pypcapkit 1.3.3.post1__cp313-none-any.whl

pcapkit/protocols/schema/link/__init__.py

@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+"""header schema for data link layer protocols"""
+
+from pcapkit.protocols.schema.link.arp import ARP
+from pcapkit.protocols.schema.link.ethernet import Ethernet
+from pcapkit.protocols.schema.link.l2tp import L2TP
+from pcapkit.protocols.schema.link.ospf import OSPF
+from pcapkit.protocols.schema.link.ospf import \
+    CrytographicAuthentication as OSPF_CrytographicAuthentication
+from pcapkit.protocols.schema.link.vlan import TCI as VLAN_TCI
+from pcapkit.protocols.schema.link.vlan import VLAN
+
+__all__ = [
+    'ARP',
+    'Ethernet',
+    'L2TP',
+    'OSPF', 'OSPF_CrytographicAuthentication',
+    'VLAN', 'VLAN_TCI',
+]

pcapkit/protocols/schema/link/arp.py

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for (inverse) address resolution protocol family"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.const.arp.hardware import Hardware as Enum_Hardware
+from pcapkit.const.arp.operation import Operation as Enum_Operation
+from pcapkit.const.reg.ethertype import EtherType as Enum_EtherType
+from pcapkit.corekit.fields.misc import PayloadField
+from pcapkit.corekit.fields.numbers import EnumField, UInt8Field
+from pcapkit.corekit.fields.strings import BytesField
+from pcapkit.protocols.schema.schema import Schema, schema_final
+
+__all__ = ['ARP']
+
+if TYPE_CHECKING:
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+
+@schema_final
+class ARP(Schema):
+    """Header schema for ARP packet."""
+
+    htype: 'Enum_Hardware' = EnumField(length=2, namespace=Enum_Hardware)
+    ptype: 'Enum_EtherType' = EnumField(length=2, namespace=Enum_EtherType)
+    hlen: 'int' = UInt8Field()
+    plen: 'int' = UInt8Field()
+    oper: 'Enum_Operation' = EnumField(length=2, namespace=Enum_Operation)
+    sha: 'bytes' = BytesField(length=lambda pkt: pkt['hlen'])
+    spa: 'bytes' = BytesField(length=lambda pkt: pkt['plen'])
+    tha: 'bytes' = BytesField(length=lambda pkt: pkt['hlen'])
+    tpa: 'bytes' = BytesField(length=lambda pkt: pkt['plen'])
+    payload: 'bytes' = PayloadField()
+
+    if TYPE_CHECKING:
+        def __init__(self, htype: 'int', ptype: 'int', hlen: 'int', plen: 'int',
+                     oper: 'int', sha: 'bytes', spa: 'bytes', tha: 'bytes',
+                     tpa: 'bytes', payload: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/link/ethernet.py

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for ethernet protocol"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.const.reg.ethertype import EtherType as Enum_EtherType
+from pcapkit.corekit.fields.misc import PayloadField
+from pcapkit.corekit.fields.numbers import EnumField
+from pcapkit.corekit.fields.strings import BytesField
+from pcapkit.corekit.module import ModuleDescriptor
+from pcapkit.protocols.schema.schema import Schema, schema_final
+
+__all__ = ['Ethernet']
+
+if TYPE_CHECKING:
+    from typing import Any
+
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+
+def callback_payload(self: 'PayloadField', packet: 'dict[str, Any]') -> 'None':
+    """Callback function for :attr:`Ethernet.payload`."""
+    from pcapkit.protocols.link.ethernet import Ethernet  # pylint: disable=import-outside-toplevel
+
+    type_ = packet['type']
+    protocol = Ethernet.__proto__[type_]
+    if isinstance(protocol, ModuleDescriptor):
+        protocol = protocol.klass
+    self.protocol = protocol
+
+
+@schema_final
+class Ethernet(Schema):
+    """Header schema for ethernet packet."""
+
+    #: Destination MAC address.
+    dst: 'bytes' = BytesField(length=6)
+    #: Source MAC address.
+    src: 'bytes' = BytesField(length=6)
+    #: Protocol (internet layer).
+    type: 'Enum_EtherType' = EnumField(length=2, namespace=Enum_EtherType)
+    #: Payload.
+    payload: 'bytes' = PayloadField(
+        length=lambda pkt: pkt['__length__'],
+        callback=callback_payload,
+    )
+
+    if TYPE_CHECKING:
+        def __init__(self, dst: 'bytes', src: 'bytes', type: 'Enum_EtherType',
+                     payload: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/link/l2tp.py

