Oscar

FYI https://github.com/dugsong/pypcap/blob/master/testsniff.py

basically dpkt doesn't reassemble TCP for you, so in this case it should probably raise NeedData

does the cookie value have ```\n``` in it?

It's possible to decode the encapsulated IP layer (in this case) by manually applying it to the underlying UDP data, and skipping the 8 bytes of JMirror header. E.g. for...

@brightpinefield dpkt will auto-decode layers if they are linked (in this example IP -> ICMP -> ICMP Echo were auto-decoded). For application layer usually one would need to specify the...

A piece of code to replicate the issue would be helpful, yes. `__byte_order__` isn't related to sizing, I don't think it needs to be involved.

This looks like a bug/improper coding to me. ```self.data``` should be set to leftover bytes remaining after unpacking. If it's fully unpacked then set to an empty string, sure. But...

> We'd like to have the CI/CD test also cover BIG endian platforms Just for accuracy ppc64le is little endian (what "le" stands for), some big endian platforms are ppc64,...

Good catch. Assigning `len` and `cmd` in both the unpacking and packing functions definitely seems wrong.

In general if you set the checksum to zero (`pkt.sum=0`), then serialize the packet (ie. call `bytes(pkt)`) it will be auto-recalculated. See the code here: https://github.com/kbandla/dpkt/blob/master/dpkt/ip.py#L90