields, the 32-bit band the running ledger already budgets. A companion bounded_area clamps a packet block's option area to the octets the block itself holds less the trailing Block Total Length: the area was otherwise sized from a declared length nothing checks against the file, so a block declaring 1,000,000 octets while holding 36 synthesised 65,535 zeros with no warning. Both are no-ops on a well-formed block. The non-packet blocks' option areas keep the framing assumption; the general fix for a declared length reaching a read is #678. Clamping rather than refusing keeps the #431 accommodation, since a PCAP-NG block read has no catch point above FieldBase.unpack() and one refusal would abort a whole extraction rather than one block; and the clamp reads only the block's own declared framing, never a running total, so identical input answers identically whatever preceded it. The skip for a remainder already past zero is load-bearing on the unpacking path, where clamping would give the field a negative template such as '-2s'. No clamp fires on the sample captures, and #678's uncaught ValueError on truncated input is unchanged (#594).
• a breaking change to FieldBase.length: it called struct.calcsize on a template built from a negative resolved length (e.g. '-5s', from a length= callback whose running counter had been overdrawn), raising a bare struct.error that ordinary caller code does not catch. The chokepoint every affected schema shares now raises ProtocolError, covering application/{ftp,httpv1,httpv2,ngap}.py, internet/{hip,ipv6_route,mh}.py, link/ethernet.py, misc/pcapng.py and transport/sctp.py with no other file changed; a non-negative length is unaffected. This closes the follow-on the httpv2 length-guard entry under pcapkit.protocols filed as out of scope (#805).
• a breaking change to EnumRegistry.register(): it now raises ValueError naming the existing member and pointing at register_alias(), where it used to silently alias an already-registered value under the caller's new name -- aenum treats a taken value as an alias request, so register(existing_value, 'TOTALLY_NEW_NAME') returned the existing member, minted nothing and raised nothing, contradicting its docstring. pcapkit.corekit.enum.EnumRegistry is a new mixin implementing get, get_all, register, register_alias, register_aliases and _unregistered_member once, per the owner's ruling on #842; it first converts registries with no bespoke __new__ (ipv6.extension_header.ExtensionHeader, tcp.flags.Flags and the mh.*_flag modules), and serves IntEnum, IntFlag and StrEnum alike. The guard reaches only those: the other const registries still carry the old generator's bare extend_enum(cls, name, value), so pcapkit.const ships contradictory register contracts until #858 (below). These also gain the generated template's KeyError catching on a missing name, so Flags.get('NOPE', 2048) returns Flags.ACK rather than raising; and a key that is neither int nor str, which raised TypeError on the IntFlag registries (Flags.get(3.5)), now raises ValueError, tried as a value. On ExtensionHeader it raised KeyError, the shift #858's entry attributes to the other registries (#855).
• a breaking change to EnumRegistry.register(), extended: the const registries still on the generated template's bare extend_enum now inherit the guard #855 (above) added, so TransType.register(6, 'TOTALLY_NEW_NAME') raises ValueError naming the value and the member that holds it and pointing at register_alias(), where it used to mint and raise nothing. pcapkit/vendor/default.py's template now emits class {NAME}(EnumRegistry, IntEnum) and drops its own get/register/_unregistered_member. The modules with a bespoke __new__ (ftp/command, ftp/return_code, http/method, http/status_code, pcapng/option_type and reg/apptype among them) are left alone, so every other class inherits EnumRegistry (#855). get()'s dispatch shifts only for a key that is neither int nor str (KeyError, tried as a name; now ValueError, tried as a value), a key type nothing in the library passes. pcapkit/corekit/enums.py is renamed enum.py, the owner's ruling (#858).
• EnumRegistry.get()'s str-key branch tried only a name lookup (cls._member_map_[key]) and on a miss raised or returned cls(default), never the value path, so on a StrEnum registry a key that resolved through the constructor (_Str('known-value')) raised KeyError through get(), and a supplied default overrode a good value match the code never attempted. It now falls back to a plain _value2member_map_ lookup once the name lookup misses and before consulting default. Deliberately not cls(key): FEATCode._missing_() (pcapkit/const/ftp/command.py) mints via extend_enum for any unrecognised string, so routing through the constructor would let a failed name lookup mint a permanent member once a registry like it converts; a dict lookup never reaches _missing_. A name still wins when a string is both a name and a different member's value. Step 1 of #860; step 2, converting the bespoke registries, follows (#869, #874, below). The non-str path is unchanged. Widens rather than breaks: a call that raised KeyError now resolves, and no caller that got a correct result gets a different one (#863).
• a breaking change to EnumRegistry.get(): its docstring claimed "It never mints", but each cls(default) call site reached _missing_ for a default inside a still-minting registry's range, growing the registry as a side effect of resolving default rather than key. Per the owner's ruling that only register() mints, and get() only through the ranges _missing_ mints, each site now resolves default through a plain _value2member_map_ lookup; key resolution is unchanged, so EtherType.get(0x0888) still mints Xyplex_0x0888 through its own _missing_, as #775's deliberate exception permits. A default naming no registered member now falls through to the error key itself would have raised, rather than a fresh error about the default -- the accepted cost of the ruling. The docstring's "It never mints" is qualified to default only. So Hardware.get('Definitely-Not-A-Member', 40), with 40 in Hardware's declared-but-unassigned range, now raises KeyError naming the original key. Closes #864 (#868).