@@ -0,0 +1,88 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for L2TP protocol"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.corekit.fields.misc import ConditionalField, PayloadField
+from pcapkit.corekit.fields.numbers import UInt16Field
+from pcapkit.corekit.fields.strings import BitField, PaddingField
+from pcapkit.protocols.schema.schema import Schema, schema_final
+from pcapkit.utilities.logging import SPHINX_TYPE_CHECKING
+
+__all__ = ['L2TP']
+
+if TYPE_CHECKING:
+    from typing import Optional
+
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+if SPHINX_TYPE_CHECKING:
+    from typing_extensions import Literal, TypedDict
+
+    class FlagsType(TypedDict):
+        """Flags of L2TP packet."""
+
+        #: Type of L2TP packet.
+        type: int
+        #: Length of L2TP packet.
+        len: int
+        #: Sequence number of L2TP packet.
+        seq: int
+        #: Offset size of L2TP packet.
+        offset: int
+        #: Priority of L2TP packet.
+        prio: int
+        #: Version of L2TP packet.
+        version: Literal[2]
+
+
+@schema_final
+class L2TP(Schema):
+    """Header schema for L2TP packet."""
+
+    #: Flags and version of L2TP packet.
+    flags: 'FlagsType' = BitField(length=2, namespace={
+        'type': (0, 1),
+        'len': (1, 1),
+        'seq': (4, 1),
+        'offset': (6, 1),
+        'prio': (7, 1),
+        'version': (12, 4),
+    })
+    #: Length of L2TP packet.
+    length: 'int' = ConditionalField(
+        UInt16Field(),
+        lambda packet: packet['flags']['len'],
+    )
+    #: Tunnel ID of L2TP packet.
+    tunnel_id: 'int' = UInt16Field()
+    #: Session ID of L2TP packet.
+    session_id: 'int' = UInt16Field()
+    #: Sequence number of L2TP packet.
+    ns: 'int' = ConditionalField(
+        UInt16Field(),
+        lambda packet: packet['flags']['seq'],
+    )
+    #: Next sequence number of L2TP packet.
+    nr: 'int' = ConditionalField(
+        UInt16Field(),
+        lambda packet: packet['flags']['seq'],
+    )
+    #: Offset size of L2TP packet.
+    offset: 'int' = ConditionalField(
+        UInt16Field(),
+        lambda packet: packet['flags']['offset'],
+    )
+    #: Padding of L2TP packet.
+    padding: 'bytes' = ConditionalField(
+        PaddingField(length=lambda pkt: pkt['offset']),
+        lambda packet: packet['flags']['offset'],
+    )
+    #: Payload of L2TP packet.
+    payload: 'bytes' = PayloadField()
+
+    if TYPE_CHECKING:
+        def __init__(self, flags: 'FlagsType', length: 'Optional[int]', tunnel_id: 'int',
+                     session_id: 'int', ns: 'Optional[int]', nr: 'Optional[int]',
+                     offset: 'Optional[int]', payload: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/link/ospf.py

