@netkitty/codec 1.0.0

package/dist/headers/S7comm.js

@@ -0,0 +1,244 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S7comm = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * S7comm — the Siemens S7 Communication protocol (S7-300/400/1200/1500 PLC), the application layer of
+ * the S7 ISO-on-TCP stack: it rides inside a COTP DT (Data) TPDU, itself carried by a TPKT PDU on TCP
+ * port 102 (RFC 1006). Every S7comm PDU begins with a fixed 10-byte header — a Protocol Id (always
+ * 0x32), a ROSCTR (message class: 1 Job request, 2 Ack, 3 Ack_Data, 7 Userdata), a 2-byte Redundancy
+ * Identification (reserved, normally 0), a 2-byte PDU Reference, and the 2-byte Parameter Length and
+ * Data Length that delimit the two variable sections — plus, ONLY for the Ack / Ack_Data classes
+ * (ROSCTR 2 or 3), a 2-byte error field (Error Class + Error Code). The Parameter section (the S7
+ * function + its arguments) and the Data section (item values, results) then follow, sized by the two
+ * length fields.
+ *
+ * The Parameter and Data sections are function-dependent, cross-PDU state (Setup Communication,
+ * Read/Write Var, block up/download, PLC control, …), so this codec keeps them verbatim as bounded hex
+ * (byte-perfect): `parameter` sized by Parameter Length and `data` sized by Data Length. The two length
+ * fields are honor-else-derive (honored verbatim when supplied — a crafted PDU may lie — else derived
+ * from the hex byte length of their section). Every field is BIG-ENDIAN (S7comm is not CIP/ENIP). A
+ * well-formed PDU round-trips byte-for-byte.
+ *
+ * S7comm is gated purely on its parent being a COTP DT TPDU (prev.id === 'cotp') plus the Protocol Id
+ * 0x32 signature at offset 0 (heuristicFallback), mirroring how COTP itself is an unkeyed
+ * content-heuristic child of TPKT — nothing on TCP/102 other than a COTP-carried 0x32 PDU is S7comm.
+ */
+class S7comm extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 's7comm';
+        this.name = 'S7 Communication';
+        this.nickname = 'S7comm';
+        //S7comm rides on TCP port 102, but always inside a COTP DT TPDU. Like COTP (which demuxes off TPKT
+        //with no matchKeys), selection is by content: heuristicFallback lists it in the heuristic chain and
+        //match() gates on the COTP parent plus the 0x32 signature.
+        this.matchKeys = [];
+        this.heuristicFallback = true;
+        //A leaf for now — the Parameter/Data sections require per-function, cross-PDU parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (S7comm.#schemaCache ??= S7comm.#buildSchema());
+    }
+    /** The 2-byte error field (Error Class + Error Code) is present ONLY on Ack (2) / Ack_Data (3). */
+    static #hasError(rosctr) {
+        return rosctr === 2 || rosctr === 3;
+    }
+    /** Length of the fixed header: 10 bytes, plus the 2-byte error field on Ack / Ack_Data. */
+    static #headerLen(rosctr) {
+        return 10 + (S7comm.#hasError(rosctr) ? 2 : 0);
+    }
+    /**
+     * Absolute byte offset (relative to this header) at which the COTP-delimited S7comm payload ends —
+     * i.e. the end of the enclosing TPKT PDU. Used to double-cap the Parameter/Data sections so a lying
+     * length field cannot read past the COTP payload into a trailing/pipelined TPKT PDU. Falls back to
+     * the captured-bytes end when no bounding TPKT length is available.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        for (const codecModule of this.prevCodecModules) {
+            if (codecModule.id === 'tpkt') {
+                //TPKT Length spans the whole TPKT PDU (its 4-byte header included); its absolute end is
+                //the end of everything COTP carries, hence the end of this S7comm PDU.
