diff --git a/scapy/__init__.py b/scapy/__init__.py
index 3126c5e412b2621267e67e2dea8c5c88e4781e7a..5db3f574a550d14b6fe0bc12aaaf0ad047302ebd 100644
--- a/scapy/__init__.py
+++ b/scapy/__init__.py
@@ -47,14 +47,14 @@ def _version_from_git_describe():
     out, err = p.communicate()
 
     if p.returncode == 0:
-        tag = out.strip()
-        match = re.match(r'^v?(.+?)-(\d+)-g[a-f0-9]+$', tag)
+        tag = out.decode().strip()
+        match = re.match('^v?(.+?)-(\\d+)-g[a-f0-9]+$', tag)
         if match:
             # remove the 'v' prefix and add a '.devN' suffix
             return '%s.dev%s' % (match.group(1), match.group(2))
         else:
             # just remove the 'v' prefix
-            return re.sub(r'^v', '', tag)
+            return re.sub('^v', '', tag)
     else:
         raise subprocess.CalledProcessError(p.returncode, err)
 
@@ -78,7 +78,7 @@ def _version():
             # See 'man gitattributes' for more details.
             git_archive_id = '$Format:%h %d$'
             sha1 = git_archive_id.strip().split()[0]
-            match = re.search(r'tag:(\S+)', git_archive_id)
+            match = re.search('tag:(\\S+)', git_archive_id)
             if match:
                 return "git-archive.dev" + match.group(1)
             elif sha1:
diff --git a/scapy/ansmachine.py b/scapy/ansmachine.py
index ddc3a93557206f2a0e3269dc79b56f2a0c55ac72..09c7d44c157a43117b450e26f77e324b641befae 100644
--- a/scapy/ansmachine.py
+++ b/scapy/ansmachine.py
@@ -70,7 +70,7 @@ class AnsweringMachine(six.with_metaclass(ReferenceAM, object)):
     def parse_all_options(self, mode, kargs):
         sniffopt = {}
         sendopt = {}
-        for k in kargs.keys():  # use .keys(): kargs is modified in the loop
+        for k in list(kargs):  # use list(): kargs is modified in the loop
             if k in self.sniff_options_list:
                 sniffopt[k] = kargs[k]
             if k in self.send_options_list:
diff --git a/scapy/asn1/mib.py b/scapy/asn1/mib.py
index 6a5d37e0cc7b850abe5d35a755ae0980499a2918..697887bbd3240f35c028dccd579b037cf9793ce2 100644
--- a/scapy/asn1/mib.py
+++ b/scapy/asn1/mib.py
@@ -73,8 +73,6 @@ class MIBDict(DADict):
             s += '\t"%s" -> "%s" [label="%s"];\n' % (parent, o,remainder)
         s += "}\n"
         do_graph(s, **kargs)
-    def __len__(self):
-        return len(self.keys())
 
 
 def mib_register(ident, value, the_mib, unresolved):
@@ -102,7 +100,7 @@ def mib_register(ident, value, the_mib, unresolved):
         return False
     else:
         the_mib[ident] = resval
-        keys = list(unresolved.keys())
+        keys = list(unresolved)
         i = 0
         while i < len(keys):
             k = keys[i]
diff --git a/scapy/asn1fields.py b/scapy/asn1fields.py
index 5f1caf40de6c9ad1b1fa2dfa60c29c5620c08faf..3a9ed21f8fb30f47aa02390ebd553ecbe82e5e39 100644
--- a/scapy/asn1fields.py
+++ b/scapy/asn1fields.py
@@ -178,7 +178,7 @@ class ASN1F_enum_INTEGER(ASN1F_INTEGER):
         if isinstance(enum, list):
             keys = range(len(enum))
         else:
-            keys = enum.keys()
+            keys = list(enum)
         if any(isinstance(x, six.string_types) for x in keys):
             i2s, s2i = s2i, i2s
         for k in keys:
diff --git a/scapy/contrib/http2.py b/scapy/contrib/http2.py
index 8cfe66dd77809dd76f99899dda65e96d6e3357a1..32b2293b28f74757edbf8b823df957a3d40e4425 100644
--- a/scapy/contrib/http2.py
+++ b/scapy/contrib/http2.py
@@ -2230,7 +2230,7 @@ class HPackHdrTable(Sized):
     @classmethod
     def init_static_table(cls):
         # type: () -> None
-        cls._static_entries_last_idx = max(cls._static_entries.keys())
+        cls._static_entries_last_idx = max(cls._static_entries)
 
     def __init__(self, dynamic_table_max_size=4096, dynamic_table_cap_size=4096):
         # type: (int, int) -> None
@@ -2379,12 +2379,12 @@ class HPackHdrTable(Sized):
         If no matching header is found, this method returns None.
         """
         name = name.lower()
-        for k in type(self)._static_entries.keys():
-            if type(self)._static_entries[k].name() == name:
-                return k
-        for k in range(0, len(self._dynamic_table)):
-            if self._dynamic_table[k].name() == name:
-                return type(self)._static_entries_last_idx + k + 1
+        for key, val in six.iteritems(type(self)._static_entries):
+            if val.name() == name:
+                return key
+        for idx, val in enumerate(self._dynamic_table):
+            if val.name() == name:
+                return type(self)._static_entries_last_idx + idx + 1
         return None
 
