Finding protocols in base layers

[markjrouse]

I'm using the __contains__ method in packet.py to see if I can find a specific protocol within a layer, but of course it doesn't work for all protocols. In my pcap file, I have a number of packets that have either a f1ap layer, or a ngap layer. I have this code:

import pyshark

cap = pyshark.FileCapture("./tc.pcap")

for packet in cap:
    print(packet.__contains__("ngap"))

This of course returns true or false depending on the packet. According to tshark -G, both f1ap and ngap protocols are recognised as protocols by tshark. The protocol nas-5gs is also recognised by tshark as a protocol, but pyshark won't find the nas-5gs protocol. Subsequently, the following code returns all falses.

import pyshark

cap = pyshark.FileCapture("./tc.pcap")

for packet in cap:
    print(packet.__contains__("nas-5gs"))

The problem might be that the nas-5gs protocol data is actually within the ngap layer.

To Reproduce
It's difficult to reproduce this issue, unless you have a pcap file that contains specific 5G traffic.

Expected behavior
I would hope that the nas-5gs protocol is treated as a layer, and the __contains__ method would return true for packets where the nas-5gs protocol is found within the ngap layer. Equally, the nr-rrc protocol is found within the f1ap layer, and I would expect a similar search for nr-rrc to return true when found in f1ap packets.

Versions (please complete the following information):

• OS: macOS 13.6.4
• pyshark version: 0.5.3
• tshark version: 4.2.3