Use capinfos epoch output and compare public CLI/MCP results with UTC
instants derived independently from the known authored PCAP records.
Avoid comparing product output with the same host-local display text.
Related: #4907, #4909. Syntax checked; live Linux verification not run.
Co-authored-by: Mert Kaya <47145541+mertkayacs@users.noreply.github.com>
Move the capinfos oracle to inspect_pcap_capture, whose summary retains timestamps. The field-inspection contract does not expose them. Check both CLI and MCP results against the independently observed producer values.
Accept the First/Last labels used by Wireshark 4.0 and 4.2 at the capinfos metadata owner. Preserve producer values and omitted timestamps, and verify real MCP timestamp projection against direct capinfos output.
Refs #4186, #4180
Co-authored-by: KET ⚡ <ket.patil77@gmail.com>
Bound retries of native close conflicts at the retained runtime owner. Preserve exact failures and later retry authority after exhaustion. Attempt all verifier cleanup while retaining primary failures; extend held-file Windows verification.
Refs #4136, #4185
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
Summarize saved Wireshark4.x captures with enforced native resource limits, serialized admission, stable snapshot verification and retained fact/text pages. Preserve complete inventories within resource budgets and source uncertainty; report cleanup failure with partial Evidence and retained ownership.
Verified six recorded corpora /13026 packets with independent Scapy/Python oracles, real CLI/MCP/schema parity,60 SNI names,132 DNS addresses and1000 URIs. Real TShark CI now exercises summary/paging. Actual Windows/Bun Wireshark remains unverified; macOS capture requires a separate enforceable-bound decision.
Co-authored-by: 3QL <85309073+3QL@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Inspect selected fields in existing captures through shared CLI/MCP Evidence.
Page matching frames without changing dissection or two-pass read coverage;
retain failed descriptor/process cleanup ownership and reject excess admission.
Verified with real TShark 4.0.17 and 4.2.2, public Wireshark recordings,
owned HTTP application traffic, real CLI/MCP workflows and schema checks.
Co-authored-by: Olorinm <59321404+Olorinm@users.noreply.github.com>
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