     def get_idx_by_name_and_value(self, name, value):
@@ -2398,14 +2398,12 @@ class HPackHdrTable(Sized):
         If no matching header is found, this method returns None.
         """
         name = name.lower()
-        for k in type(self)._static_entries.keys():
-            elmt = type(self)._static_entries[k]
-            if elmt.name() == name and elmt.value() == value:
-                return k
-        for k in range(0, len(self._dynamic_table)):
-            elmt = self._dynamic_table[k]
-            if elmt.name() == name and elmt.value() == value:
-                return type(self)._static_entries_last_idx + k + 1
+        for key, val in six.iteritems(type(self)._static_entries):
+            if val.name() == name and val.value() == value:
+                return key
+        for idx, val in enumerate(self._dynamic_table):
+            if val.name() == name and val.value() == value:
+                return type(self)._static_entries_last_idx + idx + 1
         return None
 
     def __len__(self):
diff --git a/scapy/contrib/modbus.py b/scapy/contrib/modbus.py
index 25bcc82f470c65d7f92de84a3a57463bab4ed630..ee1bdaa407ff52835f4caea5323d2629df8516e0 100644
--- a/scapy/contrib/modbus.py
+++ b/scapy/contrib/modbus.py
@@ -785,7 +785,7 @@ class ModbusADURequest(Packet):
             return _modbus_request_classes[function_code]
         except KeyError:
             pass
-        if function_code in _reserved_funccode_request.keys():
+        if function_code in _reserved_funccode_request:
             return ModbusPDUReservedFunctionCodeRequest
         return ModbusPDUUserDefinedFunctionCodeRequest
 
@@ -820,9 +820,9 @@ class ModbusADUResponse(Packet):
             return _modbus_error_classes[function_code]
         except KeyError:
             pass
-        if function_code in _reserved_funccode_response.keys():
+        if function_code in _reserved_funccode_response:
             return ModbusPDUReservedFunctionCodeResponse
-        elif function_code in _reserved_funccode_error.keys():
+        elif function_code in _reserved_funccode_error:
             return ModbusPDUReservedFunctionCodeError
         if function_code < 0x80:
             return ModbusPDUUserDefinedFunctionCodeResponse
diff --git a/scapy/dadict.py b/scapy/dadict.py
index f45e6e37f11a1bf77392db6f8b25b7cec8ca1333..8fca8e49c1176cb6c1b5dc32b96e0820bf44c272 100644
--- a/scapy/dadict.py
+++ b/scapy/dadict.py
@@ -39,9 +39,10 @@ class DADict:
     def __setitem__(self, attr, val):        
         return setattr(self, self.fixname(attr), val)
     def __iter__(self):
-        return iter(map(lambda x_y1: x_y1[1],filter(lambda x_y: x_y[0] and x_y[0][0]!="_", self.__dict__.items())))
+        return (value for key, value in six.iteritems(self.__dict__)
+                if key and key[0] != '_')
     def _show(self):
-        for k in self.__dict__.keys():
+        for k in self.__dict__:
             if k and k[0] != "_":
                 print("%10s = %r" % (k,getattr(self,k)))
     def __repr__(self):
diff --git a/scapy/fields.py b/scapy/fields.py
index b478779edf3de7646fea4803aedad41d4599cb07..09534ade21d2c299f7579b98a4bb06c493e5572c 100644
--- a/scapy/fields.py
+++ b/scapy/fields.py
@@ -10,6 +10,7 @@ Fields: basic data structures that make up parts of packets.
 from __future__ import absolute_import
 import struct,copy,socket,collections
 from scapy.config import conf
+from scapy.dadict import DADict
 from scapy.volatile import *
 from scapy.data import *
 from scapy.compat import *
@@ -880,7 +881,7 @@ class BitFieldLenField(BitField):
         self.count_of = count_of
         self.adjust = adjust
     def i2m(self, pkt, x):
-        return FieldLenField.i2m.__func__(self, pkt, x)
+        return (FieldLenField.i2m.__func__ if six.PY2 else FieldLenField.i2m)(self, pkt, x)
 
 
 class XBitField(BitField):
@@ -917,8 +918,10 @@ class _EnumField(Field):
             self.s2i_cb = None
             if isinstance(enum, list):
                 keys = range(len(enum))
-            else:
+            elif isinstance(enum, DADict):
                 keys = enum.keys()
+            else:
+                keys = list(enum)
             if any(isinstance(x, str) for x in keys):
                 i2s, s2i = s2i, i2s
             for k in keys:
@@ -965,7 +968,7 @@ class CharEnumField(EnumField):
     def __init__(self, name, default, enum, fmt = "1s"):
         EnumField.__init__(self, name, default, enum, fmt)
         if self.i2s is not None:
-            k = list(self.i2s.keys())
+            k = list(self.i2s)
             if k and len(k[0]) != 1:
                 self.i2s,self.s2i = self.s2i,self.i2s
     def any2i_one(self, pkt, x):
@@ -1258,7 +1261,7 @@ class MultiFlagsField(BitField):
         super(MultiFlagsField, self).__init__(name, default, size)
 
     def any2i(self, pkt, x):
-        assert isinstance(x, (int, long, set)), 'set expected'
+        assert isinstance(x, six.integer_types + (set,)), 'set expected'
 
         if pkt is not None:
             if isinstance(x, six.integer_types):
@@ -1270,8 +1273,8 @@ class MultiFlagsField(BitField):
                     these_names = self.names[v]
                     s = set()
                     for i in x:
-                        for j in these_names.keys():
-                            if these_names[j].short == i:
+                        for val in six.itervalues(these_names):
+                            if val.short == i:
                                 s.add(i)
                                 break
                         else:
@@ -1289,8 +1292,8 @@ class MultiFlagsField(BitField):
 