• ProtoChain.__add__() returned the left operand's cached protocols and aliases: once a.protocols had been read, a + ProtoChain(IPv4) reported chain == 'Ethernet:IPv4' but protocols == (Ethernet,). copy.copy(self) carried the cache across; the result is now built fresh, as from_list builds one, and += follows, since it falls back to __add__ (#1099).
• a SchemaField with no declared length handed its -1 placeholder to the nested schema as that schema's length, so every item of such a list warned packet length < 0: a HIP LOCATOR_SET and an MH CGA Parameters item among them. SchemaField.unpack() now passes what is left in the buffer as a declared length -- not None, which would turn a truncated item's FieldValueError into prepare()'s quiet StreamEOFError. Fixed-length items are unchanged; the HTTP/2 SETTINGS pair, whose size is fixed, is given it in its own schema instead (#1140, below) (#1148).
• a signed NumberField decoded as unsigned, a zero-length PayloadField misread, and an empty Raw did not rebuild (#1331).
• from_dict(to_dict()) lost nested values, and len() of an Info counted its hidden keys (#1334).
• StringField packs back exactly the octets it unpacked, where a guessed charset, a U+FFFD substitution or a character-count length used to change them; the decoded text is unchanged (#1293, #1336). A charset that rejects 'replace' falls back to UTF-8 (#1706, #1728), and Python 3.8 unquotes through pcapkit.utilities.compat.unquote (#1693, #1707).
• IPv4InterfaceField keeps a mask that is not a netmask, and a deep copy of an OrderedMultiDict keeps its order (#1346).
• a breaking change to padding: non-zero padding octets are kept on rebuild rather than zeroed (#1223, #1436).
• fields keep the bits and octets they captured on rebuild: a BitField's unnamed bits (#1487, #1495), a NumberField's bits outside bit_length (#1488, #1497), and the bytes an untyped ListField unpacked (#1489, #1494). An unnamed ListField, PayloadField or SchemaField gets a default name (#1491, #1493).
• each non-final Info subclass is finalised on its own state (#1490, #1496), and its constructor reads only the class's own annotations (#1692, #1702).
• copying or pickling a stream proxy no longer recurses (#1524, #1544).
• @prepare reads length and packet by keyword as well as by position, so Schema.unpack(data) and Schema.unpack(data, length=2) work where they raised IndexError (#444, #450).
• ListField unpacks a schema item from the per-item copy its callback and length_callback configured, not from the unconfigured original (#433, #453).
• an *IntField given a signed= that contradicts its fixed sign, such as UInt8Field(signed=True), raises FieldValueError; the argument used to be discarded silently (#545, #549).
• negative lengths raise ProtocolError rather than a bare stdlib error: FieldBase.length tells a malformed template from a negative resolved length (#825, #827), and NumberField checks a negative resolved length and a negative bit_length (#828, #829, #831, #834).
• ModuleDescriptor.klass raises ProtocolError for a class name that resolves to nothing, or one never given, rather than a bare AttributeError; the registry modules share one NULL sentinel compared by identity, where each had its own string (#832, #833, #835).
• PortEnumField given a proto with no .name -- a string such as 'tcp', or a composite such as TransportProtocol.tcp | TransportProtocol.udp, which is a bare int -- raised AttributeError on a port the registry does not hold. The miss takes its transport from the registry's __transport__, as AppType.get() does (#1774, #1781).
• EnumLookup.get() answers a value miss quietly, whether default answers it or the miss is raised: a registry's _validate_value rejection logs nothing and installs no exception hook there, while EnumRegistry.register() still reports the same rejection loudly (#1845, #1873).
• each sentinel is a singleton, as None is: calling its type, copy, deepcopy and pickle at every protocol give back the one object, and NO_VALUE reprs as its own name rather than as an object address. Their new common base, Sentinel, is public; a sentinel's type cannot be subclassed, and neither it nor the sentinel takes an attribute write. A pickle written before this change at protocol 0 or 1 still loads, though not as the singleton (#1841, #1842, #1876).
• defects off CPython on Linux. On GraalPy, SeekableReader's reads aliased a buffer a later slide rewrote, so they copy out of it, and a MultiDict nested each value list, so it is built from a dict (#1963, #1974); and a sentinel type refused the cache writes _py_abc makes, so isinstance against it raised TypeError (#1960, #1966). Field.pack hands struct a bytearray as bytes for the s, p and c formats, which PyPy refuses for s and p and GraalPy accepts for c where CPython does not, so it packs alike on every interpreter (#2004, #2007, #2015, #2018). On Windows, SeekableReader(buffer_save=True) with no buffer_path could not reopen its temporary file; it creates one it can, and deletes it on close() or collection (#2098, #2105).
• PortEnumField and SwitchField are exported from pcapkit.corekit, pcapkit.corekit.fields and pcapkit.all, and SchemaField, nested_packet_context and BytesField from the modules defining them, so import * binds them (#2174, #2191).
• a ListField callback is handed the per-item copy it configures, not the shared field, and a SchemaField with a callable length sizes its template from the resolved length rather than 1024s. No parse in the library reached either (#2173, #2190).
• PortEnumField range-checks the port it is handed, so a directly built TCP, UDP or SCTP schema raises FieldValueError for a port outside the field's width, where srcport=70000 was masked to 0x1170 and -1 to 0xffff. NumberField keeps masking, which is its documented contract; the NumberField and Schema docstrings now say that direct construction range-checks nothing, and name where the checks live (#2314, #2335).