+                const tpktLength = codecModule.instance.length.getValue(0);
+                const relEnd = codecModule.startPos + tpktLength - this.startPos;
+                if (relEnd >= 0 && relEnd < end)
+                    end = relEnd;
+            }
+        }
+        return end;
+    }
+    /** honor-else-derive length field: honored verbatim when supplied, else derived from `sectionName`. */
+    static #lengthField(name, offset, sectionName, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 65535,
+            decode: function () {
+                this.instance[name].setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2)));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                const provided = node.getValue();
+                let value = (provided !== undefined && provided !== null)
+                    ? provided
+                    : (0, HexToBuffer_1.HexToBuffer)(this.instance[sectionName].getValue('')).length;
+                if (value > 65535) {
+                    this.recordError(node.getPath(), 'Maximum value is 65535');
+                    value = 65535;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'S7comm rosctr=${rosctr} ref=${pduReference}',
+            properties: {
+                //Protocol Id: always 0x32 for S7comm. A plain uint (no enum) so a crafted/off-spec value
+                //still round-trips; the 0x32 signature gates selection in match(), not the schema.
+                protocolId: this.fieldUInt('protocolId', 0, 1, 'Protocol Id'),
+                //ROSCTR (message class): 1 Job, 2 Ack, 3 Ack_Data, 7 Userdata. Kept as a plain uint —
+                //an unknown class must still decode and re-encode, so no enum constraint is applied.
+                rosctr: this.fieldUInt('rosctr', 1, 1, 'ROSCTR'),
+                //Redundancy Identification: reserved, normally 0x0000. Kept verbatim so any value round-trips.
+                redundancyId: this.fieldHex('redundancyId', 2, 2, 'Redundancy Identification'),
+                pduReference: this.fieldUInt('pduReference', 4, 2, 'PDU Reference'),
+                //Parameter Length / Data Length delimit the two variable sections. honor-else-derive.
+                parameterLength: this.#lengthField('parameterLength', 6, 'parameter', 'Parameter Length'),
+                dataLength: this.#lengthField('dataLength', 8, 'data', 'Data Length'),
+                //Error Class + Error Code: present ONLY on Ack (2) / Ack_Data (3) — bytes 10..11. For a
+                //Job (1) / Userdata (7) PDU these octets do not exist, so decode leaves them 0 and encode
+                //writes nothing (mirrors COTP's DT-only eot/tpduNr conditional fields).
+                errorClass: {
+                    type: 'integer',
+                    label: 'Error Class',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        this.instance.errorClass.setValue(S7comm.#hasError(rosctr) ? this.readBytes(10, 1)[0] : 0);
+                    },
+                    encode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        if (!S7comm.#hasError(rosctr))
+                            return;
+                        let value = this.instance.errorClass.getValue(0);
+                        if (value > 255) {
+                            this.recordError(this.instance.errorClass.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.errorClass.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.errorClass.setValue(value);
+                        this.writeBytes(10, Buffer.from([value & 0xff]));
+                    }
+                },
+                errorCode: {
+                    type: 'integer',
+                    label: 'Error Code',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        this.instance.errorCode.setValue(S7comm.#hasError(rosctr) ? this.readBytes(11, 1)[0] : 0);
+                    },
+                    encode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        if (!S7comm.#hasError(rosctr))
+                            return;
+                        let value = this.instance.errorCode.getValue(0);
+                        if (value > 255) {
+                            this.recordError(this.instance.errorCode.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.errorCode.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.errorCode.setValue(value);
+                        this.writeBytes(11, Buffer.from([value & 0xff]));
+                    }
+                },
+                //Parameter section (S7 function + arguments), kept verbatim. Sized by Parameter Length,
+                //double-capped by the COTP-delimited payload end so a lying length cannot swallow the
+                //Data section or a trailing TPKT PDU.
+                parameter: {
+                    type: 'string',
+                    label: 'Parameter',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        const headerLen = S7comm.#headerLen(rosctr);
+                        const parameterLength = this.instance.parameterLength.getValue(0);
+                        let end = headerLen + parameterLength;
+                        const payloadEnd = this.#payloadEnd();
+                        if (end > payloadEnd)
+                            end = payloadEnd;
+                        this.instance.parameter.setValue(end > headerLen ? (0, BufferToHex_1.BufferToHex)(this.readBytes(headerLen, end - headerLen)) : '');
+                    },
+                    encode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        const headerLen = S7comm.#headerLen(rosctr);
+                        const parameter = this.instance.parameter.getValue('');
+                        if (parameter)
+                            this.writeBytes(headerLen, (0, HexToBuffer_1.HexToBuffer)(parameter));
+                    }
+                },
+                //Data section (item values / results), kept verbatim. Sized by Data Length, double-capped
+                //by the COTP-delimited payload end (so trailing/pipelined bytes fall through to the codec).