         r = 0
         for flag_set in x:
-            for i in these_names.keys():
-                if these_names[i].short == flag_set:
+            for i, val in six.iteritems(these_names):
+                if val.short == flag_set:
                     r |= 1 << i
                     break
             else:
diff --git a/scapy/layers/all.py b/scapy/layers/all.py
index 1373bc9916aea5cbd39cddb985e63fda494e3c9d..8743276dfa527206826853d4ada90c8ecf7f1806 100644
--- a/scapy/layers/all.py
+++ b/scapy/layers/all.py
@@ -13,7 +13,7 @@ from scapy.error import log_loading
 from scapy.main import load_layer
 import logging, importlib
 import scapy.modules.six as six
-ignored = list(six.moves.builtins.__dict__.keys()) + ["sys"]
+ignored = list(six.moves.builtins.__dict__) + ["sys"]
 log = logging.getLogger("scapy.loading")
 
 __all__ = []
diff --git a/scapy/layers/bluetooth.py b/scapy/layers/bluetooth.py
index cb845062ceaeedcf4991de46c4b35b10cf60c38a..234dbcc9ab1307bec37982943963b19aede0cfd8 100644
--- a/scapy/layers/bluetooth.py
+++ b/scapy/layers/bluetooth.py
@@ -71,8 +71,7 @@ class HCI_ACL_Hdr(Packet):
     def post_build(self, p, pay):
         p += pay
         if self.len is None:
-            l = len(p)-4
-            p = p[:2]+chr(l&0xff)+chr((l>>8)&0xff)+p[4:]
+            p = p[:2] + struct.pack("<H", len(pay)) + p[4:]
         return p
 
 
@@ -84,8 +83,7 @@ class L2CAP_Hdr(Packet):
     def post_build(self, p, pay):
         p += pay
         if self.len is None:
-            l = len(pay)
-            p = chr(l&0xff)+chr((l>>8)&0xff)+p[2:]
+            p = struct.pack("<H", len(pay)) + p[2:]
         return p
 
 
@@ -103,8 +101,7 @@ class L2CAP_CmdHdr(Packet):
     def post_build(self, p, pay):
         p += pay
         if self.len is None:
-            l = len(p)-4
-            p = p[:2]+chr(l&0xff)+chr((l>>8)&0xff)+p[4:]
+            p = p[:2] + struct.pack("<H", len(pay)) + p[4:]
         return p
     def answers(self, other):
         if other.id == self.id:
@@ -464,8 +461,7 @@ class HCI_Command_Hdr(Packet):
     def post_build(self, p, pay):
         p += pay
         if self.len is None:
-            l = len(p)-3
-            p = p[:2]+chr(l&0xff)+p[3:]
+            p = p[:2] + struct.pack("B", len(pay)) + p[3:]
         return p
 
 class HCI_Cmd_Reset(Packet):
diff --git a/scapy/layers/dhcp6.py b/scapy/layers/dhcp6.py
index e109c116ad9b060e76b74a8b872cf15d9967d1b5..bb6856cf712fc7d3db014380ec7c9eb87085db01 100644
--- a/scapy/layers/dhcp6.py
+++ b/scapy/layers/dhcp6.py
@@ -1315,7 +1315,7 @@ DHCPv6_am.parse_options( dns="2001:500::1035", domain="localdomain, local",
 
         if self.debug:
             print("\n[+] List of active DHCPv6 options:")
-            opts = sorted(self.dhcpv6_options.keys())
+            opts = sorted(self.dhcpv6_options)
             for i in opts:
                 print("    %d: %s" % (i, repr(self.dhcpv6_options[i])))
 
@@ -1343,7 +1343,7 @@ DHCPv6_am.parse_options( dns="2001:500::1035", domain="localdomain, local",
 
             # Mac Address
             rawmac = get_if_raw_hwaddr(iface)[1]
-            mac = ":".join("%.02x" % ord(x) for x in rawmac)
+            mac = ":".join("%.02x" % orb(x) for x in rawmac)
 
             self.duid = DUID_LLT(timeval = timeval, lladdr = mac)
             
@@ -1574,12 +1574,12 @@ DHCPv6_am.parse_options( dns="2001:500::1035", domain="localdomain, local",
                     reqopts = []
                     if p.haslayer(DHCP6OptOptReq): # add only asked ones
                         reqopts = p[DHCP6OptOptReq].reqopts
-                        for o in self.dhcpv6_options.keys():
+                        for o, opt in six.iteritems(self.dhcpv6_options):
                             if o in reqopts:
-                                resp /= self.dhcpv6_options[o]
+                                resp /= opt
                     else: # advertise everything we have available
-                        for o in self.dhcpv6_options.keys():
-                            resp /= self.dhcpv6_options[o]                    
+                        for o, opt in six.iteritems(self.dhcpv6_options):
+                            resp /= opt
 
             return resp
 
@@ -1595,15 +1595,15 @@ DHCPv6_am.parse_options( dns="2001:500::1035", domain="localdomain, local",
             reqopts = []
             if p.haslayer(DHCP6OptOptReq): # add only asked ones
                 reqopts = p[DHCP6OptOptReq].reqopts
-                for o in self.dhcpv6_options.keys():
+                for o, opt in six.iteritems(self.dhcpv6_options):
                     if o in reqopts:
-                        resp /= self.dhcpv6_options[o]
+                        resp /= opt
             else: 
                 # advertise everything we have available.
                 # Should not happen has clients MUST include 
                 # and ORO in requests (sec 18.1.1)   -- arno
-                for o in self.dhcpv6_options.keys():
-                    resp /= self.dhcpv6_options[o]          
+                for o, opt in six.iteritems(self.dhcpv6_options):
+                    resp /= opt
 