pcapkit.dumpkit

Fixed

• a flag value with no declared bits no longer dumps as Type::None [0]. This changes user-visible output in every textual dump format. make_dumper's object_hook renders each enumeration member as Type::name [value] and interpolated the name unguarded, but a Flag value composed entirely of undeclared bits has name is None, so the literal None landed in the name half: Flags(0) rendered as Flags::None [0] in json, tree, text, txt, plist and xml, out of both Extractor and TraceFlow. A nameless member now renders with the value's decimal spelling, so Flags(0) gives Flags::0 [0] and Flags(8) gives Flags::8 [8]. That is the spelling the enumeration libraries use for an undeclared residue (Flags(2057).name is ACK|9), and it cannot be mistaken for a member name, since an identifier may not begin with a digit, whereas NONE is a real declared name elsewhere. The guard is on name is None and not on the value, because the defect was never about zero (Flags(1) and Flags(9) are equally nameless). Surfaced by #634, which made a flagless TCP segment reach this path (#648).
• tests/dumpkit/test_nameless_enum_rendering_unit.py (added by #670) carried probes assuming every flag-enum registry is 16 bits wide: test_scalar_return_renders_a_nameless_member_as_its_value used one fixed tuple ending in 65536, and test_no_flag_registry_renders_the_literal_none swept every registry but only against registry(0). Widths differ: ftp.command.CommandType 3 bits, reg.apptype.TransportProtocol 4 (computed at runtime), the mh ack/initiate flags 8, and mh.binding_update_flag.BindingUpdateFlag and tcp.flags.Flags 16. tcp.flags.Flags(65536) correctly raises (0 <= value <= 0xFFFF), so the sweep was failing on correct behaviour. The probes now derive each registry's bound from its declared members, and a new test pins that one past the widest in-field value is refused. Test-only (#702).
• the plist writer emitted mapping keys unescaped, so a key carrying &, < or > produced a report that is not well-formed XML. dictdumper's _append_dict interpolates the key into '<key>{item}</key>' and calls _encode_value on the value only, so both branches of pcapkit.dumpkit.common that build a mapping now escape their keys through one escape_key helper -- a MultiDict, where #575 escaped an enum-derived key inline and nothing else, and a plain dict, where nothing was escaped. The json, tree and text writers are untouched. A non-str key is escaped too: a PCAP-NG decryption secrets block keys TLS key log entries by a raw bytes client random whose repr can carry any of those characters. The upstream half is JarryShaw/DictDumper#125; this does not wait on it. The json writer's quoting defect stands, upstream as JarryShaw/DictDumper#121 (#772).
• the JSON writer emitted mapping keys unescaped, so the report of test.pcapng did not parse (Expecting ':' delimiter): its TLS key log is keyed by a bytes client random whose repr holds " and \. escape_key in pcapkit.dumpkit.common now JSON-escapes keys for JSON output, as #772 made it XML-escape them for plist, and the JSON report of every examples/captures/ file now parses. The upstream defect, JarryShaw/DictDumper#121, stands (#1152). The PCAP-NG end-to-end test of that report no longer skips; test-only (#1795, #1809).
• a breaking change to the dump schema: the output writers dropped or corrupted what the packets carried. An OrderedMultiDict, which every option list is, now dumps as a list of single-key entries in wire order (#1305). Inside an object the writers fall back on, a class, module or function is written as its qualified name rather than expanded, and an object met again on its own expansion path as <circular reference: T> (#1372, #1381).
• tree output raised on a complex value, and is now documented as lossy (#1266, #1366).
• plist dates are written to whole seconds, so plistlib reads them back (#1448, #1450).
• a PCAP trace record scales its fraction to the trace's resolution (#1500, #1529), and writes the octets it has rather than a truncated record's claimed length (#1541, #1543).
• a subclass of a dumper make_dumper builds recursed without end in its object_hook fallback, which called super(type(self), self) (#2144, #2146).

pcapkit.foundation

Added

• the engine='pypcap' and engine='pcap_ct' extraction engines, independent distributions of the same libpcap interface, and engine='pypcapfile' (#386, #405). They buy speed by doing less -- neither pypcap nor pcap_ct dissects at all, so they offer no reassembly or flow tracing, and pypcapfile has no IPv6 decoder. Install only one of pypcap and pcap-ct: both own the top-level pcap module, and with both present pcap-ct wins the import and the other becomes unselectable. The missing interface constants PyPCAP, PCAP_CT and PyPCAPFile are now exported alongside DPKT, Scapy, PyShark and PCAPKit (#412). Python 3.11 is the last interpreter on which every built-in engine can run, and even there pypcap and pcap-ct cannot coexist.
• EngineBase.unsupported_reason(), a preflight every engine answers and Extractor.run() consults before anything is imported. An engine that cannot run in the current environment now gives one warning naming the real cause (a Python version, a missing tshark or libpcap, the wrong pcap distribution) and a clean fall back to pcapkit's own parser, rather than an error from inside the third-party package (#396, #405). The same holds for an engine whose package is not installed at all (#1045).
• conflict on the reassembly data models: absolute, inclusive ranges where two fragments claimed the same span with different bytes, previously lost silently on both the IP (#482) and TCP (#443, #478) paths.
• the declarations that pair a __proto__ dispatch registry with the enumeration its codes come from, replacing the module-level tables that held the pairing apart from the __proto__ they describe. __proto_key__, on each class owning such a registry (Link, Internet, Frame, PCAPNG, TCP, UDP and SCTP), names that enumeration and whether a bare int is also valid (#2392); __proto_dest__, on the LinkType, EtherType, TransType and PayloadProtocolIdentifier registries, names the destination each enumeration keys, which is how code=<member> infers one without an explicit destination. Both are rendered attributes, and the vendor crawlers generate the latter from a new PROTO_DEST (#2403).

