How to read whole ip layer and tcp layer from a packet when using scapy?

Question

I am doing a TCP retransmission behavior test when receiving ICMP Destination unreachable (Fragmentation needed ICMP TYPE=3 CODE=4) message with scapy.

The test flow like this:
1. Establish a TCP connection to the server
2. Send a HTTP GET request to the server when TCP is established
3. When HTTP Response back
4. Send an ICMP type 3 code 4 message to the server with s small MTU set

The question is that ICMP TYPE=3 CODE=4 message include the IP Header and partial TCP header (srt, dst and seq number) of that HTTP Response packets. Currently, I just read each paramemter (like IP identification, frag tag, ttl etc.) from that HTTP Response packets. The question is: is there any way that I can read the whole IP and TCP header from that packet:

ICMP(TYPE=3 CODE=4)/IP Header/TCP Header

Answer 1

Hopefully the following will help:

>>> pkt = ICMP()/IP()/TCP()
>>> ip_header = pkt.getlayer(IP) 
>>> ip_header 
<IP  frag=0 proto=tcp |<TCP  |>>
>>> 

To retrieve just the IP header:

>>> pkt = Ether()/IP()/TCP()
>>> ip = pkt.getlayer(IP)
>>> ip
<IP  frag=0 proto=tcp |<TCP  |>>
>>> ip.remove_payload()
>>> ip
<IP  |>
>>> 

Answer 2

I convert the packet object into dict object to make my parsing life easier. code:

from scapy.all import *
from cStringIO import StringIO
import sys
class Capturing(list):
        """
        This class will capture sys.out.
        More info:
        http://stackoverflow.com/questions/16571150/how-to-capture-stdout-output-from-a-python-function-call
        """
    def __enter__(self):
        self._stdout = sys.stdout
        sys.stdout = self._stringio = StringIO()
        return self
    def __exit__(self, *args):
        self.extend(self._stringio.getvalue().splitlines())
        del self._stringio    # free up some memory
        sys.stdout = self._stdout
class PacketDict(dict):
        """
        This class will convert packet into a dict by using the result of packet.show2(). Furthermore the original
        packet will be also saved as attribute '.packet'.
        More class functions could be added, currently only support 'haslayer()'.
        Scapy version: scapy-2.3.3
        """
    def __init__(self, pkt):
        self.packet = pkt
        self.__packet_to_dict()
    def __extract_key(self, line):
        a = line.lstrip("###[ ").rstrip(" ]### ")
        return a
    def __extract_value_to_dict(self, line):
        if line.find("=") > -1:
            b = line.replace(" ","")
            a = b.split("=")
            return {a[0]: a[1]}
        return {line.replace(" ",""): None}
    def __packet_to_dict(self):
        with Capturing() as packet_in_list:
            self.packet.show2()
        current_dict = self
        for line in packet_in_list:
            if line.strip() != "":
                line = line.replace("|","")
                if line.find('###[') > -1:
                    key = self.__extract_key(line)
                    current_dict[key] = {}
                    current_dict = current_dict[key]
                    continue
                current_dict.update(self.__extract_value_to_dict(line))
    def haslayer(self, pkt_cls):
        return self.packet.haslayer(pkt_cls)

if __name__ == "__main__":
    packet_list = rdpcap("/media/sf_ubshare/pcap/test.pcap")
    for packet in packet_list:
        a = PacketDict(packet)
        print a['Ethernet']['IP']['ihl']
        print a.haslayer('ISAKMP')

Output:

/usr/bin/python2.7 /home/yuanzhi/workspace/scaptest/scaptest.py
5L
1

The dictionary will look like:

{
  "Ethernet": {
    "src": "5e:22:73:12:50:02", 
    "dst": "6e:30:96:e3:a0:6c", 
    "type": "0x800", 
    "IP": {
      "frag": "0L", 
      "src": "1.0.3.0", 
      "UDP": {
        "dport": "isakmp", 
        "ISAKMP": {
          "resp_cookie": "'\\xb5A\\x06\\xef\\x126~\\x95'", 
          "exch_type": "identityprot.", 
          "length": "204", 
          "version": "0x10", 
          "flags": "", 
          "init_cookie": "'2\\x12\\xbda\\xee\\xa8\\xba\\xa6'", 
          "ISAKMP SA": {
            "IKE proposal": {
              "SPI": "''", 
              "length": "44", 
              "IKE Transform": {
                "length": "36", 
                "num": "0", 
                "transforms": "[('Encryption','AES-CBC'),('KeyLength',256),('Hash','SHA'),('Authentication','PSK'),('GroupDesc','1024MODPgr'),('LifeType','Seconds'),('LifeDuration',43200)]", 
                "ISAKMP Vendor ID": {......