             return resp            
         
@@ -1693,8 +1693,8 @@ DHCPv6_am.parse_options( dns="2001:500::1035", domain="localdomain, local",
             reqopts = []
             if p.haslayer(DHCP6OptOptReq):
                 reqopts = p[DHCP6OptOptReq].reqopts
-            for o in self.dhcpv6_options.keys():
-                resp /= self.dhcpv6_options[o]
+            for o, opt in six.iteritems(self.dhcpv6_options):
+                resp /= opt
 
             return resp
 
diff --git a/scapy/layers/dns.py b/scapy/layers/dns.py
index 5780712295246c9eea6e00f9d6242df661e4eb9c..7630fb41533c7303fed792b76bfa536fc787e7a0 100644
--- a/scapy/layers/dns.py
+++ b/scapy/layers/dns.py
@@ -397,9 +397,9 @@ def bitmap2RRlist(bitmap):
             warning("bitmap too short (%i)" % len(bitmap))
             return
 
-        window_block = ord(bitmap[0]) # window number
-        offset = 256*window_block # offset of the Resource Record
-        bitmap_len = ord(bitmap[1]) # length of the bitmap in bytes
+        window_block = orb(bitmap[0]) # window number
+        offset = 256 * window_block # offset of the Resource Record
+        bitmap_len = orb(bitmap[1]) # length of the bitmap in bytes
 
         if bitmap_len <= 0 or bitmap_len > 32:
             warning("bitmap length is no valid (%i)" % bitmap_len)
@@ -411,7 +411,7 @@ def bitmap2RRlist(bitmap):
         for b in range(len(tmp_bitmap)):
             v = 128
             for i in range(8):
-                if ord(tmp_bitmap[b]) & v:
+                if orb(tmp_bitmap[b]) & v:
                     # each of the RR is encoded as a bit
                     RRlist += [ offset + b*8 + i ]
                 v = v >> 1
@@ -431,10 +431,8 @@ def RRlist2bitmap(lst):
 
     import math
 
-    bitmap = ""
-    lst = sorted(set(lst))
-
-    lst = [abs(x) for x in lst if x <= 65535]
+    bitmap = b""
+    lst = [abs(x) for x in sorted(set(lst)) if x <= 65535]
 
     # number of window blocks
     max_window_blocks = int(math.ceil(lst[-1] / 256.))
@@ -446,7 +444,7 @@ def RRlist2bitmap(lst):
         # First, filter out RR not encoded in the current window block
         # i.e. keep everything between 256*wb <= 256*(wb+1)
         rrlist = sorted(x for x in lst if 256 * wb <= x < 256 * (wb + 1))
-        if rrlist == []:
+        if not rrlist:
             continue
 
         # Compute the number of bytes used to store the bitmap
@@ -454,12 +452,11 @@ def RRlist2bitmap(lst):
             bytes_count = 1
         else:
             max = rrlist[-1] - 256*wb
-            bytes_count = int(math.ceil(max / 8)) + 1  # use at least 1 byte
+            bytes_count = int(math.ceil(max // 8)) + 1  # use at least 1 byte
         if bytes_count > 32: # Don't encode more than 256 bits / values
             bytes_count = 32
 
-        bitmap += struct.pack("B", wb)
-        bitmap += struct.pack("B", bytes_count)
+        bitmap += struct.pack("BB", wb, bytes_count)
 
         # Generate the bitmap
 	# The idea is to remove out of range Resource Records with these steps
diff --git a/scapy/layers/inet.py b/scapy/layers/inet.py
index 4154d86ae85cdf5226c24ffade66953d2a06e890..5ce30aa876b01c24f6b480a15dd7a1a87c537a22 100644
--- a/scapy/layers/inet.py
+++ b/scapy/layers/inet.py
@@ -1089,7 +1089,7 @@ class TracerouteResult(SndRcvList):
                 m = min(x for x, y in six.itervalues(k) if y)
             except ValueError:
                 continue
-            for l in k.keys():  # use .keys(): k is modified in the loop
+            for l in list(k):  # use list(): k is modified in the loop
                 if l > m:
                     del k[l]
         return trace
diff --git a/scapy/layers/inet6.py b/scapy/layers/inet6.py
index f7dad10c185b829c96a4950ede432e38e4843a6d..d626a4cd5e2e7b236ac976291148e667d7385a9e 100644
--- a/scapy/layers/inet6.py
+++ b/scapy/layers/inet6.py
@@ -3179,7 +3179,7 @@ class TracerouteResult6(TracerouteResult):
                 m = min(x for x, y in six.itervalues(k) if y)
             except ValueError:
                 continue
-            for l in k.keys():  # use .keys(): k is modified in the loop
+            for l in list(k):  # use list(): k is modified in the loop
                 if l > m:
                     del k[l]
 
diff --git a/scapy/layers/ipsec.py b/scapy/layers/ipsec.py
index 91cd98ecbb7a3df2ef5b1fdd46e52c5808008110..d6685b903036e229db636a18be8cad4e9210cb3f 100644
--- a/scapy/layers/ipsec.py
+++ b/scapy/layers/ipsec.py
@@ -46,6 +46,7 @@ import socket
 import struct
 
 from scapy.config import conf, crypto_validator
+from scapy.compat import orb, raw
 from scapy.data import IP_PROTOS
 from scapy.compat import *
 from scapy.error import log_loading
@@ -153,7 +154,7 @@ class _ESPPlain(Packet):
     ]
 
     def data_for_encryption(self):
-        return str(self.data) + self.padding + chr(self.padlen) + chr(self.nh)
+        return raw(self.data) + self.padding + struct.pack("BB", self.padlen, self.nh)
 
