morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

Last packet time") #1638

New issue

Closed

opened 2026-10-16 21:08:16 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:08:16 +00:00

Owner

Originally created by @Rinkia on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4180

Before submitting

I searched the open and closed issues and PRs for a related report (capture_start, capinfos, "Earliest packet time", "First packet time"): none found. Open PR #3407 refactors TShark selection and doesn't touch the capinfos parser.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

With the Ubuntu 24.04 Wireshark package (TShark/Capinfos 4.2.2), inspect_pcap_capture always reports:

"capture_start": null, "capture_end": null, "capture_duration_seconds": 0

capinfos itself reports the times for the same file:

Capture duration:    0.000000 seconds
First packet time:   2026-10-15 16:57:16.031899
Last packet time:    2026-10-15 16:57:16.031899

Cause

src/pcap/PcapOutput.ts (lines ~69-70 on main @ 62bf09809, unchanged since 9581e067a "feat(pcap): add bounded capture summaries through CLI and MCP") reads only the newer labels:

captureStart: lines.get("Earliest packet time") ?? null,
captureEnd:   lines.get("Latest packet time") ?? null,

Labels in capinfos.c by Wireshark tag:

Tag	Labels
v4.0.0, v4.2.2	`First packet time`, `Last packet time`
v4.4.0, v4.6.0	`Earliest packet time`, `Latest packet time`

docs/pcap-analysis.md says the family supports caller-selected "Wireshark 4.x" tshark and capinfos. Debian 12 ships 4.0 and Ubuntu 24.04 ships 4.2, so on both current LTS distributions the times are silently null rather than reported or marked unsupported.

Reproduction

Any capture works. With the stock Ubuntu 24.04 packages:

apt-get install tshark          # 4.2.2-1.1build3
REA_TSHARK_COMMAND=/usr/bin/tshark REA_CAPINFOS_COMMAND=/usr/bin/capinfos \
  rea inspect-pcap-capture ./capture.pcap --json | jq '.normalized_result | {capture_start, capture_end}'
# {"capture_start": null, "capture_end": null}
capinfos -M ./capture.pcap | grep "packet time"
# First packet time:   …
# Last packet time:    …

Expected behavior

Accept both label pairs (First/Last and Earliest/Latest), or
if only 4.4+ is intended, say so in the docs and in inspect_pcap_client, and report the times as unavailable with a limitation naming the label mismatch rather than a bare null.

A regression fixture with 4.2-style capinfos -M output would cover it.

Impact and scope

Capture time bounds are always missing on Wireshark 4.0/4.2, which is the default on current Debian and Ubuntu LTS. Every other field I checked was correct.
Deterministic.

REA version

Executed on rea-agents@6.5.0. The parser is unchanged on main @ 62bf09809.

Runtime and platform

rea Docker image (Ubuntu 24.04) plus apt install tshark (4.2.2-1.1build3), on Windows 11 / Docker Desktop.

Target and artifact context

A synthetic 8-packet pcap built with scapy 2.6.1.

Interface

CLI.

Relevant output or evidence

Everything else matched the capture's ground truth (the packets as built):

endpoints counted once per packet, including inner IP-in-IP addresses and a packet with the same source and destination;
DNS answers associated with their question (the additional record for another name wasn't);
TLS SNI;
the six frame.protocols stacks;
HTTP userinfo credentials stripped from an absolute-form URI, with http_uri_redaction_count: 1.

