title: Using Scapy to send tcp payload: Why a byte is eaten?
body: <p>My issue is as follows: I want to implement a listen service using scapy to stimulate a honeypot (because honeypot uses a fake ip, so I can't use OS sockets) and I chose scapy.</p>
  <p>I implemented a very simple TCP hand-shake procedure, however one thing frustrated me: one byte of the packet I use PSH to send is eaten.</p>
  <p>For example I send &quot;abc&quot; out to a client, but the client's socket, for example netcat or wget, only receive &quot;bc&quot;. Another example is &quot;HTTP/1.1 200 OK&quot; becomes &quot;TTP/1.1 200 OK&quot;. I captured packet and wireshark can correctly recognize my hand-made packet as HTTP, but the client socket just lack 1 byte. I don't know why.</p>
  <p>The code is as follows:
  192.168.1.100 stands for server(my) ip addr,9999 is the port. For example, I run this python script on 192.168.1.100, then I use &quot;nc 192.168.1.100 9999&quot;. I expect to get &quot;abc&quot;, but I can only get &quot;bc&quot;, but the packet seems no problem in Wireshark. it's so strange.</p>
  <pre class="lang-py prettyprint-override"><code>    '''
      Created on Jun 2, 2012
      
      @author: root
      '''
      from scapy import all
      from scapy.layers.inet import IP, ICMP, TCP
      from scapy.packet import ls, Raw
      from scapy.sendrecv import sniff, send
      from scipy.signal.signaltools import lfilter
      import scapy.all
      HOSTADDR = &quot;192.168.1.100&quot;
      TCPPORT = 9999 'port to listen for'
      SEQ_NUM = 100
      
      ADD_TEST = &quot;abc&quot;
      
      
      def tcp_monitor_callback(pkt):
          global SEQ_NUM
          global TCPPORT
          if(pkt.payload.payload.flags == 2):
              'A syn situation, 2 for SYN'
              print(&quot;tcp incoming connection&quot;)
              ACK=TCP(sport=TCPPORT, dport=pkt.payload.payload.sport, flags=&quot;SA&quot;,ack=pkt.payload.payload.seq + 1,seq=0)
              send(IP(src=pkt.payload.dst,dst=pkt.payload.src)/ACK)
          if(pkt.payload.payload.flags &amp; 8 !=0):
              'accept push from client, 8 for PSH flag'
              print(&quot;tcp push connection&quot;)
              pushLen = len(pkt.payload.payload.load)
              httpPart=TCP(sport=TCPPORT, dport=pkt.payload.payload.sport, flags=&quot;PA&quot;, ack=pkt.payload.payload.seq + pushLen)/Raw(load=ADD_TEST)
              'PROBLEM HERE!!!! If I send out abc, the client socket only receive bc, one byte disappers!!!But the packet received by client is CORRECT'
              send(IP(src=pkt.payload.dst,dst=pkt.payload.src)/httpPart)
          if(pkt.payload.payload.flags &amp; 1 !=0):
              'accept fin from cilent'
              print (&quot;tcp fin connection&quot;)
              FIN=TCP(sport=TCPPORT, dport=pkt.payload.payload.sport, flags=&quot;FA&quot;, ack=pkt.payload.payload.seq +1, seq = pkt.payload.payload.ack)
              send(IP(src=pkt.payload.dst,dst=pkt.payload.src)/FIN)
      def dispatcher_callback(pkt):
          print &quot;packet incoming&quot;
          global HOSTADDR
          global TCPPORT
          if(pkt.haslayer(TCP) and (pkt.payload.dst == HOSTADDR) and (pkt.payload.dport == TCPPORT)):
              tcp_monitor_callback(pkt)
          else:
              return
      if __name__ == '__main__':
          print &quot;HoneyPot listen Module Test&quot;
          scapy.all.conf.iface = &quot;eth0&quot;
          sniff(filter=(&quot;(tcp dst port %s) and dst host %s&quot;) % (TCPPORT,HOSTADDR), prn=dispatcher_callback)
          
  </code></pre>