 #------------------------------------------------------------------------------
 if conf.crypto_valid:
@@ -179,7 +180,7 @@ def _lcm(a, b):
     if a == 0 or b == 0:
         return 0
     else:
-        return abs(a * b) / gcd(a, b)
+        return abs(a * b) // gcd(a, b)
 
 class CryptAlgo(object):
     """
@@ -316,7 +317,7 @@ class CryptAlgo(object):
         # Still according to the RFC, the default value for padding *MUST* be an
         # array of bytes starting from 1 to padlen
         # TODO: Handle padding function according to the encryption algo
-        esp.padding = ''.join(chr(b) for b in range(1, esp.padlen + 1))
+        esp.padding = struct.pack("B" * esp.padlen, *range(1, esp.padlen + 1))
 
         # If the following test fails, it means that this algo does not comply
         # with the RFC
@@ -390,8 +391,8 @@ class CryptAlgo(object):
                 raise IPSecIntegrityError(err)
 
         # extract padlen and nh
-        padlen = ord(data[-2])
-        nh = ord(data[-1])
+        padlen = orb(data[-2])
+        nh = orb(data[-1])
 
         # then use padlen to determine data and padding
         data = data[:len(data) - padlen - 2]
@@ -690,7 +691,7 @@ def zero_mutable_fields(pkt, sending=False):
     """
 
     if pkt.haslayer(AH):
-        pkt[AH].icv = chr(0) * len(pkt[AH].icv)
+        pkt[AH].icv = b"\x00" * len(pkt[AH].icv)
     else:
         raise TypeError('no AH layer found')
 
@@ -712,7 +713,7 @@ def zero_mutable_fields(pkt, sending=False):
             if opt.option in IMMUTABLE_IPV4_OPTIONS:
                 immutable_opts.append(opt)
             else:
-                immutable_opts.append(Raw(chr(0) * len(opt)))
+                immutable_opts.append(Raw(b"\x00" * len(opt)))
         pkt.options = immutable_opts
 
     else:
@@ -732,7 +733,7 @@ def zero_mutable_fields(pkt, sending=False):
                 for opt in next_hdr.options:
                     if opt.otype & 0x20:
                         # option data can change en-route and must be zeroed
-                        opt.optdata = chr(0) * opt.optlen
+                        opt.optdata = b"\x00" * opt.optlen
             elif isinstance(next_hdr, IPv6ExtHdrRouting) and sending:
                 # The sender must order the field so that it appears as it
                 # will at the receiver, prior to performing the ICV computation.
@@ -786,7 +787,7 @@ class SecurityAssociation(object):
         if crypt_algo:
             if crypt_algo not in CRYPT_ALGOS:
                 raise TypeError('unsupported encryption algo %r, try %r' %
-                                (crypt_algo, list(CRYPT_ALGOS.keys())))
+                                (crypt_algo, list(CRYPT_ALGOS)))
             self.crypt_algo = CRYPT_ALGOS[crypt_algo]
 
             if crypt_key:
@@ -804,7 +805,7 @@ class SecurityAssociation(object):
         if auth_algo:
             if auth_algo not in AUTH_ALGOS:
                 raise TypeError('unsupported integrity algo %r, try %r' %
-                                (auth_algo, list(AUTH_ALGOS.keys())))
+                                (auth_algo, list(AUTH_ALGOS)))
             self.auth_algo = AUTH_ALGOS[auth_algo]
             self.auth_key = auth_key
         else:
@@ -872,7 +873,7 @@ class SecurityAssociation(object):
         if ip_header.version == 4:
             ip_header.len = len(ip_header) + len(esp)
             del ip_header.chksum
-            ip_header = ip_header.__class__(str(ip_header))
+            ip_header = ip_header.__class__(raw(ip_header))
         else:
             ip_header.plen = len(ip_header.payload) + len(esp)
 
@@ -885,7 +886,7 @@ class SecurityAssociation(object):
     def _encrypt_ah(self, pkt, seq_num=None):
 
         ah = AH(spi=self.spi, seq=seq_num or self.seq_num,
-                icv=chr(0) * self.auth_algo.icv_size)
+                icv = b"\x00" * self.auth_algo.icv_size)
 
         if self.tunnel_header:
             tunnel = self.tunnel_header.copy()
@@ -898,7 +899,7 @@ class SecurityAssociation(object):
                 del tunnel.nh
                 del tunnel.plen
 
-            pkt = tunnel.__class__(str(tunnel / pkt))
+            pkt = tunnel.__class__(raw(tunnel / pkt))
 
         ip_header, nh, payload = split_for_transport(pkt, socket.IPPROTO_AH)
         ah.nh = nh
@@ -906,16 +907,16 @@ class SecurityAssociation(object):
         if ip_header.version == 6 and len(ah) % 8 != 0:
             # For IPv6, the total length of the header must be a multiple of
             # 8-octet units.
-            ah.padding = chr(0) * (-len(ah) % 8)
+            ah.padding = b"\x00" * (-len(ah) % 8)
         elif len(ah) % 4 != 0:
             # For IPv4, the total length of the header must be a multiple of
             # 4-octet units.
-            ah.padding = chr(0) * (-len(ah) % 4)
+            ah.padding = b"\x00" * (-len(ah) % 4)
 
