I'm trying to extract all UDP and TCP payloads from a pcap file using packet[TCP].payload.load and packet[UDP].payload.load. However, I noticed that packet[UDP].payload.load failed for DNS packets.
The output of packet[IP].show() is as follows (one DNS query and response packet). I don't see any [ Raw ] section, which I guess is where the .load failed. How can I extract the payload in bytes after the UDP layer for such packets?
====================================================
###[ IP ]###
version = 4
ihl = 5
tos = 0x0
len = 64
id = 59183
flags =
frag = 0
ttl = 128
proto = udp
chksum = 0x0
src = 172.22.32.48
dst = 203.211.152.66
\options \
###[ UDP ]###
sport = 55884
dport = domain
len = 44
chksum = 0x309a
###[ DNS ]###
id = 40212
qr = 0
opcode = QUERY
aa = 0
tc = 0
rd = 1
ra = 0
z = 0
<snipped>
None
====================================================
###[ IP ]###
version = 4
ihl = 5
tos = 0x0
len = 155
id = 38148
flags =
frag = 0
ttl = 58
proto = udp
chksum = 0xbaf1
src = 203.211.152.66
dst = 172.22.32.48
\options \
###[ UDP ]###
sport = domain
dport = 55884
len = 135
chksum = 0x51d9
###[ DNS ]###
id = 40212
qr = 1
opcode = QUERY
aa = 0
tc = 0
rd = 1
ra = 1
<snipped>
None
Scapy has dissected the DNS layer into something meaningful. If you want the raw bytes, you can call bytes() on a layer to get them back.
For instance:
bytes(packet[TCP].payload)