title: Raw load found, how to access?
body: <p>To start off, I have read through other raw answers pertaining to scapy on here, however none have been useful, maybe I am just doing something wrong and thats what has brought me here today.</p>
  
  <p>So, for starters, I have a pcap file, which started corrupted with some retransmissions, to my belief I have gotten it back to gether correctly.</p>
  
  <p>It contains Radiotap header, IEEE 802.11 (dot11), logical-link control, IPv4, UDP, and DNS.</p>
  
  <p>To my understanding, the udp packets being transmitted hold this raw data, however, do to a some recent quirks, maybe the raw is in Radiotap/raw.</p>
  
  <p>Using scapy, I'm iterating through the packets, and when a packet with the Raw layer is found, I am using the <code>.show()</code> function of scapy to view it.</p>
  
  <p>As such, I can see that there is a raw load available</p>
  
  <pre><code>###[ Raw ]###
   \load      \
    |###[ Raw ]###
    |  load      = '@\x00\x00\x00\xff\xff\xff\xff\xff\xff\x10h?'
  </code></pre>
  
  <p>So, I suppose my question is, how can I capture this payload to receive whatever this may be, To my knowledge the load is supposed to be an image file, however I have trouble believing such, so I assume I have misstepped somewhere.</p>
  
  <p>Here is the code I'm using to achieve the above result</p>
  
  <pre><code>from scapy.all import *
  from scapy.utils import *
  
  
  pack = rdpcap('/home/username/Downloads/new.pcap')
  for packet in pack:
      if packet.getlayer(Raw):
          print '[+] Found Raw' + '\n'
          l = packet.getlayer(Raw)
          rawr = Raw(l)
          rawr.show()
  </code></pre>
  
  <p>Any help, or insight for further reading would be appreciated, I am new to scapy and no expert in packet dissection.</p>
  
  <p>*Side note, previously I had tried (using separate code and server) to replay the packets and send them to myself, to no avail. However I feel thats due to my lack of knowledge in receipt of UDP packets.</p>
  
  <p><strong>UPDATES</strong> - I have now tested my pcap file with a scapy reassembler, and I've confirmed I have no fragmented packets, or anything of the sort, so I assume all should go smoothly...
   Upon opening my pcap in wireshark, I can see that there are retransmissions, but I'm not sure how much that will affect my goals since no fragmentation occurred?</p>
  
  <p>Also, I have tried the <code>getlayer(Raw).load</code>, if I use print on it I get some gibberish to the screen, I'm assuming its the data to my would-be-image, however I need to now get it into a usable format.</p>