         # RFC 4302 - Section 2.2. Payload Length
         # This 8-bit field specifies the length of AH in 32-bit words (4-byte
         # units), minus "2".
-        ah.payloadlen = len(ah) / 4 - 2
+        ah.payloadlen = len(ah) // 4 - 2
 
         if ip_header.version == 4:
             ip_header.len = len(ip_header) + len(ah) + len(payload)
diff --git a/scapy/main.py b/scapy/main.py
index d4b30c39e4520980f9fbceb2fe10d8260fa2fe56..48680b0293ea61a65e11aaadbfa95446075e196a 100644
--- a/scapy/main.py
+++ b/scapy/main.py
@@ -231,7 +231,7 @@ def save_session(fname=None, session=None, pickleProto=-1):
     if "__builtins__" in to_be_saved:
         del(to_be_saved["__builtins__"])
 
-    for k in list(to_be_saved.keys()):
+    for k in list(to_be_saved):
         i = to_be_saved[k]
         if hasattr(i, "__module__") and (k[0] == "_" or i.__module__.startswith("IPython")):
             del(to_be_saved[k])
diff --git a/scapy/packet.py b/scapy/packet.py
index 89184d1724565d819f243f21a0b67b8a89e2f585..eed3f64d42a3b394ef33fd5ccd880c1b2e2439d5 100644
--- a/scapy/packet.py
+++ b/scapy/packet.py
@@ -772,7 +772,7 @@ class Packet(six.with_metaclass(Packet_metaclass, BasePacket)):
 
     def hide_defaults(self):
         """Removes fields' values that are the same as default values."""
-        for k in list(self.fields.keys()):  # use .items(): self.fields is modified in the loop
+        for k, v in list(self.fields.items()):  # use list(): self.fields is modified in the loop
             v = self.fields[k]
             if k in self.default_fields:
                 if self.default_fields[k] == v:
@@ -907,7 +907,7 @@ values.
             ccls,fld = cls,None
         if cls is None or match(self.__class__, cls) or self.__class__.__name__ == ccls:
             if all(self.getfieldval(fldname) == fldvalue
-                   for fldname, fldvalue in flt.iteritems()):
+                   for fldname, fldvalue in six.iteritems(flt)):
                 if nb == 1:
                     if fld is None:
                         return self
diff --git a/test/bluetooth.uts b/test/bluetooth.uts
index 3ac5acad9852770ac17fd65ea7d51c2f827a7d44..253c26e5553d94918aaddb97ce0d3a5c6489c572 100644
--- a/test/bluetooth.uts
+++ b/test/bluetooth.uts
@@ -3,18 +3,18 @@
 + HCI Commands
 = LE Create Connection Cancel
 
-expected_cmd_raw_data = "010e2000".decode('hex')
-cmd_raw_data = str(HCI_Hdr() / HCI_Command_Hdr() / HCI_Cmd_LE_Create_Connection_Cancel())
+expected_cmd_raw_data = hex_bytes("010e2000")
+cmd_raw_data = raw(HCI_Hdr() / HCI_Command_Hdr() / HCI_Cmd_LE_Create_Connection_Cancel())
 assert(expected_cmd_raw_data == cmd_raw_data)
 
 = Disconnect
-expected_cmd_raw_data = "01060403341213".decode('hex')
-cmd_raw_data = str(HCI_Hdr() / HCI_Command_Hdr() / HCI_Cmd_Disconnect(handle=0x1234))
+expected_cmd_raw_data = hex_bytes("01060403341213")
+cmd_raw_data = raw(HCI_Hdr() / HCI_Command_Hdr() / HCI_Cmd_Disconnect(handle=0x1234))
 assert(expected_cmd_raw_data == cmd_raw_data)
 
 = LE Connection Update Command
-expected_cmd_raw_data = "0113200e47000a00140001003c000100ffff".decode('hex')
-cmd_raw_data = str(
+expected_cmd_raw_data = hex_bytes("0113200e47000a00140001003c000100ffff")
+cmd_raw_data = raw(
     HCI_Hdr() / HCI_Command_Hdr() / HCI_Cmd_LE_Connection_Update(
         handle=0x47, min_interval=10, max_interval=20, latency=1, timeout=60,
         min_ce=1, max_ce=0xffff))
@@ -23,7 +23,7 @@ assert(expected_cmd_raw_data == cmd_raw_data)
 
 + HCI Events
 = LE Connection Update Event
-evt_raw_data = "043e0a03004800140001003c00".decode('hex')
+evt_raw_data = hex_bytes("043e0a03004800140001003c00")
 evt_pkt =  HCI_Hdr(evt_raw_data)
 assert(evt_pkt[HCI_LE_Meta_Connection_Update_Complete].handle == 0x48)
 assert(evt_pkt[HCI_LE_Meta_Connection_Update_Complete].interval == 20)
@@ -35,20 +35,20 @@ assert(evt_pkt[HCI_LE_Meta_Connection_Update_Complete].timeout == 60)
 = Parse EIR_Flags, EIR_CompleteList16BitServiceUUIDs, EIR_CompleteLocalName and EIR_TX_Power_Level
 
 ad_report_raw_data = \
-    "043e2b020100016522c00181781f0201020303d9fe1409" \
-    "506562626c652054696d65204c452037314536020a0cde".decode('hex')
+    hex_bytes("043e2b020100016522c00181781f0201020303d9fe1409" \
+              "506562626c652054696d65204c452037314536020a0cde")
 scapy_packet = HCI_Hdr(ad_report_raw_data)
 
 assert(scapy_packet[EIR_Flags].flags == 0x02)
 assert(scapy_packet[EIR_CompleteList16BitServiceUUIDs].svc_uuids == [0xfed9])
-assert(scapy_packet[EIR_CompleteLocalName].local_name == 'Pebble Time LE 71E6')
+assert(scapy_packet[EIR_CompleteLocalName].local_name == b'Pebble Time LE 71E6')
 assert(scapy_packet[EIR_TX_Power_Level].level == 12)
 