@@ -0,0 +1,90 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for OSPF protocol"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.const.ospf.authentication import Authentication as Enum_Authentication
+from pcapkit.const.ospf.packet import Packet as Enum_Packet
+from pcapkit.corekit.fields.ipaddress import IPv4AddressField
+from pcapkit.corekit.fields.misc import PayloadField, SchemaField, SwitchField
+from pcapkit.corekit.fields.numbers import EnumField, UInt8Field, UInt16Field, UInt32Field
+from pcapkit.corekit.fields.strings import BytesField, PaddingField
+from pcapkit.protocols.schema.schema import Schema, schema_final
+
+__all__ = ['OSPF', 'CrytographicAuthentication']
+
+if TYPE_CHECKING:
+    from ipaddress import IPv4Address
+    from typing import Any
+
+    from pcapkit.corekit.fields.field import FieldBase as Field
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+
+def ospf_auth_data_selector(pkt: 'dict[str, Any]') -> 'Field':
+    """Selector function for :attr:`OSPF.auth_data` field.
+
+    Args:
+        pkt: Packet data.
+
+    Returns:
+        * If :attr:`OSPF.auth_type` is 2, a :class:`~pcapkit.corekit.fields.misc.SchemaField`
+          wrapped :class:`~pcapkit.protocols.schema.link.ospf.CrytographicAuthentication` instance.
+        * Otherwise, a :class:`~pcapkit.corekit.fields.strings.BytesField` instance.
+
+    """
+    if pkt['auth_type'] == Enum_Authentication.Cryptographic_authentication:
+        return SchemaField(length=8, schema=CrytographicAuthentication)
+    return BytesField(length=8)
+
+
+@schema_final
+class CrytographicAuthentication(Schema):
+    """Header schema for OSPF cryptographic authentication."""
+
+    #: Reserved bytes.
+    reserved: 'bytes' = PaddingField(length=2)
+    #: Key ID.
+    key_id: 'int' = UInt8Field()
+    #: Length.
+    len: 'int' = UInt8Field()
+    #: Sequence number.
+    seq: 'int' = UInt32Field()
+
+    if TYPE_CHECKING:
+        def __init__(self, key_id: 'int', len: 'int', seq: 'int') -> 'None': ...
+
+
+@schema_final
+class OSPF(Schema):
+    """Header schema for OSPF packet."""
+
+    #: Version.
+    version: 'int' = UInt8Field()
+    #: Type.
+    type: 'Enum_Packet' = EnumField(length=1, namespace=Enum_Packet)
+    #: Length.
+    length: 'int' = UInt16Field()
+    #: Router ID.
+    router_id: 'IPv4Address' = IPv4AddressField()
+    #: Area ID.
+    area_id: 'IPv4Address' = IPv4AddressField()
+    #: Checksum.
+    checksum: 'bytes' = BytesField(length=2)
+    #: Authentication type.
+    auth_type: 'Enum_Authentication' = EnumField(length=2, namespace=Enum_Authentication)
+    #: Authentication data.
+    auth_data: 'bytes | CrytographicAuthentication' = SwitchField(
+        selector=ospf_auth_data_selector,
+    )
+    #: Payload.
+    payload: 'bytes' = PayloadField()
+
+    if TYPE_CHECKING:
+        def __init__(self, version: 'int', type: 'Enum_Packet', length: 'int',
+                     router_id: 'IPv4Address | bytes | str | int',
+                     area_id: 'IPv4Address | bytes | str | int',
+                     checksum: 'bytes', auth_type: 'Enum_Authentication',
+                     auth_data: 'bytes | CrytographicAuthentication',
+                     payload: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/link/vlan.py

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for 802.1Q Customer VLAN Tag Type protocol"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.const.reg.ethertype import EtherType as Enum_EtherType
+from pcapkit.const.vlan.priority_level import PriorityLevel as Enum_PriorityLevel
+from pcapkit.corekit.fields.misc import PayloadField
+from pcapkit.corekit.fields.numbers import EnumField, UInt8Field, UInt16Field
+from pcapkit.corekit.fields.strings import BitField
+from pcapkit.protocols.schema.schema import Schema, schema_final
+from pcapkit.utilities.logging import SPHINX_TYPE_CHECKING
+
+__all__ = ['VLAN', 'TCI']
+
+if TYPE_CHECKING:
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+if SPHINX_TYPE_CHECKING:
+    from typing_extensions import TypedDict
+
+    class TCIType(TypedDict):
+        """Type of 802.1Q Customer VLAN Tag Type tag control information."""
+
+        #: Priority code point.
+        pcp: int
+        #: Drop eligible indicator.
+        dei: int
+        #: VLAN identifier.
+        vid: int
+
+
+@schema_final
+class TCI(Schema):
+    """Header schema for 802.1Q Customer VLAN Tag Type tag control information."""
+
+    #: Priority code point.
+    pcp: 'Enum_PriorityLevel' = EnumField(length=1, bit_length=3, namespace=Enum_PriorityLevel)
+    #: Drop eligible indicator.
+    dei: 'int' = UInt8Field(bit_length=1)
+    #: VLAN identifier.
+    vid: 'int' = UInt16Field(bit_length=12)
+
+    if TYPE_CHECKING:
+        def __init__(self, pcp: 'Enum_PriorityLevel', dei: 'int', vid: 'int') -> 'None': ...
+
+
+@schema_final
+class VLAN(Schema):
+    """Header schema for 802.1Q Customer VLAN Tag Type packet."""
+
+    #: Tag control information.
+    tci: 'TCIType' = BitField(
+        length=2,
+        namespace={
+            'pcp': (0, 3),
+            'dei': (3, 1),
+            'vid': (4, 12),
+        },
+    )
+    #: EtherType.
+    type: 'Enum_EtherType' = EnumField(length=2, namespace=Enum_EtherType)
+    #: Payload.
+    payload: 'bytes' = PayloadField()
+
+    if TYPE_CHECKING:
+        def __init__(self, tci: 'TCIType', type: 'Enum_EtherType',
+                     payload: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/misc/__init__.py

