Ethernet header removal using scapy (python)

Question

I am trying to work with pcap files. For a preprocessing phase, I am trying to remove an ethernet header using scapy but not sure if this is the right way. Any ideas would like much appreciated. Thanks

I am working on Jupyter notebook and I use python and scapy to read pcap files.

Packet summary: 
'Ether / IP / UDP 131.XXX:XXX:XXX:netbios_ns > 131.XXX:XXX:XXX:netbios_ns / NBNSQueryRequest'

Tried:
pk1= ['Ether / IP / UDP 131.XXX:XXX:XXX:netbios_ns > 131.XXX:XXX:XXX:netbios_ns / NBNSQueryRequest']
pkt2=pk1['NBNSQueryRequest']
pk1[Ether].remove_payload()
pk1 /=pkt2

Answer 1

You may open capture file in Wireshark, go to File menu, then "Export PDU" and specify a filter of what do you want to export.

Answer 2

If I understand correctly your question you can access the payload by doing the following:

1. pk1[1]

2. pk1.payload

Answer 3

Assuming you have a Packet object with the following layers:

pkt = Ether()/IP()/ICMP()

The packet would look something like this:

print(repr(pkt)) 
# <Ether  type=IPv4 |<IP  frag=0 proto=icmp |<ICMP  |>>>

pkt is actually an ethernet packet with all the other layers encapsulated as it's payload, so you can just use:

pkt = pkt.payload
# Or
pkt = pkt[Ether].payload

And you'll end up with:

print(repr(pkt))
# <IP  frag=0 proto=icmp |<ICMP  |>>