Originally created by @Rinkia on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4180 ### Before submitting - [x] I searched the open and closed issues and PRs for a related report (capture_start, capinfos, "Earliest packet time", "First packet time"): none found. Open PR #3407 refactors TShark selection and doesn't touch the capinfos parser. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior With the Ubuntu 24.04 Wireshark package (TShark/Capinfos 4.2.2), `inspect_pcap_capture` always reports: ```json "capture_start": null, "capture_end": null, "capture_duration_seconds": 0 ``` `capinfos` itself reports the times for the same file: ```text Capture duration: 0.000000 seconds First packet time: 2026-10-15 16:57:16.031899 Last packet time: 2026-10-15 16:57:16.031899 ``` ### Cause `src/pcap/PcapOutput.ts` (lines ~69-70 on `main` @ `62bf09809`, unchanged since `9581e067a` "feat(pcap): add bounded capture summaries through CLI and MCP") reads only the newer labels: ```ts captureStart: lines.get("Earliest packet time") ?? null, captureEnd: lines.get("Latest packet time") ?? null, ``` Labels in `capinfos.c` by Wireshark tag: | Tag | Labels | | --- | --- | | v4.0.0, v4.2.2 | `First packet time`, `Last packet time` | | v4.4.0, v4.6.0 | `Earliest packet time`, `Latest packet time` | `docs/pcap-analysis.md` says the family supports caller-selected "Wireshark 4.x" `tshark` and `capinfos`. Debian 12 ships 4.0 and Ubuntu 24.04 ships 4.2, so on both current LTS distributions the times are silently null rather than reported or marked unsupported. ### Reproduction Any capture works. With the stock Ubuntu 24.04 packages: ```sh apt-get install tshark # 4.2.2-1.1build3 REA_TSHARK_COMMAND=/usr/bin/tshark REA_CAPINFOS_COMMAND=/usr/bin/capinfos \ rea inspect-pcap-capture ./capture.pcap --json | jq '.normalized_result | {capture_start, capture_end}' # {"capture_start": null, "capture_end": null} capinfos -M ./capture.pcap | grep "packet time" # First packet time: … # Last packet time: … ``` ### Expected behavior - Accept both label pairs (`First`/`Last` and `Earliest`/`Latest`), or - if only 4.4+ is intended, say so in the docs and in `inspect_pcap_client`, and report the times as unavailable with a limitation naming the label mismatch rather than a bare `null`. A regression fixture with 4.2-style `capinfos -M` output would cover it. ### Impact and scope - Capture time bounds are always missing on Wireshark 4.0/4.2, which is the default on current Debian and Ubuntu LTS. Every other field I checked was correct. - Deterministic. ### REA version Executed on `rea-agents@6.5.0`. The parser is unchanged on `main` @ `62bf09809`. ### Runtime and platform `rea` Docker image (Ubuntu 24.04) plus `apt install tshark` (4.2.2-1.1build3), on Windows 11 / Docker Desktop. ### Target and artifact context A synthetic 8-packet pcap built with scapy 2.6.1. ### Interface CLI. ### Relevant output or evidence Everything else matched the capture's ground truth (the packets as built): - endpoints counted once per packet, including inner IP-in-IP addresses and a packet with the same source and destination; - DNS answers associated with their question (the additional record for another name wasn't); - TLS SNI; - the six `frame.protocols` stacks; - HTTP userinfo credentials stripped from an absolute-form URI, with `http_uri_redaction_count: 1`.

bsakaguchi closed this issue

2026-10-16 21:08:16 +00:00

bsakaguchi commented

2026-10-16 21:08:17 +00:00

Author

Owner

@morluto commented on GitHub (Oct 15, 2026):

Fixed on main in 95957d748. The producer-boundary parser now preserves the timestamp values present under the First/Last labels used by supported Wireshark 4.0/4.2, while missing values remain unknown. The modern-label behavior is retained.

The old compiled parser reproduced the null-value loss; the fixed compiled parser retained both timestamps. Independent hosted verification with actual Wireshark 4.2.2 passed the supported CLI and MCP summary workflows against direct capinfos output for two controlled captures: real Wireshark verification. The workflow also passed 70 focused tests and 23 verification cases. Closing the supported-version compatibility defect.

Final main qualification passed all 36 jobs: CI at e2db76801.

@morluto commented on GitHub (Oct 15, 2026): Fixed on main in 95957d748. The producer-boundary parser now preserves the timestamp values present under the First/Last labels used by supported Wireshark 4.0/4.2, while missing values remain unknown. The modern-label behavior is retained. The old compiled parser reproduced the null-value loss; the fixed compiled parser retained both timestamps. Independent hosted verification with actual Wireshark 4.2.2 passed the supported CLI and MCP summary workflows against direct capinfos output for two controlled captures: [real Wireshark verification](https://github.com/morluto/rea/actions/runs/38799183537). The workflow also passed 70 focused tests and 23 verification cases. Closing the supported-version compatibility defect. Final main qualification passed all 36 jobs: [CI at e2db76801](https://github.com/morluto/rea/actions/runs/38799119711).

bsakaguchi referenced this issue

2026-10-31 00:54:19 +00:00

[PR #1638] [MERGED] fix(tests): bind HOME in native client and deepseek verifiers #4718

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1638

No description provided.

Rows
Columns