@@ -0,0 +1,108 @@
+# -*- coding: utf-8 -*-
+"""header schema for utility protocols"""
+
+# PCAP file format
+from pcapkit.protocols.schema.misc.pcap import *
+
+# PCAP-NG file format
+from pcapkit.protocols.schema.misc.pcapng import UnknownSecrets as PCAPNG_UnknownSecrets
+from pcapkit.protocols.schema.misc.pcapng import BlockType as PCAPNG_BlockType
+from pcapkit.protocols.schema.misc.pcapng import PCAPNG
+from pcapkit.protocols.schema.misc.pcapng import CommentOption as PCAPNG_CommentOption
+from pcapkit.protocols.schema.misc.pcapng import CustomBlock as PCAPNG_CustomBlock
+from pcapkit.protocols.schema.misc.pcapng import CustomOption as PCAPNG_CustomOption
+from pcapkit.protocols.schema.misc.pcapng import \
+    DecryptionSecretsBlock as PCAPNG_DecryptionSecretsBlock
+from pcapkit.protocols.schema.misc.pcapng import DSBSecrets as PCAPNG_DSBSecrets
+from pcapkit.protocols.schema.misc.pcapng import EndOfOption as PCAPNG_EndOfOption
+from pcapkit.protocols.schema.misc.pcapng import EndRecord as PCAPNG_EndRecord
+from pcapkit.protocols.schema.misc.pcapng import EnhancedPacketBlock as PCAPNG_EnhancedPacketBlock
+from pcapkit.protocols.schema.misc.pcapng import EPB_DropCountOption as PCAPNG_EPB_DropCountOption
+from pcapkit.protocols.schema.misc.pcapng import EPB_FlagsOption as PCAPNG_EPB_FlagsOption
+from pcapkit.protocols.schema.misc.pcapng import EPB_HashOption as PCAPNG_EPB_HashOption
+from pcapkit.protocols.schema.misc.pcapng import EPB_PacketIDOption as PCAPNG_EPB_PacketIDOption
+from pcapkit.protocols.schema.misc.pcapng import EPB_QueueOption as PCAPNG_EPB_QueueOption
+from pcapkit.protocols.schema.misc.pcapng import EPB_VerdictOption as PCAPNG_EPB_VerdictOption
+from pcapkit.protocols.schema.misc.pcapng import IF_DescriptionOption as PCAPNG_IF_DescriptionOption
+from pcapkit.protocols.schema.misc.pcapng import IF_EUIAddrOption as PCAPNG_IF_EUIAddrOption
+from pcapkit.protocols.schema.misc.pcapng import IF_FCSLenOption as PCAPNG_IF_FCSLenOption
+from pcapkit.protocols.schema.misc.pcapng import IF_FilterOption as PCAPNG_IF_FilterOption
+from pcapkit.protocols.schema.misc.pcapng import IF_HardwareOption as PCAPNG_IF_HardwareOption
+from pcapkit.protocols.schema.misc.pcapng import IF_IPv4AddrOption as PCAPNG_IF_IPv4AddrOption
+from pcapkit.protocols.schema.misc.pcapng import IF_IPv6AddrOption as PCAPNG_IF_IPv6AddrOption
+from pcapkit.protocols.schema.misc.pcapng import IF_MACAddrOption as PCAPNG_IF_MACAddrOption
+from pcapkit.protocols.schema.misc.pcapng import IF_NameOption as PCAPNG_IF_NameOption