Changed

• layer= and protocol= are honoured rather than inert. Both were read under the wrong names, so every value a caller passed was dropped into **kwargs; the CLI's -L also now validates its argument. The packet context reaches the schema layer for the first time, so a field the wire elides can be resolved from its enclosing packet (#404). follow_tcp_stream dispatches on the engine type, where both branches of the old test were dead and the native adapter ran against every engine's frames (#402).
• reassembly and flow-tracing defaults moved (#435), visible to a caller. Datagram.completed widened from bool to a Completion enumeration (COMPLETE, PARTIAL, TIMEOUT); only COMPLETE is truthy, so if datagram.completed: is unaffected but datagram.completed == True no longer holds. TCP flow tracing is bidirectional by default, which merges each flow's two halves and closes one only once both have FINed -- 331 flows become 111 on the sample HTTP capture, the difference being single-frame stray tails; pass trace_bidirectional=False for the old behaviour. IP reassembly also gained the 60-second timeout [RFC 1122, RFC 8200], clocked off the capture's own timestamps, tunable with reasm_timeout=; TCP reassembly gets no timeout by default. trace_analyse= is new, and reassembles each traced flow's application layer.
• conflicting TCP overlaps resolve first-write-wins, per RFC 9293 section 3.10, where they had silently resolved last-write-wins (#443, #478). A deliberate, narrow behaviour break: a conforming retransmission carries identical bytes. IP fragment reassembly keeps last-write-wins, because RFC 791 specifies the opposite resolution, and records the disagreement instead (#482).
• renames with no compatibility alias left behind: HoleDiscriptor is spelled HoleDescriptor and its package alias TCP_HoleDiscriptor is TCP_HoleDescriptor (#350).
• subclass registration is opt-in for Engine, Reassembly, TraceFlow and dumpkit's Dumper (#514). Each registers if and only if its registry keyword is given -- engine= for Engine, protocol= for Reassembly and TraceFlow, fmt= for Dumper. Previously an absent keyword fell back to the class' own name, so every subclass of the public class was registered, and declining meant subclassing the parallel *Base class under an alias, which every built-in does (hence no public class had a subclass, while every built-in derives from its *Base class). This breaks out-of-tree code that subclasses one of these classes and relies on the derived key; pass the keyword, or call the matching register_* function. Nothing the library ships is affected, and the *Base classes remain importable. Silent failures are now loud: an unrecognised class keyword raises UnsupportedCall instead of being swallowed by **kwargs (passing name= to a Reassembly subclass silently ignored the key, since protocol= is the real one), and so does Dumper's ext= without fmt=. A class attribute is not an opt-in: __engine_name__ and __protocol_name__ still set the name a class reports, registered or not. Each metaclass gained a class-level registry property mirroring EnumSchema.registry, and a Dumper subclass no longer touches the filesystem while its class statement runs. Engine's keyword is engine= rather than the name= first shipped, because mcls, name, bases and namespace collide with abc.ABCMeta.__new__'s parameters on Python 3.10 and raise TypeError before the hook runs. There is no name= alias: a keyword that works on some interpreters and not others is the trap being removed.
• a breaking change to Extractor.register_engine(), register_reassembly and register_traceflow, and the register_extractor_* wrappers over them: each now accepts only a subclass of the public Engine, Reassembly or TraceFlow (#1016). They had accepted a subclass of the matching *Base class since #513, which was a tolerance for pcapkit's own built-ins (every built-in derives from the base, none from the public class) rather than a contract: *Base is documented as internal, and the public class is the one carrying the registration hook. Third-party code that subclasses EngineBase, ReassemblyBase or TraceFlowBase directly and registers through these functions now gets RegistryError naming the public class; subclass the public class instead. The error messages are unchanged. The built-ins never pass through a registrar; Extractor._register_internal_engine and its sibling internal registrars check the base for internal registration, and are what the #513 regression test now exercises. register_protocol is untouched (#1020).
• extraction is around 46% faster on a 1,117-frame HTTP capture, with byte-identical output (#420). A reassembled datagram's payload is analysed on first read rather than eagerly, cutting IP reassembly's own cost by 90.7% and TCP's by 23.7% (IP reassembly submits a datagram for every frame, fragmented or not) (#424). Flow tracing over the same capture went from 1416.6 ms to 744.0 ms, because the flow dumper handed each record to a Frame constructor that re-dissected the whole stack to return the bytes it had just been given; options are no longer parsed twice either (#427).
• a breaking change to Extractor.engine and Extractor.record_header(): both are now declared to return EngineBase[_P] rather than Engine, and the private _exeng attribute follows. The built-in engines subclass EngineBase directly, so none was ever an Engine, which adds only the __init_subclass__ registration hook. A type checker sees the change: code passing the result to an Engine-typed parameter must now accept EngineBase; and because the old declarations were unparameterised, engine.read_frame() and record_header().read_frame() used to be Any and are now the extractor's own frame type, so an assignment that relied on Any there no longer type-checks (#1022).
• the documentation of the engine base classes: the member stubs (name, module, registry, extractor, unsupported_reason, run, read_frame, close and the rest) moved from Engine to EngineBase, where they are defined, and Engine now documents only the __init_subclass__ registration hook it adds, so the EngineBase[_P] that Extractor.engine returns leads to an API. Cross-references to Engine.run, Engine.read_frame, Engine.close and Engine.unsupported_reason now point at EngineBase, which stays out of __all__, as #1016 settled (#1024).
• a breaking change to register_mh_extension: schema is keyword-only, as in the other schema-taking registrars (#516, #526).
• the pypcap and pcap_ct engines probe the pcap backend once per extraction rather than three times, and find its distribution without parsing each candidate's METADATA, which importlib.metadata does on Python 3.15 and which made pcap_ct extraction about 2.4x slower there (#2110, #2112, #2113, #2121).

