[Python] Is there any way to modify strings inside .pcap files with python scapy wthiout...

I am experimenting with scapy in python and captured a test pcap which only contains a transfer of a file over HTTP. The contents of the file are plaintext.

I am trying to basically change the Server string:

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.11.8


to a different one, let's say:

HTTP/1.0 200 OK
Server: A custom one


The thing is that after this change, the size of the packet changes and as a result a lot of TCP packets are marked as retransmissions, the content of the HTTP packet says that bytes are missing etc.

Is there a way to modify strings - and the corresponding size fields - so that the pcap remains without errors?

P.S. I tried changing the Frame Length and Capture Length fields of Ether layer but still was getting errors.

My demo script for the time being is:

from scapy.all import *

def replace_user_agent(packets):
i = 0
for packet in packets:
i+=1
if packet.haslayer(Raw):
raw = packet[Raw].load
if b"SimpleHTTP/0.6 Python/3.11.8" in raw:
raw = raw.replace(b"SimpleHTTP/0.6 Python/3.11.8", b"A custom one"+ b" " * (len("SimpleHTTP/0.6 Python/3.11.8") - len("A custom one"))) # cover the missing length with spaces
packet[Raw].load = raw

# Recalculate length fields and checksums
if packet.haslayer(IP):
del packet[IP].len # Recalculate IP length
del packet[IP].chksum # Recalculate IP checksum
if packet.haslayer(TCP):
del packet[TCP].chksum # Recalculate TCP checksum
elif packet.haslayer(UDP):
del packet[UDP].len # Recalculate UDP length
del packet[UDP].chksum # Recalculate UDP checksum


return packets

if __name__ == "__main__":
input_pcap = "input.pcap"
output_pcap = "output.pcap"

packets = rdpcap(input_pcap)
modified_packets = replace_user_agent(packets)
wrpcap(output_pcap, modified_packets)


This script does and does not do what I am trying to achieve. It basically replaces the Server string with my shorter custom one, and for the missing bytes it just uses spaces.

Continue reading...