+from pcapkit.protocols.schema.misc.pcapng import IF_OSOption as PCAPNG_IF_OSOption
+from pcapkit.protocols.schema.misc.pcapng import IF_RxSpeedOption as PCAPNG_IF_RxSpeedOption
+from pcapkit.protocols.schema.misc.pcapng import IF_SpeedOption as PCAPNG_IF_SpeedOption
+from pcapkit.protocols.schema.misc.pcapng import IF_TSOffsetOption as PCAPNG_IF_TSOffsetOption
+from pcapkit.protocols.schema.misc.pcapng import IF_TSResolOption as PCAPNG_IF_TSResolOption
+from pcapkit.protocols.schema.misc.pcapng import IF_TxSpeedOption as PCAPNG_IF_TxSpeedOption
+from pcapkit.protocols.schema.misc.pcapng import IF_TZoneOption as PCAPNG_IF_TZoneOption
+from pcapkit.protocols.schema.misc.pcapng import \
+    InterfaceDescriptionBlock as PCAPNG_InterfaceDescriptionBlock
+from pcapkit.protocols.schema.misc.pcapng import \
+    InterfaceStatisticsBlock as PCAPNG_InterfaceStatisticsBlock
+from pcapkit.protocols.schema.misc.pcapng import IPv4Record as PCAPNG_IPv4Record
+from pcapkit.protocols.schema.misc.pcapng import IPv6Record as PCAPNG_IPv6Record
+from pcapkit.protocols.schema.misc.pcapng import ISB_EndTimeOption as PCAPNG_ISB_EndTimeOption
+from pcapkit.protocols.schema.misc.pcapng import \
+    ISB_FilterAcceptOption as PCAPNG_ISB_FilterAcceptOption
+from pcapkit.protocols.schema.misc.pcapng import ISB_IFDropOption as PCAPNG_ISB_IFDropOption
+from pcapkit.protocols.schema.misc.pcapng import ISB_IFRecvOption as PCAPNG_ISB_IFRecvOption
+from pcapkit.protocols.schema.misc.pcapng import ISB_OSDropOption as PCAPNG_ISB_OSDropOption
+from pcapkit.protocols.schema.misc.pcapng import ISB_StartTimeOption as PCAPNG_ISB_StartTimeOption
+from pcapkit.protocols.schema.misc.pcapng import ISB_UsrDelivOption as PCAPNG_ISB_UsrDelivOption
+from pcapkit.protocols.schema.misc.pcapng import NameResolutionBlock as PCAPNG_NameResolutionBlock
+from pcapkit.protocols.schema.misc.pcapng import NameResolutionRecord as PCAPNG_NameResolutionRecord
+from pcapkit.protocols.schema.misc.pcapng import NS_DNSIP4AddrOption as PCAPNG_NS_DNSIP4AddrOption
+from pcapkit.protocols.schema.misc.pcapng import NS_DNSIP6AddrOption as PCAPNG_NS_DNSIP6AddrOption
+from pcapkit.protocols.schema.misc.pcapng import NS_DNSNameOption as PCAPNG_NS_DNSNameOption
+from pcapkit.protocols.schema.misc.pcapng import Option as PCAPNG_Option
+from pcapkit.protocols.schema.misc.pcapng import SectionHeaderBlock as PCAPNG_SectionHeaderBlock
+from pcapkit.protocols.schema.misc.pcapng import SimplePacketBlock as PCAPNG_SimplePacketBlock
+from pcapkit.protocols.schema.misc.pcapng import \
+    SystemdJournalExportBlock as PCAPNG_SystemdJournalExportBlock