Fixed

• TCP reassembly mixed absolute sequence numbers with buffer-relative slicing, so on any capture carrying a SYN with a realistic initial sequence number incomplete datagrams were dropped silently, and the completed=False branch of the public API was unreachable (#349, #376).
• format='text' raised AttributeError before writing anything, naming a dictdumper.Text that has never existed. It now points at Tree, as the 'txt' alias beside it already did.
• Extractor had the ownership of its input stream inverted: a handle it opened itself, from fin given as a path, was never closed, while a stream the caller supplied and still needed was. _cleanup closed under not self._flag_s (the flag that gated the open()), and the SeekableReader wrapping a non-seekable input asked for stream_closing=not self._flag_s in the same wrong direction. The leak was one descriptor per extraction, which surfaced as a ResourceWarning failing the test suite (#577, #596, #600; #606 only made the test immune). Both conditions now follow ownership via a single Extractor._owns_input, and a finaliser releases the handle of an extraction abandoned before end of file (auto=False, iterated part way and dropped); the files #610 names emit no such warning. Leaving a with block follows the same rule, so a caller's stream stays open after it (#1999, #2000). The finaliser is a weakref.finalize, so it also runs where __del__ never does, as on GraalPy (#1997, #1998).
• extract(..., no_eof=True) never returned. End of stream was detected and ExtractionWarning: EOF reached fired, but every loop that handles it (record_frames, __next__, __call__) read if self._flag_n: continue, so the flag suppressed the error that ended the loop without supplying another ending and an exhausted input was retried forever. The flag is not pointless -- __main__ sets no_eof for fin='-', and the end of what has arrived on a live capture is not the end of the capture -- so this is a termination condition rather than a deletion. The input's own position tells a paused capture from a finished one: prepare raises end of stream when zero bytes remain and restores the position first, so two consecutive ends of stream at the same position mean nothing arrived between them (Extractor._note_eof_progress). A pipe is unaffected, since a read there blocks while the writer is open but idle. This also fixes pcapkit -, which hung on any finished stdin. One deliberate narrowing: a seekable input does not block, so a file still being appended to ends at the data present when the extraction reached it; a timed grace period would make the cut-off intermittent rather than absent, so following a growing file is left to a policy of its own. Pre-existing and untouched: an append landing mid-record raises ValueError: read length must be non-negative or -1. The end-to-end tests are bounded by a child process rather than tests._support.time_limit, because the in-process deadline proved intermittent on this loop, and an intermittent guard against a hang leaves a wedged suite rather than a red test. Guesses at the cause are ruled out: the parse path's except Exception handlers are never entered during the spin, and the memory is the retry loop's EOF reached records, which the runner retains (#620).
• register_protocol displaced one protocol class with another and said nothing. The registry behind pcapkit.protocols.__proto__ is keyed on cls.__name__.upper(), and several dispatchable classes are named HTTP (the base pcapkit.protocols.application.http.HTTP and the httpv1 and httpv2 implementations), so a bare assignment decided the winner: register_protocol(httpv2.HTTP) moved __proto__['HTTP'] to the httpv2 class with no exception, log line or RegistryWarning, and ProtocolBase.expand_comp('HTTP') then resolved to whichever registered last. The overwrite now raises a RegistryWarning naming the displaced and the replacing class. The sharpest path is not a call to the registrar: Protocol.__init_subclass__() registers unconditionally, so merely defining a subclass of the public Protocol under a name a built-in holds displaced that built-in. A plain import pcapkit emits zero new warnings: the built-in HTTP classes derive from ProtocolBase, so __init_subclass__ never fires for them, and import-time seeding keys off the distinct names HTTP, HTTPv1 and HTTPv2. The guard deliberately reads "key present and the incumbent is a different class", not mere presence (#726 later gave its sibling registrars the same identity guard): this function is the funnel every wrapper registrar ends in, so registering one class under two codes (register_tcp then register_udp, a documented path) reaches it twice with nothing displaced. The collision is reported, not resolved: re-keying is a registry-format change that none of the bare-name readers can absorb (each degrades silently to a string or Raw on a miss), so it belongs to the registry redesign in #514. The issue called this the one registrar with no warning; in fact none warned by itself, the siblings only by delegating to a guarded classmethod (#675).
• the #: autodoc comments in pcapkit/foundation/traceflow/traceflow.py that named a bare Type, which Sphinx resolves against every class named Type in the project rather than typing.Type, and silently linked to pcapkit.const.l2tp.type.Type, an L2TP field-type enum; once #684 rendered TraceFlow._foutio, the built docs pointed at the wrong class with no warning. These sites now spell it ~typing.Type[Dumper], among the sites #709 lists. The other bare Type sites, in hand-written :type: fields under docs/source/pcapkit/foundation/, are fixed separately by #714 (#709).
• register_protocol's overwrite warning could claim a protocol was replaced with itself. The guard was correct (incumbent is not protocol, an identity check from #681), but the message built both operands with a bare repr(). A factory defining a same-named closure-local class on every call (as tests/protocols/test_construction_keyword_check_unit.py's _protocol_class does) produces two distinct classes sharing one __module__ and __qualname__, so a real overwrite read "overwriting X with X." The message now compares the two reprs and, only when they coincide, appends each object's id(); __module__/__qualname__ would not disambiguate, being what the repr already renders (#710).
• more registrars warned on mere key presence rather than an actual overwrite, outside the wording of #718's identity guard (incumbent is not None and incumbent is not new, landed by #726), whose issue named only code-keyed registrars: register_engine, register_reassembly and register_traceflow on Extractor, and register_dumper on both Extractor and TraceFlow. Each now compares the incumbent by identity before warning; both register_dumper sites compare only the stored dumper, so re-registering with just a new file extension stays silent too. Non-breaking: a correct caller sees strictly fewer warnings (#739).
• the class registrars listed below now raise RegistryError for a non-class argument, where a bare TypeError ("issubclass() arg 1 must be a class") used to escape -- from the guard itself for the register_dumper methods, and from inside abc for the others. They are register_dumper, register_engine, register_reassembly and register_traceflow on Extractor, TraceFlow.register_dumper() (reached through register_traceflow_dumper), and pcapkit.foundation.registry.protocols.register_protocol(). Each guard gains an explicit isinstance(x, type) test ahead of its issubclass; in those that accept a ModuleDescriptor it runs after the descriptor is unwrapped, so a descriptor naming a non-class attribute is rejected too, while register_protocol takes no descriptor. No guard's target class changes, and a wrong class still raises RegistryError as before. RegistryError subclasses TypeError, so except TypeError still catches it; a caller matching the exact type, or the old message, does not. The same guard in the protocol register classmethods is fixed separately by #1026 (#1021).
• a missing extraction engine package now gives a single EngineWarning rather than a duplicate (#1045, #1046). Extractor.import_test() warned that the package was absent, then Extractor.run() warned again when it fell back to the default engine; run now stays silent there, and import_test says what run used to: engine <name> (<module>) is not installed; using default engine instead, the module name in backticks. Only code that matched import_test's old wording, or that expects the duplicate warning, breaks.
