0
votes

I'm reading a pcap file in python using scapy which contains Ethernet packets that have trailer. How can I remove these trailers?

P.S: Ethernet packets can not be less than 64 bytes (including FCS).Network adapters add padding zero bytes to end of the packet to overcome this problem. These padding bytes called "Trailer". See here for more information.

2
are you talking abt: #USER_AGENT = ' (+yourdomain.com)' - nafas
No. I means trailer of the packet in Ethernet header. USER_AGENT exists in HTTP header. - SuB
well why don't you use some proxy, I use TOR and I don't identify myself, (by uncomming that line ). so nothing seems to go through - nafas

2 Answers

1
votes

It seems there is no official way to remove it. This work on frames that have IPv4 as network layer protocol:

packet_without_trailer=IP(str(packet[IP])[0:packet[IP].len])
-2
votes

Just use the upper layers and ignore the Ethernet layer:

packet = eval(originalPacket[IP])