+from pcapkit.protocols.schema.misc.pcapng import TLSKeyLog as PCAPNG_TLSKeyLog
+from pcapkit.protocols.schema.misc.pcapng import UnknownBlock as PCAPNG_UnknownBlock
+from pcapkit.protocols.schema.misc.pcapng import UnknownOption as PCAPNG_UnknownOption
+from pcapkit.protocols.schema.misc.pcapng import UnknownRecord as PCAPNG_UnknownRecord
+from pcapkit.protocols.schema.misc.pcapng import WireGuardKeyLog as PCAPNG_WireGuardKeyLog
+from pcapkit.protocols.schema.misc.pcapng import ZigBeeAPSKey as PCAPNG_ZigBeeAPSKey
+from pcapkit.protocols.schema.misc.pcapng import ZigBeeNWKKey as PCAPNG_ZigBeeNWKKey
+
+# misc protocols
+from pcapkit.protocols.schema.misc.raw import Raw
+from pcapkit.protocols.schema.misc.null import NoPayload
+
+__all__ = [
+    # PCAP file format
+    'Header',
+    'Frame',
+
+    # PCAP-NG file format
+    'PCAPNG',
+    'PCAPNG_Option', 'PCAPNG_UnknownOption',
+    'PCAPNG_EndOfOption', 'PCAPNG_CommentOption', 'PCAPNG_CustomOption',
+    'PCAPNG_IF_NameOption', 'PCAPNG_IF_DescriptionOption', 'PCAPNG_IF_IPv4AddrOption', 'PCAPNG_IF_IPv6AddrOption',
+    'PCAPNG_IF_MACAddrOption', 'PCAPNG_IF_EUIAddrOption', 'PCAPNG_IF_SpeedOption', 'PCAPNG_IF_TSResolOption',
+    'PCAPNG_IF_TZoneOption', 'PCAPNG_IF_FilterOption', 'PCAPNG_IF_OSOption', 'PCAPNG_IF_FCSLenOption',
+    'PCAPNG_IF_TSOffsetOption', 'PCAPNG_IF_HardwareOption', 'PCAPNG_IF_TxSpeedOption', 'PCAPNG_IF_RxSpeedOption',
+    'PCAPNG_EPB_FlagsOption', 'PCAPNG_EPB_HashOption', 'PCAPNG_EPB_DropCountOption', 'PCAPNG_EPB_PacketIDOption',
+    'PCAPNG_EPB_QueueOption', 'PCAPNG_EPB_VerdictOption',
+    'PCAPNG_NS_DNSNameOption', 'PCAPNG_NS_DNSIP4AddrOption', 'PCAPNG_NS_DNSIP6AddrOption',
+    'PCAPNG_ISB_StartTimeOption', 'PCAPNG_ISB_EndTimeOption', 'PCAPNG_ISB_IFRecvOption', 'PCAPNG_ISB_IFDropOption',
+    'PCAPNG_ISB_FilterAcceptOption', 'PCAPNG_ISB_OSDropOption', 'PCAPNG_ISB_UsrDelivOption',
+    'PCAPNG_NameResolutionRecord', 'PCAPNG_UnknownRecord', 'PCAPNG_EndRecord', 'PCAPNG_IPv4Record', 'PCAPNG_IPv6Record',
+    'PCAPNG_DSBSecrets', 'PCAPNG_UnknownSecrets', 'PCAPNG_TLSKeyLog', 'PCAPNG_WireGuardKeyLog', 'PCAPNG_ZigBeeNWKKey',
+    'PCAPNG_ZigBeeAPSKey',
+    'PCAPNG_BlockType',
+    'PCAPNG_UnknownBlock', 'PCAPNG_SectionHeaderBlock', 'PCAPNG_InterfaceDescriptionBlock',
+    'PCAPNG_EnhancedPacketBlock', 'PCAPNG_SimplePacketBlock', 'PCAPNG_NameResolutionBlock',
+    'PCAPNG_InterfaceStatisticsBlock', 'PCAPNG_SystemdJournalExportBlock', 'PCAPNG_DecryptionSecretsBlock',
+    'PCAPNG_CustomBlock',
+
+    # misc protocols
+    'NoPayload',
+    'Raw',
+]