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        const headerLen = S7comm.#headerLen(rosctr);
+                        const parameterLength = this.instance.parameterLength.getValue(0);
+                        const dataLength = this.instance.dataLength.getValue(0);
+                        const dataStart = headerLen + parameterLength;
+                        let end = dataStart + dataLength;
+                        const payloadEnd = this.#payloadEnd();
+                        if (end > payloadEnd)
+                            end = payloadEnd;
+                        this.instance.data.setValue(end > dataStart ? (0, BufferToHex_1.BufferToHex)(this.readBytes(dataStart, end - dataStart)) : '');
+                    },
+                    encode: function () {
+                        const rosctr = this.instance.rosctr.getValue(0);
+                        const headerLen = S7comm.#headerLen(rosctr);
+                        const parameterLength = this.instance.parameterLength.getValue(0);
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(headerLen + parameterLength, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //S7comm is carried exclusively inside a COTP DT TPDU — gate on the parent being COTP so a stray
+        //TCP/102 payload is never mis-claimed, then confirm the Protocol Id 0x32 signature at offset 0.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'cotp')
+            return false;
+        if (this.packet.length - this.startPos < 1)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 0x32;
+    }
+}
+exports.S7comm = S7comm;

package/dist/headers/SCTP.d.ts

@@ -0,0 +1,35 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SCTP — Stream Control Transmission Protocol (RFC 9260), carried directly over IP as protocol 132
+ * (both IPv4 `protocol` and IPv6 `nxt`). The 12-byte common header is all big-endian: Source Port (2) +
+ * Destination Port (2) + Verification Tag (4) + Checksum (4). The Checksum is a CRC32c over the whole
+ * SCTP packet (with the field zeroed) stored little-endian on the wire — but it is honored verbatim,
+ * never recomputed (encode is a faithful executor), so it is surfaced as an opaque 4-byte hex string.
+ *
+ * After the common header comes a chain of chunks until the enclosing IP payload is consumed. Each chunk
+ * is Type(1) + Flags(1) + Length(2) + Value, where Length counts the 4-byte chunk header plus the value
+ * but NOT the trailing padding to the next 4-byte boundary. Because the Length excludes that pad, the
+ * alignment padding (0..3 bytes) is the tricky part of a byte-perfect round-trip: it is captured verbatim
+ * (per chunk, as hex) and re-emitted, so even a malformed non-zero pad reproduces exactly. Chunks are
+ * carried generically (type + flags + verbatim hex value) so every chunk type — DATA(0), INIT(1),
+ * INIT_ACK(2), SACK(3), HEARTBEAT(4), HEARTBEAT_ACK(5), COOKIE_ECHO(10), COOKIE_ACK(11), … — round-trips;
+ * per-chunk semantic decoding (and cross-packet DATA reassembly) is a later enrichment.
+ *
+ * The chunk walk is bounded by the enclosing IP datagram, so a lying chunk Length near the end does not
+ * read into a trailing Ethernet FCS; a chunk whose Length overruns the available bytes (or is below its
+ * own 4-byte header) stops the walk, leaving the remainder to the codec's recursion / RawData. A
+ * well-formed SCTP packet round-trips byte-for-byte. This is a single-packet codec: chunks are dissected
+ * in place, with no cross-packet reassembly.
+ */
+export declare class SCTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SCTP.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SCTP — Stream Control Transmission Protocol (RFC 9260), carried directly over IP as protocol 132
+ * (both IPv4 `protocol` and IPv6 `nxt`). The 12-byte common header is all big-endian: Source Port (2) +
+ * Destination Port (2) + Verification Tag (4) + Checksum (4). The Checksum is a CRC32c over the whole
+ * SCTP packet (with the field zeroed) stored little-endian on the wire — but it is honored verbatim,
+ * never recomputed (encode is a faithful executor), so it is surfaced as an opaque 4-byte hex string.