 = Parse EIR_Manufacturer_Specific_Data
 
 scan_resp_raw_data = \
-    "043e2302010401be5e0eb9f04f1716ff5401005f423331" \
-    "3134374432343631fc00030c0000de".decode('hex')
+    hex_bytes("043e2302010401be5e0eb9f04f1716ff5401005f423331" \
+              "3134374432343631fc00030c0000de")
 scapy_packet = HCI_Hdr(scan_resp_raw_data)
 
 assert(scapy_packet[EIR_Manufacturer_Specific_Data].data == b'\x00_B31147D2461\xfc\x00\x03\x0c\x00\x00')
diff --git a/test/dnssecRR.uts b/test/dnssecRR.uts
index becb1905b1c61284b522145aad4e952312ea19af..4069fbeeaff0313f23bb4a14295847719346c22c 100644
--- a/test/dnssecRR.uts
+++ b/test/dnssecRR.uts
@@ -46,41 +46,41 @@ RRlist2bitmap(bitmap2RRlist(b)) == b
 
 = DNSRRNSEC(), basic instanciation
 t = DNSRRNSEC()
-str(t) == b'\x00\x00/\x00\x01\x00\x00\x00\x00\x00\x01\x00'
+raw(t) == b'\x00\x00/\x00\x01\x00\x00\x00\x00\x00\x01\x00'
 
 = DNSRRRNSEC(), check parameters
 t = DNSRRNSEC(rrname="scapy.secdev.org.", rclass=42, ttl=28, nextname="www.secdev.org.", typebitmaps=RRlist2bitmap([1,2,3,4,1234]))
-str(t) == b'\x05scapy\x06secdev\x03org\x00\x00/\x00*\x00\x00\x00\x1c\x000\x03www\x06secdev\x03org\x00\x00\x01x\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '
+raw(t) == b'\x05scapy\x06secdev\x03org\x00\x00/\x00*\x00\x00\x00\x1c\x000\x03www\x06secdev\x03org\x00\x00\x01x\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '
 
 + Test NSEC3 RR
 
 = DNSRRNSEC3(), basic instanciation
 t = DNSRRNSEC3()
-str(t) == b'\x00\x002\x00\x01\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00'
+raw(t) == b'\x00\x002\x00\x01\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00'
 
 = DNSRRRNSEC3(), check parameters
 t = DNSRRNSEC3(rrname="scapy.secdev.org.", rclass=42, ttl=28, hashalg=7, iterations=80, saltlength=28, salt=b"\x28\x07", hashlength=31, nexthashedownername="XXX.scapy.secdev.org", typebitmaps=RRlist2bitmap([1,2,3,4,1234]))
-str(t) == b'\x05scapy\x06secdev\x03org\x00\x002\x00*\x00\x00\x00\x1c\x00<\x07\x00\x00P\x1c(\x07\x1fXXX.scapy.secdev.org\x00\x01x\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '
+raw(t) == b'\x05scapy\x06secdev\x03org\x00\x002\x00*\x00\x00\x00\x1c\x00<\x07\x00\x00P\x1c(\x07\x1fXXX.scapy.secdev.org\x00\x01x\x04\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '
 
 + Test NSEC3PARAM RR
 
 = DNSRRNSEC3PARAM(), basic instanciation
 t = DNSRRNSEC3PARAM()
-str(t) == b'\x00\x003\x00\x01\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00'
+raw(t) == b'\x00\x003\x00\x01\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00'
 
 = DNSRRRNSEC3PARAM(), check parameters
 t = DNSRRNSEC3(rrname="scapy.secdev.org.", rclass=42, ttl=28, hashalg=7, flags=80, iterations=80, saltlength=28, salt=b"\x28\x07")
-str(t) == b'\x05scapy\x06secdev\x03org\x00\x002\x00*\x00\x00\x00\x1c\x00\x08\x07P\x00P\x1c(\x07\x00'
+raw(t) == b'\x05scapy\x06secdev\x03org\x00\x002\x00*\x00\x00\x00\x1c\x00\x08\x07P\x00P\x1c(\x07\x00'
 
 + Test RRSIG RR
 
 = DNSRRRSIG(), basic instanciation
 t = DNSRRRSIG()
-str(t) == b'\x00\x00.\x00\x01\x00\x00\x00\x00\x00\x13\x00\x01\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
+raw(t) == b'\x00\x00.\x00\x01\x00\x00\x00\x00\x00\x13\x00\x01\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 
 = DNSRRRSIG(), check parameters
 t = DNSRRRSIG(rrname="test.example.com.", type=46, rclass=12, ttl=64, originalttl=2807, keytag=42, signersname="test.rsig", signature="test RSIG")
-str(t) == b'\x04test\x07example\x03com\x00\x00.\x00\x0c\x00\x00\x00@\x00&\x00\x01\x05\x00\x00\x00\n\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x04test\x04rsig\x00test RSIG'
+raw(t) == b'\x04test\x07example\x03com\x00\x00.\x00\x0c\x00\x00\x00@\x00&\x00\x01\x05\x00\x00\x00\n\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x04test\x04rsig\x00test RSIG'
 