pcapkit/protocols/schema/misc/null.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for empty payload"""
+
+from pcapkit.protocols.schema.schema import Schema, schema_final
+
+__all__ = ['NoPayload']
+
+
+@schema_final
+class NoPayload(Schema):
+    """Schema for empty payload."""
+
+    # NOTE: We add this method for both type annotation and to mark that this
+    # class accepts no arguments at runtime, since :class:`Schema` explicitly
+    # skipped those whose :attr:`__dict__` is empty :obj:`dict`.
+    def __init__(self) -> 'None':  # pylint: disable=super-init-not-called
+        pass

pcapkit/protocols/schema/misc/pcap/__init__.py

@@ -0,0 +1,10 @@
+# -*- coding: utf-8 -*-
+"""header schema for PCAP file format"""
+
+from pcapkit.protocols.schema.misc.pcap.header import Header
+from pcapkit.protocols.schema.misc.pcap.frame import Frame
+
+__all__ = [
+    'Header',
+    'Frame',
+]

pcapkit/protocols/schema/misc/pcap/frame.py

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for frame header of PCAP file format"""
+
+import sys
+from typing import TYPE_CHECKING
+
+from pcapkit.corekit.fields.misc import PayloadField
+from pcapkit.corekit.fields.numbers import UInt32Field
+from pcapkit.protocols.schema.schema import Schema, schema_final
+
+__all__ = ['Frame']
+
+if TYPE_CHECKING:
+    from typing import Any
+
+    from pcapkit.corekit.fields.numbers import NumberField as Field
+    from pcapkit.protocols.protocol import ProtocolBase as Protocol
+
+
+def byteorder_callback(field: 'Field', packet: 'dict[str, Any]') -> 'None':
+    """Update byte order of PCAP file.
+
+    Args:
+        field: Field instance.
+        packet: Packet data.
+
+    """
+    field._byteorder = packet.get('byteorder', sys.byteorder)
+
+
+@schema_final
+class Frame(Schema):
+    """Frame header of PCAP file format."""
+
+    __payload__ = 'packet'
+
+    #: Timestamp seconds.
+    ts_sec: 'int' = UInt32Field(callback=byteorder_callback)
+    #: Timestamp microseconds.
+    ts_usec: 'int' = UInt32Field(callback=byteorder_callback)
+    #: Number of octets of packet saved in file.
+    incl_len: 'int' = UInt32Field(callback=byteorder_callback)
+    #: Actual length of packet.
+    orig_len: 'int' = UInt32Field(callback=byteorder_callback)
+    #: Payload.
+    packet: 'bytes' = PayloadField(length=lambda pkt: pkt['incl_len'])
+
+    if TYPE_CHECKING:
+        def __init__(self, ts_sec: 'int', ts_usec: 'int', incl_len: 'int',
+                     orig_len: 'int', packet: 'bytes | Protocol | Schema') -> 'None': ...

pcapkit/protocols/schema/misc/pcap/header.py

@@ -0,0 +1,63 @@
+# -*- coding: utf-8 -*-
+# mypy: disable-error-code=assignment
+"""header schema for global header of PCAP file format"""
+
+from typing import TYPE_CHECKING
+
+from pcapkit.const.reg.linktype import LinkType as Enum_LinkType
+from pcapkit.corekit.fields.numbers import EnumField, Int32Field, UInt16Field, UInt32Field
+from pcapkit.corekit.fields.strings import BytesField
+from pcapkit.protocols.schema.schema import Schema, schema_final
+from pcapkit.utilities.exceptions import ProtocolError
+
+__all__ = ['Header']
+
+if TYPE_CHECKING:
+    from typing import Any
+
+    from pcapkit.corekit.fields.numbers import NumberField
+
+
+def magic_number_callback(field: 'NumberField', packet: 'dict[str, Any]') -> 'None':
+    """Calculate byte order of PCAP file.
+
+    Args:
+        field: Field instance.
+        packet: Packet data.
+
+    """
+    magic_number = packet['magic_number']
+    if magic_number == b'\xd4\xc3\xb2\xa1':
+        field._byteorder = 'little'
+    elif magic_number == b'\xa1\xb2\xc3\xd4':
+        field._byteorder = 'big'
+    elif magic_number == b'\x4d\x3c\xb2\xa1':
+        field._byteorder = 'little'
+    elif magic_number == b'\xa1\xb2\x3c\x4d':
+        field._byteorder = 'big'
+    else:
+        raise ProtocolError('invalid magic number')
+
+
+@schema_final
+class Header(Schema):
+    """Global header of PCAP file."""
+
+    #: Magic number.
+    magic_number: 'bytes' = BytesField(length=4)
+    #: Version number major.
+    version_major: 'int' = UInt16Field(callback=magic_number_callback)
+    #: Version number minor.
+    version_minor: 'int' = UInt16Field(callback=magic_number_callback)
+    #: GMT to local correction.
+    thiszone: 'int' = Int32Field(callback=magic_number_callback)
+    #: Accuracy of timestamps.
+    sigfigs: 'int' = UInt32Field(callback=magic_number_callback)
+    #: Max length of captured packets, in octets.
+    snaplen: 'int' = UInt32Field(callback=magic_number_callback)
+    #: Data link type.
+    network: 'Enum_LinkType' = EnumField(length=4, namespace=Enum_LinkType, callback=magic_number_callback)
+
+    if TYPE_CHECKING:
+        def __init__(self, magic_number: 'bytes', version_major: 'int', version_minor: 'int',  # pylint: disable=unused-argument,super-init-not-called,multiple-statements
+                     thiszone: 'int', sigfigs: 'int', snaplen: 'int', network: 'int') -> 'None': ...