How to create a Scapy packet from raw bytes
Using the python packet parsing/sniffing tool Scapy, I would like to create a packet from a raw byte-string. While the details of my specific use-case are more realistic, the following example illustrates my problem and my present attempt:
# Get an example packet (we won't really have an offline file in production.)
pkt = sniff(offline="./example_packets/example_packets2.pcap")
# Convert it to raw bytes -- oddly __str__ does this.
raw_packet = str(pkt)
# Current, broken, attempt to construct a new packet from the same bytes as the old.
# In truth, there are easier ways to copy packets from existing Scapy packets, but
# we are really just using that offline packet as a convenient example.
new_packet = Packet(_pkt=raw_packet)
# Sadly, while this packet has the bytes internally, it no longer has the
# interpretations of the layers like the original packet did (such as saying that
# the packet is ARP and has these field values, etc.
print repr(new_packet)
How can I produce a new_packet from raw bytes that will look the same as if it were sniffed from a pcap file?
Answer
There is no way for Scapy to guess the first layer of your packet, so you need to specify it.
You can do so by using the appropriate Packet subclass. For example, say your packet's first layer is Ethernet, use Ether(raw_packet) instead of Packet(raw_packet).