title: Change TCP Payload with nfqueue/scapy
body: <p>Hello I am using nfqueue and scapy and I my goal is to recieve packets at my NFQUEUE, change the payload and resend them.</p>
  
  <p>I can change fields like the TTL without any kind of problem, but when it comes to change the payload, I am encoutering problems.</p>
  
  <p>When I change the payload, I sniff the packet with wireshark and apparently I send the packet with the payload modified, but the server doesn't answer.</p>
  
  <p>This is my code:</p>
  
  <pre><code>#!/usr/bin/env python
  
  import nfqueue
  from scapy.all import *
  def callback(payload):
      data = payload.get_data()
      pkt = IP(data)
  
      pkt[TCP].payload = str(pkt[TCP].payload).replace("ABC","GET")
  
      pkt[IP].ttl = 40
  
      print 'Data: '+ str(pkt[TCP].payload)
      print 'TTL: ' + str(pkt[IP].ttl)
  
      del pkt[IP].chksum
      payload.set_verdict_modified(nfqueue.NF_ACCEPT, str(pkt), len(pkt))
  def main():
      q = nfqueue.queue()
      q.open()
      q.bind(socket.AF_INET)
      q.set_callback(callback)
      q.create_queue(0)
      try:
          q.try_run() # Main loop
      except KeyboardInterrupt:
          q.unbind(socket.AF_INET)
          q.close()
  
  main()
  </code></pre>
  
  <p>I have set this rule for outgoing traffic to port 80: <code>iptables -I OUTPUT -s 192.168.1.10 -p tcp --dport 80 -j NFQUEUE</code></p>
  
  <p>And, to test it, for example I open telnet to google port 80, do a <code>GET / HTTP/1.1</code> and this is what I see:</p>
  
  <pre><code>TTL: 40
  DATA: GET / HTTP/1.1
  </code></pre>
  
  <p>Now, if I do <code>ABC / HTTP/1.1</code> I receive no answer! My telnet just get stuck.</p>
  
  <p>I have also tried on HTTP websites browers to browse something, check on wireshark how my TTL is really changing to 40, then, browse the string "ABC" and my browser again get stuck.
  I sniff the request changed to GET but I receive no answer.</p>
  
  <p>Thank is kind of giving me a headache and I would really appreciate if someone with more experience could lead me to the right way. Thank you in advance.</p>