title: Scapy - TCPSession from list of packets
body: <p>I'm trying to use TCPSession funcionality (like: <code>sniff(offline="./my_file.pcap", prn=func, store=False, session=TCPSession)</code>) but without creating a PCAP file.</p>
  
  <p>I receive a list of RAW Packets so I can build a list of Scapy packets but I need the <strong>TCPSession</strong> funcionality because of the HTTP Packets: Without TCPSession the headers and the body are in different packets so HTTP Layers Class can't identify the body part.</p>
  
  <p>So I have this code that finds the <strong>HTTP Requests</strong>:</p>
  
  <pre class="lang-py prettyprint-override"><code>import pickle
  from scapy.all import *
  from scapy.layers import http
  load_layer("http")
  
  def expand(x):
      yield x
      while x.payload:
          x = x.payload
          yield x
  
  file_pickle = open('prueba.pkl','rb')
  pkt_list = pickle.load(file_pickle)
  
  for pkt_raw in pkt_list:
      p = Ether(pkt_raw)
      if p.haslayer(IP):
          srcIP = p[IP].src
          if p.haslayer(HTTP):
              if p.haslayer(HTTPRequest):
                  print(list(expand(p)), end="\n---------------------------------------------------\n")
  </code></pre>
  
  <p>The execution of this code finds the HTTP Requests but without the Body part of the POST Requests:</p>
  
  <pre><code>[...]&lt;HTTPRequest  Method='POST' Path='/NP3POCF.jsp' Http_Version='HTTP/1.1' Accept='*/*' Accept_Encoding='gzip, deflate' Connection='keep-alive' Content_Length='56' Content_Type='application/x-www-form-urlencoded' Host='172.16.191.129' User_Agent='python-requests/2.7.0 CPython/3.7.5 Linux/5.3.0-kali2-amd64' |&gt;]
  </code></pre>
  
  <p>With a sniffer with TCPSession (such as Scapy sniff function) the packet has a Raw Layer that contains the body of the request.</p>
  
  <p>Any help to apply TCPSession? Thank You.</p>