+ *
+ * After the common header comes a chain of chunks until the enclosing IP payload is consumed. Each chunk
+ * is Type(1) + Flags(1) + Length(2) + Value, where Length counts the 4-byte chunk header plus the value
+ * but NOT the trailing padding to the next 4-byte boundary. Because the Length excludes that pad, the
+ * alignment padding (0..3 bytes) is the tricky part of a byte-perfect round-trip: it is captured verbatim
+ * (per chunk, as hex) and re-emitted, so even a malformed non-zero pad reproduces exactly. Chunks are
+ * carried generically (type + flags + verbatim hex value) so every chunk type — DATA(0), INIT(1),
+ * INIT_ACK(2), SACK(3), HEARTBEAT(4), HEARTBEAT_ACK(5), COOKIE_ECHO(10), COOKIE_ACK(11), … — round-trips;
+ * per-chunk semantic decoding (and cross-packet DATA reassembly) is a later enrichment.
+ *
+ * The chunk walk is bounded by the enclosing IP datagram, so a lying chunk Length near the end does not
+ * read into a trailing Ethernet FCS; a chunk whose Length overruns the available bytes (or is below its
+ * own 4-byte header) stops the walk, leaving the remainder to the codec's recursion / RawData. A
+ * well-formed SCTP packet round-trips byte-for-byte. This is a single-packet codec: chunks are dissected
+ * in place, with no cross-packet reassembly.
+ */
+class SCTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'sctp';
+        this.name = 'Stream Control Transmission Protocol';
+        this.nickname = 'SCTP';
+        this.matchKeys = ['ipproto:132'];
+        //A leaf header — chunk values are kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SCTP.#schemaCache ??= SCTP.#buildSchema());
+    }
+    /**
+     * Bytes available to SCTP within the enclosing IP datagram — so a short IP payload (or a lying chunk
+     * Length) does not let the chunk walk read into a trailing Ethernet FCS / padding. Bounds the chunk
+     * reads and the match gate.
+     */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'ipv4') {
+            const ipPayload = prev.instance.length.getValue(0) - prev.length;
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        else if (prev && prev.id === 'ipv6') {
+            const ipPayload = prev.instance.plen.getValue(0);
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SCTP ${srcPort}->${dstPort}',
+            properties: {
+                srcPort: this.fieldUInt('srcPort', 0, 2, 'Source Port'),
+                dstPort: this.fieldUInt('dstPort', 2, 2, 'Destination Port'),
+                //32-bit association selector; opaque on the wire, kept verbatim as hex.
+                verificationTag: this.fieldHex('verificationTag', 4, 4, 'Verification Tag'),
+                //CRC32c over the whole packet (little-endian on the wire) — honored verbatim, never
+                //recomputed, so it is surfaced as opaque 4-byte hex and round-trips even when crafted/wrong.
+                checksum: this.fieldHex('checksum', 8, 4, 'Checksum'),
+                chunks: {
+                    type: 'array',
+                    label: 'Chunks',
+                    items: {
+                        type: 'object',
+                        label: 'Chunk',
+                        properties: {
+                            type: { type: 'integer', label: 'Chunk Type', minimum: 0, maximum: 255 },
+                            flags: { type: 'integer', label: 'Chunk Flags', minimum: 0, maximum: 255 },
+                            length: { type: 'integer', label: 'Chunk Length', minimum: 0, maximum: 65535 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                            padding: { type: 'string', label: 'Padding', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const available = this.#available();
+                        const chunks = [];
+                        let offset = 12;
+                        //Each chunk is type(1) flags(1) length(2) value. A Length below its own 4-byte
+                        //header is invalid (and would not advance), and a Length that overruns the
+                        //available bytes is truncated — in both cases stop and leave the remaining bytes
+                        //to the codec's recursion / raw layer, keeping the round-trip exact.
+                        while (offset + 4 <= available) {
+                            const type = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1, true));
+                            const flags = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1, true));
+                            const chunkLength = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset + 2, 2, true));
+                            if (chunkLength < 4 || offset + chunkLength > available)
+                                break;
+                            //Padding to the next 4-byte boundary is NOT counted in chunkLength; for a
+                            //well-formed packet it is within `available` (clamped defensively otherwise).
