Strange Payload when generating raw packet with Scappy

Question

I am having an strange problem trying to generate a raw packet with Scappy.

I am doing the following:

eee=Ether(dst='08:00:11:11:11', src='08:00:11:11:22:22', type=0x888)/Raw(load='112233445566778888776655443322110901')

But when I do a hexdump of the newly created packet:

hexdump(eee)
0000   08 00 11 11 11 00 08 00  11 11 22 22 08 88 **31 31**   ..........""..11
0010   **32 32** 33 33 34 34 35 35  36 36 37 37 38 38 38 38   2233445566778888
0020   37 37 36 36 35 35 34 34  33 33 32 32 31 31 30 39   7766554433221109
0030   30 31

It look like it is appending a 3 to the hexdump version of the payload. I really do not know from where that 3 is appearing.

Thanks in advance for any hint.

Answer 1

The Raw layer takes the binary representation of the load argument. Since the ascii value of the character 1 is 0x31 and the ascii value of the character 2 is 0x32, the binary representation of the string 1122 is 0x31313232. That's what you see as the output of hexdump.

What you need to do is decode the string before transferring it as the load argument to the Raw layer:

In [1]: from scapy.all import *
WARNING: No route found for IPv6 destination :: (no default route?)

In [2]: eee=Ether(dst='08:00:11:11:11', src='08:00:11:11:22:22', type=0x888)/Raw(load='112233445566778888776655443322110901'.decode("HEX"))

In [3]: hexdump(eee)
0000   08 00 11 11 11 00 08 00  11 11 22 22 08 88 11 22   ..........""..."
0010   33 44 55 66 77 88 88 77  66 55 44 33 22 11 09 01   3DUfw..wfUD3"...