title: scapy - Missing data in sniffed TCP packets
body: <p>I have an application that sends data over a TCP connection to a production server. I need to sniff the contents of that TCP connection and resend it to a debug server.</p>
  
  <p>I've gotten quite close with this:</p>
  
  <pre><code>from scapy.all import *
  packets = 0
  
  def dup_pkt(pkt):
      global packets
  
      read = raw(pkt[TCP].payload)
      print(str(packets))
      s.sendall(read)
  
  print("connecting")
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect(("x.x.x.x", 12345))
  print("connected")
  
  print("sniffing")
  pkts = sniff(prn=dup_pkt, filter="tcp dst port 12345 and not host x.x.x.x") # don't sniff the packets we're resending
  </code></pre>
  
  <p>The problem is that the packets appear to be missing data in the first two headers. I have set the debug server to save each received packet to a file, and set the application to connect directly to the debug server to compare the known good packet data with what the sniffer is sending. In the first packet, the first 1546/2079 bytes are good, but after that, each byte is zero instead of full of the correct data. In the second packet, the first 11 bytes are missing, but the rest is good. </p>
  
  <p>Interestingly, after those initial two big setup packets, the remainder of the TCP packets seem to be sniffed properly - perhaps because they are usually far simpler and less than 40 bytes each.</p>
  
  <p>Is there a better way to read packet data? Am I missing something? Unfortunately I don't have access to the source of the application, so I can't tell if it's doing anything special with those two big packets I'm having trouble with.</p>