+                            const padLength = (4 - (chunkLength % 4)) % 4;
+                            const padAvailable = Math.min(padLength, available - (offset + chunkLength));
+                            const valueLength = chunkLength - 4;
+                            chunks.push({
+                                type: type,
+                                flags: flags,
+                                length: chunkLength,
+                                value: valueLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 4, valueLength)) : '',
+                                padding: padAvailable > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + chunkLength, padAvailable)) : ''
+                            });
+                            offset += chunkLength + padAvailable;
+                        }
+                        //The chunk-header reads (type/flags/length) are dryRun peeks so a malformed-length
+                        //break leaves the bytes to trailing RawData; an empty-value chunk (COOKIE_ACK /
+                        //SHUTDOWN_ACK, Length 4) does no non-dry value/padding read of its own. Mark the
+                        //whole consumed chunk region with one non-dry read so headerLength covers every
+                        //byte the walk captured — otherwise a trailing empty chunk is re-decoded as a
+                        //RawData layer and duplicated on encode (the packet grows and re-encode differs).
+                        if (offset > 12)
+                            this.readBytes(12, offset - 12);
+                        this.instance.chunks.setValue(chunks);
+                    },
+                    encode: function () {
+                        const chunks = this.instance.chunks.getValue([]);
+                        if (!chunks)
+                            return;
+                        let offset = 12;
+                        for (const chunk of chunks) {
+                            const type = chunk.type ? chunk.type : 0;
+                            const flags = chunk.flags ? chunk.flags : 0;
+                            const value = (0, HexToBuffer_1.HexToBuffer)(chunk.value ? chunk.value : '');
+                            //Honor an explicit Chunk Length (a crafted chunk may lie / a decoded one carries
+                            //its on-wire value); else derive it from the 4-byte header + value. For a decoded
+                            //chunk these agree exactly, so the walk advances identically to decode.
+                            const chunkLength = (chunk.length !== undefined && chunk.length !== null)
+                                ? chunk.length
+                                : 4 + value.length;
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(type));
+                            this.writeBytes(offset + 1, (0, NumberToBuffer_1.UInt8ToBuffer)(flags));
+                            this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(chunkLength));
+                            if (value.length)
+                                this.writeBytes(offset + 4, value);
+                            //Padding kept verbatim so a non-zero/truncated pad round-trips; when absent
+                            //(crafting) it is derived as zero bytes to the next 4-byte boundary.
+                            const padding = (chunk.padding !== undefined && chunk.padding !== null)
+                                ? (0, HexToBuffer_1.HexToBuffer)(chunk.padding)
+                                : Buffer.alloc((4 - (chunkLength % 4)) % 4, 0);
+                            if (padding.length)
+                                this.writeBytes(offset + chunkLength, padding);
+                            offset += chunkLength + padding.length;
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SCTP sits directly above IPv4 (protocol field) or IPv6 (next-header field) with protocol 132,
+        //and needs at least its 12-byte common header within the IP payload.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.instance.protocol.getValue() !== 0x84 && this.prevCodecModule.instance.nxt.getValue() !== 0x84)
+            return false;
+        return this.#available() >= 12;
+    }
+}
+exports.SCTP = SCTP;

package/dist/headers/SFlow.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * sFlow v5 — sampled flow monitoring export (sflow.org v5 spec; historically RFC 3176 for v4). Rides
+ * UDP, conventionally destination port 6343. All fields are big-endian.
+ *
+ * The datagram header is: version (=5), agentAddressType (1 = IPv4, 2 = IPv6), the agent address
+ * (4 bytes for IPv4, 16 bytes for IPv6 — the ONLY variable-length part of the fixed header, and it
+ * shifts every downstream offset), subAgentId, sequenceNumber, sysUptime, and numSamples. Then
+ * `numSamples` sample records follow, each a 4-byte sampleType (enterprise << 12 | format), a 4-byte
+ * sampleLength, and sampleLength opaque bytes carried verbatim as hex (structuring the per-format
+ * flow/counter records is a later slice).
+ *
+ * The sample walk is bounded by BOTH `numSamples` and the bytes actually captured, so a lying
+ * numSamples in a truncated frame can never over-read; any trailing bytes fall to the raw layer.
+ * numSamples is honored when supplied (so a malformed datagram round-trips byte-for-byte) and derived
+ * from samples.length only when absent (crafting). This is a leaf header — nothing demuxes off sFlow.
+ */
+export declare class SFlow extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}