• Extractor defects: Extractor.output's UnsupportedCall named format rather than output; make_name looked an unknown format up in the __output__ defaultdict and so inserted it; and the Scapy engine never set _offmt, so Extractor.format raised AttributeError under engine='scapy' (#1095).
• the DPKT, Scapy and PyShark engines call Extractor.record_header() at setup again, as they did until 2023, so the global-header step is shared with the default engine and sets _offmt for each of them. Their dumped output changes: JSON, plist and tree reports gain the leading Global Header record (Section Header 1 for PCAP-NG) the default engine already writes, identical to its, and files=True writes that record's file too; frame records are unchanged. Extractor.format now also answers on a capture with no frames. format='pcap' failing on every engine is a separate defect, #1127 (below) (#1104).
• format='pcap' failed on every engine with a TypeError from PCAPIO.__init__(), missing protocol: Extractor.__init__() created the writer before any global header was read, so PCAPIO had no link type. The header step now creates it through Extractor._open_output(), and run() opens it for engines with no such step; a PCAP writer takes the frame itself and skips the Global Header record, so the default engine writes in.pcap back byte for byte. The third-party engines hand the writer no frame octets, so they fall back to JSON with a FormatWarning, as their flow tracing already does, and a PCAP-NG input raises FormatError (#1127). The written global header also dropped the input's thiszone, sigfigs and snaplen, so most sample PCAP files did not come back byte for byte; the PCAP engine now passes those fields through _open_output to PCAPIO, and every one does (#1165).
• IP reassembly reports only the octets it holds: a truncated fragment, a strict run and a zero-length datagram no longer report octets from the declared Total Length (#1368). Only the final fragment's partial block counts, and a datagram too long for its length field never completes (#1582, #1585, #1598).
• TCP reassembly judges completion from each buffer's own gaps, compares sequence numbers modulo 2**32, and holds a FIN until reordered data arrives (#1375). A TSO fragment's length is its captured length, and RCVBT covers the last block (#1564).
• a second TCP flow with the same label truncated the first flow's file; a reused label now gets the next free suffix (#1360, #1371).
• the engine, reassembly, traceflow and dumper registrars accept a built-in back under the name it shipped with, restoring the shipped entry after an override; the engine, reassembly and traceflow registrars still refuse any other built-in (#1363, #1376).
• PCAP-NG blocks are numbered across the whole file, not per section (#1256, #1426).
• format='pcap' is kept when an unavailable engine falls back to the default one (#1264, #1430).
• extract() accepts a file object with no name as fin (#1506, #1509), and reads every frame from a pipe or other non-seekable stream (#1586, #1595).
• the third-party engines read what the capture holds. The dpkt engine keeps a frame dpkt cannot parse rather than leaking AttributeError (#1351, #1377), applies each PCAP-NG interface's link type and timestamp resolution rather than the first one's (#1379, #1396), and reads float timestamps, Simple Packet Blocks and raw-IP frames (#1550). The scapy engine resets its interfaces at each PCAP-NG section (#1522, #1546), takes a packet's link type and clock from its interface (#1563), and reads each record whole (#1717, #1733). The pyshark engine skips non-packet PCAP-NG blocks (#1515, #1531), and the pypcapfile engine reads the PCAP records pypcapfile drops (#1512, #1569). dpkt and scapy write real PCAP traces (#1507, #1511).
• a callable passed as verbose= is called on every engine. The scapy, dpkt, pyshark, pypcap, pcap-ct and pypcapfile engines replaced it with their own printer, which now runs only for verbose=True, its output unchanged (#1874, #1880).
• an Extractor whose constructor raises closes what it owns, the input it opened and then the engine it chose, so a PyShark capture's tshark does not outlive it; the original exception still propagates, and a caller's stream stays open (#2100, #2106, #2107, #2119).
• engine='pypcap' warns and falls back to the default engine when the pcap module is installed but cannot load, as engine='pcap_ct' already did, where it raised the loader's OSError (#2132, #2133).
• TCP reassembly bounded its holes with sys.maxsize, which on GraalPy and 32-bit builds is 2**31 - 1, inside TCP's sequence space, so a stream past it never completed. The bound is HOLE_OPEN_BOUND, 2**63 - 1, the value 64-bit builds already used (#1959, #1965).
• the method-name registrars, such as register_ipv4_option, and register_linktype, register_pcap, register_pcapng, register_ethertype and register_transtype refuse a code that is not an enum member with RegistryError before touching a registry, where they registered it and then raised AttributeError, leaving the entry behind (#2186, #2193).
• pcapkit.foundation.registry.protocols.register_protocol_code(), and the code= class keyword, check every destination's key before registering any of them. A key belonging to another enum, such as {Frame: TransType.ICMP}, is refused with RegistryError where it replaced the shipped LinkType.ETHERNET entry, and a bad target late in the list no longer leaves the earlier ones registered. A destination keeping a registry of its own, such as Loopback and IPX, is not checked against another enum (#2268, #2343).
• the number registrars register_tcp, register_udp, register_sctp and register_apptype refuse a bool code with RegistryError, where register_tcp(True, ...) registered port 1, since bool is an int subclass (#2269, #2344).
• IP reassembly reports a datagram that is not itself fragmented but whose BUFID is already buffered: it submits that buffer as incomplete and then reassembles the datagram in a buffer of its own, per RFC 791 Section 3.2, where the datagram was never reported at all. On IPv6 an atomic fragment is reassembled in a buffer of its own and submitted without flushing the datagram already being reassembled, so that one's final fragment still completes it, per RFC 6946 Section 4 (#2270, #2345).
• the PyPCAP, pcap-ct and pypcapfile engines warn with AttributeWarning, naming the engine, that they ignore a parsing context supplied through Extractor's context=, as the dpkt, scapy and pyshark engines already did, where they dropped it silently (#2313, #2332).
• Deferred could not be pickled under protocol 0 or 1 -- a slotted class with no __getstate__ raises TypeError there, independent of the analyze/proto regression #2417 fixed. It now defines __getstate__ and __setstate__, mirroring the (dict_or_None, slots) pair Python's own default slotted-class reduction already used for every released build, so a Deferred pickled by one of those still unpickles. The slot names come from copyreg._slotnames rather than a hand-rolled walk of type(self).__mro__, which would otherwise shadow a base class's slots under a subclass declaring its own, miscount a bare-string __slots__ = 'name', or read a private, name-mangled slot under its unmangled spelling (#2423, #2425, #2424).
• that same Deferred still failed to pickle under protocol 0 or 1 on GraalPy 25.4, after #2423's fix: copyreg._reduce_ex, which handles protocol 0 and 1 before __getstate__ is ever consulted, walks cls.__mro__ for a base to compute a base-object state from, and on GraalPy that walk stops at Generic itself rather than at object, raising TypeError: typing.Generic() takes no arguments. Deferred.__reduce_ex__ now hard-codes the base=object, state=None outcome the walk always reached on CPython for protocol 0 and 1, so the walk -- and Generic -- is no longer part of the route pickling takes. The same override also checks for, and defers to, a subclass's own __reduce__ before building that hard-coded tuple -- without that check a Deferred subclass overriding __reduce__ had it silently ignored at protocol 0 and 1 while protocol 2 and above (via object.__reduce_ex__ unchanged) kept honouring it (#2433, #2435).

