Question

I am trying to view the raw html being sent over the wire using scapy. The issue i am having is the the payload of the tcp packet isn’t printing as ascii.

def sniffer_callback(packet):
    print "[*] Got a packet"
    if(validate_packet(packet)):
            resend_packet(packet)
    else:
            resend_packet(packet)
             print "------------------------------"

def validate_packet(packet):
# Validate whether the packet came from the right domain    
     print "[!] Validating Packet"
      tcp = packet[TCP]
      print  tcp.payload

[*] Got a packet

[!] Validating Packet

HTTP/1.1 200 OK

Content-Type: application/json;charset=utf-8

Cache-Control: max-age=5

Content-Encoding: gzip

Content-Length: 121

Accept-Ranges: bytes

Date: Thu, 11 Oct 2012 23:45:45 GMT

Age: 4

Connection: keep-alive

P3P: CP=”CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY
ONL UNI PUR COM NAV INT DEM CNT STA PRE”

m�=
�0
���
MSkxqP�A��I�n������Fާ3���/HE����jFn�Vm���xk��ZL��b��m���������”h��=�L,�2�Q����

Thats an example of a packet i recieve but i am wondering how to view the entire packet not just the http header.

Thanks in advance for the help

Answer 1

The packet you chose is actually compressed using gzip. Notice this header:

Content-Encoding: gzip

You should be able to decompress it with the gzip module. A guide is available at:

http://www.diveintopython.net/http_web_services/gzip_compression.html