pcapkit.interface

Added

• pcapkit.interface.registry, making public the registry-entry helpers same_entry, restore_shipped and restore_shipped_dumper (#1519, #1568).

Fixed

• the messages the interface functions and the helpers behind them raise and warn read in the house <prefix>: <lowercase description>: ... {value!r} form. reassemble and trace lowercase their unsupported-protocol error and quote the protocol; follow_tcp_stream warns using default engine instead, the wording Extractor already used, and quotes an engine that has no reassembly adapter; TraceFlowBase's output-format warning is lowercased; and Extractor.make_name quotes the format it does not know, where an empty one ended the message at the colon with nothing after it (#2303, #2374).

pcapkit.protocols

Added

• ESP parsing and construction [RFC 4303], with optional payload decryption and ICV verification through cryptography (pip install pypcapkit[crypto]) (#378). Keys reach the dissector through a new caller-state channel, pcapkit.corekit.context, surfaced as the context= keyword on extract() and Extractor, carrying an esp.SecurityAssociation. Nothing here raises: with no association the SPI and sequence number are still reported and the ciphertext is left opaque with status=NO_SA, and a failed decryption or ICV check is recorded on the parsed result the same way. Extended Sequence Numbers, TFC padding and anti-replay are not implemented, and an unsupported cipher or MAC is refused with a clear error rather than half-processed.
• SCTP as a transport protocol [RFC 9260]: every chunk type, chunk parameter and error cause it defines, with the CRC32c both recorded and verifiable (it covers the SCTP packet alone, with no IP pseudo-header). Upper layers register on the DATA chunk's Payload Protocol Identifier through register_sctp, not on a port (#379).
• NGAP over SCTP (3GPP TS 38.413), decoding aligned PER through pycrate (pip install pypcapkit[NGAP]) (#251, #417). Decoding is generic by ASN.1 shape rather than per-procedure, so every elementary procedure and protocol IE works and a new 3GPP release needs no code change. Registered as a default on PPID 60 and 66, but only 60 decodes: PPID 66 is an NGAP PDU inside a DTLS record, and there is no DTLS dissector. pycrate was at first left out of the all extra -- it is LGPL-2.1+ where this package is BSD-3-Clause, and lands some 238 MB to obtain one module -- until #910 counted it among all's core addons, so all installs it (the all entry under Project infrastructure).
• the Mobility Header registry, completed (#383, #437): the RFC 5568 fast-handover messages and options, then every registered message data type, every registered option (with nested sub-option registries for the flow identification, access network identifier, quality-of-service and LMA-controlled MAG parameter families) and every CGA extension. The CGA Parameters option, the only option that can carry a CGA extension on the wire, was the last to come off the generic handler, which is what let the CGA extensions round-trip end to end.
• dispatch entries for dissectors that existed but were reachable from no registry (#436): FTP-DATA on TCP 20, HTTP/1 on TCP 8080, HTTP on UDP 8080, L2TPv2 on UDP 1701 and OSPF at TransType 89. VLAN became an abstract base with C_Tag (802.1Q) and S_Tag (802.1ad) as concrete subclasses, so a Q-in-Q frame no longer collapses into one opaque Raw; L2TP likewise became a base, with L2TPv2 carrying the RFC 2661 implementation.
• Protocol/ProtocolBase gain a code= class keyword for the next-layer dispatch registries (Link.__proto__, Internet.__proto__, TCP.__proto__, UDP.__proto__, SCTP.__proto__, Frame.__proto__, PCAPNG.__proto__), the opt-in treatment #514 gave Engine, Reassembly, TraceFlow and Dumper above, extended to the one family that needed a registration key invented. Omitting code leaves a subclass unregistered, as before; the built-in tables are still filled by literal assignment in each layer module, so nothing the library ships moves. code accepts a bare enum member, whose type infers the destination (EtherType means Link, TransType means Internet, PayloadProtocolIdentifier means SCTP, and LinkType means both Frame and PCAPNG, mirroring register_linktype), or a {destination: key} mapping, required for a raw int such as a port number, which cannot say which transport it belongs to. Either form may appear in an iterable, so one declaration can register a class into several registries (e.g. a L2TP subclass reachable by IP protocol number and by a UDP port), and the mapping form is accepted even where inference would work. Inference refuses rather than guesses: an enum member whose type names no known destination raises RegistryError, and an unrecognised class keyword raises UnsupportedCall, matching the other registrar families. Backed by pcapkit.foundation.registry.protocols.register_protocol_code(), also callable directly for a class that declined at definition time. It was written up as the mechanism #548 needs; #548 turned out to need a missing class instead (115 is RFC 3931 L2TPv3 over IP, not RFC 2661; see the corresponding Fixed entry below), so its worked example names L2TPv3 (#570).
• tests/protocols/test_dispatch_reachability_unit.py, the coverage #548 asked for: every ProtocolBase descendant whose __index__ returns an enum member must be reachable under that code in the registry its enum type designates, read from the same __proto_dest__ declaration backing code= so the two cannot drift. It walks the classes rather than the registry entries, so it catches a class nothing registered, the shape in which OSPF once shipped (#548).
• tests/protocols/transport/test_tcp_mptcp_join_flag_ordering_unit.py, covering all three MP_JOIN layouts through the public constructor, the construct-pack-parse cycle for each, the stale-flags case that rules out a zero-valued default, the statement order, and controls for the parse path and the flag-independent options. The old cases bypassed the public path, so full coverage coexisted with a broken one. The stale tcp-mptcp/MP_JOIN entry is deleted from EXPECTED_FAILURES (#587).
• tests/protocols/test_option_generator_tcp_base_unit.py, asserting that every TCP_BASE key is a parameter TCP.make() declares (derived from inspect.signature) and that the built segment carries the stated header in both data model and packed octets (#602).
• ILNP nonce sizing coverage in tests/protocols/internet/test_ipv6_extension_unit.py, a test per protocol, asserting the declared length, the exact packed octets and the construct-pack-parse cycle over a spread of nonces, most with a bit length that is not a multiple of eight, where floor division and the ceiling disagree (#601).
• SOLUTION parameter width coverage in tests/protocols/internet/test_hip_unit.py: a spread of widths, each asserting the declared length, the reader's acceptance and the construct-pack-parse cycle, plus a 57-bit case pinning the 20-octet length RFC 5201 Section 5.2.5 requires of HIPv1. Some widths are deliberately not multiples of eight, where the defective ceil(bits / 4) differs from the correct width (#608).
• the BSD loopback layer for LINKTYPE_NULL and LINKTYPE_LOOP, and dissection of LINKTYPE_RAW by the version nibble (#1594).
• one home for each RFC- or format-fixed constant spelled out in more than one module -- the IPv4, IPv6, AH and TCP header lengths and offsets, IP_MAX_LENGTH, and the PCAP and PCAP-NG framing constants -- in the module that owns the protocol (#1739, #1752).

Changed

• a breaking change to OSPF, RARP and DRARP: they move from pcapkit.protocols.link to pcapkit.protocols.application, with no deprecated re-export at the old path (#719). Layer is decided by designed function, with the IETF as the single source of truth -- RFC 1812 Section 7 places routing protocols in the application layer and RFC 1122 Section 1.1.3 lists RARP there -- and the rule is recorded in docs/source/contributing/conventions/protocol-layer-placement.rst.

Import paths, before to after:

• pcapkit.protocols.link.ospf to pcapkit.protocols.application.ospf
• pcapkit.protocols.data.link.ospf to pcapkit.protocols.data.application.ospf
• pcapkit.protocols.schema.link.ospf to pcapkit.protocols.schema.application.ospf
• pcapkit.protocols.link.rarp to pcapkit.protocols.application.rarp

from pcapkit import OSPF and from pcapkit.protocols import OSPF (likewise RARP and DRARP) are unaffected; from pcapkit.protocols.link import OSPF and the deep paths above break. RARP has no data or schema module of its own, as it reuses ARP's.

layer changes from 'Link' to 'Application' for OSPF, RARP and DRARP. OSPF now takes Application as its only base, and RARP becomes class RARP(Application, ARP) -- layer base first, because ARP's chain reaches Link, which owns __layer__. ARP and InARP stay 'Link'. Dispatch keys are unchanged: OSPF is still reached from Internet.__proto__ at TransType.OSPFIGP and RARP from Link.__proto__ by EtherType. Leaving Link repoints OSPF.__proto__ at ProtocolBase.__proto__, so OSPF no longer sees Link's EtherType entries -- which nothing used, since it is reached by protocol number, and a -1 lookup falls back to Raw in either registry without inserting. register and _read_protos still resolve, on ProtocolBase rather than Link. RARP keeps Link's through ARP.

Layer-limited extraction: layer='link' no longer sets the termination flag on OSPF and layer='application' now does -- the same inversion applies to RARP -- but the extracted protochain is unchanged at every layer= value, including 'internet' (IPv4:OSPFIGP before and after, as IPv4 ends the chain itself).

• renames with no compatibility alias left behind: PCAP-NG Option subclasses spell the namespace class keyword ns= instead of namespace= (#439).
• tests/protocols/transport/test_tcp_udp_unit.py now reaches the MP_JOIN dispatchers through TCP() itself, instead of assigning a Python set to _flags on a bare TCP.__new__(TCP). A set answers the same membership tests, so every branch ran while the attribute had neither the type production assigns nor the ordering that governs when it exists -- how #587 stayed invisible. Reverting #587's hoist, or restoring the cast('Enum_Flags', 0) seed, now fails the file. Test-only (#603).
• building a protocol through its constructor with a keyword that names nothing now raises UnsupportedCall instead of discarding it. This is a behaviour change to a public API: every make in the tree ends its signature with **kwargs and reads nothing out of it, so a misspelled keyword was accepted, dropped, and the field it named kept its default -- wrong octets, nothing said, as in #602, #541 and #556. The check sits in ProtocolBase.__init__() rather than make, because __post_init__ passes one **kwargs to the construction and to the parse of what it has just constructed, so a keyword declared only by read legitimately travels through make (HIP.read() declares extension). The accepted set is the union of every keyword-taking parameter of make, read, pack, unpack, __post_init__ and __init__ across the MRO. Parsing is deliberately untouched: a protocol cannot know which keywords its parent passed on. A new __keywords__ opts a class out: a set, for a keyword read out of **kwargs by name (ESP.read() with packet); and None, for a dispatcher whose real signature belongs to a class chosen at call time (only HTTP.make). The message names the near neighbour (seq reports did you mean 'seq_no'?). from_data warns UnknownFieldWarning rather than raising for a key its own _make_data returned, which the caller cannot fix; a keyword passed to from_data itself raises, as for a direct construction (#1147). The leftover copies of #602's misspelled TCP base, in examples/generators/dispatch.py and tests/protocols/transport/, are fixed. Some _make_data keys that make does not declare are reported, not fixed: Frame._make_data() returns ts_src where make declares ts_sec, L2TPv2._make_data() returns prio where it declares priority, and Header._make_data() returns a magic_number that Header.make() does not take. A direct SomeProtocol.make(...) call is not checked and still discards silently (#617).
• a breaking change to Application: it no longer forbids payload dispatch outright. It encodes "no further protocol layer above this one", which undissected trailer bytes are not, so _decode_next_layer and _import_next_layer accept the -1 sentinel -- the rest of the packet, resolving to Raw, or to NoPayload when nothing remains -- and __post_init__ keeps a payload that read set instead of overwriting it with NoPayload. A real protocol number (any proto other than -1) is still refused with UnsupportedCall. A subclass that calls either method with -1 changes from raising to succeeding; no subclass in the package does (#719).
• the Protocol and ProtocolMeta docstrings. Protocol claimed to be the base of every protocol family, though nothing in the package subclasses it, and ProtocolMeta claimed to generate attributes its empty body does not. Protocol is now documented as the base for third-party protocols, and ProtocolBase as the one the families derive from (#1101).
• a breaking change to OSPF_CrytographicAuthentication: the misspelling is corrected to OSPF_CryptographicAuthentication, and CrytographicAuthentication in pcapkit.protocols.schema.application.ospf and pcapkit.protocols.data.application.ospf to CryptographicAuthentication, with no alias left for the old spelling. Both OSPF names also move to the application group of schema.__all__ and data.__all__, after #719's move (#1090).
• a breaking change to a declared length that runs past the data: it is refused with ProtocolError rather than accepted and zero-filled on rebuild, so a malformed option looks different in info (#1325, #1398).
• dissection is bounded: a frame at 64 layers (#1610, #1620) and an IPv6 extension-header chain at 32 headers (#1604, #1608). Both limits are PCAPKIT_FRAME_LAYER_LIMIT and PCAPKIT_EXTENSION_HEADER_LIMIT in pcapkit.utilities.config (#1743). Rebuilding a frame cut at the chain bound warns once (#1619, #1630).
• a breaking change to IPv6 extension headers: an unrecognised or unparsable one is parsed generically, per RFC 6564, rather than collapsing the packet to Raw (#891, #904). IPv6_Ext does it, and is also the shared base of every extension header (#917, #924).
• a breaking change to pack(): it no longer keeps the header it builds on the instance it is called on, which in 1.4.1 too left schema disagreeing with info: UDP(srcport=1234).pack() reset schema.srcport to 0 while info.srcport kept 1234. Once an instance has been parsed or constructed, pack() builds on a shallow copy, so schema, info and what make() sets, such as TCP's connection, stay as they were. The Frame, PCAPNG and HTTPv2