 = DNSRRRSIG(), dissection
 rrsig = b'\x03isc\x03org\x00\x00.\x00\x01\x00\x00\x96O\x00\x9b\x00\x02\x05\x02\x00\x00\xa8\xc0K-3\xd9K\x05\xa6\xd9\xed6\x03isc\x03org\x00\xac\xb2_I\x9e\xdcU\xca/3\x1c\xdf{\xba\xd5\x80\xb0 \xa4~\x98\x95\xab~\x84\xb2\x1f9\x17#\x7f\xfeP\xb9\xfb\x8d\x13\x19\xd7\x7f\x9e/\x1c\xd7rv<\xc6\xd3\xf1\xae8\rh\xba\x1e\xaa\xe6\xf1\x1e\x1d\xdaS\xd4\\\xfd\xa3`P\xa1\xe0\xa2\x860\xd4?\xb4}j\x81O\x03\xdc&v\x13\xd4(k\xa07\x8f-\x08e\x06\xff\xb8h\x8f\x16j\xe4\xd92\xd2\x99\xc2\xb4'
@@ -91,11 +91,11 @@ t.rrname == 'isc.org.' and t.labels == 2 and t.keytag == 60726 and t.signature[-
 
 = DNSRRDNSKEY(), basic instanciation
 t = DNSRRDNSKEY()
-str(t) == b'\x00\x000\x00\x01\x00\x00\x00\x00\x00\x04\x01\x00\x03\x05' and t.sprintf("%flags%") == 'Z'
+raw(t) == b'\x00\x000\x00\x01\x00\x00\x00\x00\x00\x04\x01\x00\x03\x05' and t.sprintf("%flags%") == 'Z'
 
 = DNSRRDNSKEY(), check parameters
 t = DNSRRDNSKEY(rrname="www.secdev.org.", type=42, rclass=12, ttl=1234, rdlen=567, flags=2807, protocol=195, algorithm=66, publickey="strong public key")
-str(t) == b'\x03www\x06secdev\x03org\x00\x00*\x00\x0c\x00\x00\x04\xd2\x027\n\xf7\xc3Bstrong public key'
+raw(t) == b'\x03www\x06secdev\x03org\x00\x00*\x00\x0c\x00\x00\x04\xd2\x027\n\xf7\xc3Bstrong public key'
 
 = DNSRRDNSKEY(), dissection
 t = DNSRRDNSKEY(b'\x03dlv\x03isc\x03org\x00\x000\x00\x01\x00\x00\x1bq\x01\t\x01\x01\x03\x05\x04@\x00\x00\x03\xc72\xef\xf9\xa2|\xeb\x10N\xf3\xd5\xe8&\x86\x0f\xd6<\xed>\x8e\xea\x19\xadm\xde\xb9a\'\xe0\xccC\x08M~\x94\xbc\xb6n\xb8P\xbf\x9a\xcd\xdfdJ\xb4\xcc\xd7\xe8\xc8\xfb\xd27sx\xd0\xf8^I\xd6\xe7\xc7g$\xd3\xc2\xc6\x7f>\x8c\x01\xa5\xd8VK+\xcb~\xd6\xea\xb8[\xe9\xe7\x03z\x8e\xdb\xe0\xcb\xfaN\x81\x0f\x89\x9e\xc0\xc2\xdb!\x81p{C\xc6\xeft\xde\xf5\xf6v\x90\x96\xf9\xe9\xd8`1\xd7\xb9\xcae\xf8\x04\x8f\xe8C\xe7\x00+\x9d?\xc6\xf2o\xd3Ak\x7f\xc90\xea\xe7\x0cO\x01e\x80\xf7\xbe\x8eq\xb1<\xf1&\x1c\x0b^\xfdDdc\xad\x99~B\xe8\x04\x00\x03,t="\xb4\xb6\xb6\xbc\x80{\xb9\x9b\x05\x95\\;\x02\x1eS\xf4p\xfedq\xfe\xfc00$\xe05\xba\x0c@\xabTv\xf3W\x0e\xb6\t\r!\xd9\xc2\xcd\xf1\x89\x15\xc5\xd5\x17\xfej_T\x99\x97\xd2j\xff\xf85b\xca\x8c|\xe9O\x9fd\xfdT\xadL3taK\x96\xac\x13a')
@@ -106,7 +106,7 @@ t.rrname == "dlv.isc.org." and t.rdlen == 265 and t.sprintf("%flags%") == 'SZ' a
 = DNSRRDS() and DNSRRDLV(), basic instancaition
 ds = DNSRRDS()
 dlv = DNSRRDLV(type=43)
-str(ds) == str(dlv)
+raw(ds) == raw(dlv)
 
 = DNSRRDS(), check parameters
 t = DNSRRDS(b'\x03isc\x03org\x00\x00+\x00\x01\x00\x01Q(\x00\x182\\\x05\x01\x98!\x13\xd0\x8bLj\x1d\x9fj\xee\x1e"7\xae\xf6\x9f?\x97Y')
@@ -119,17 +119,17 @@ t = DNSRR(type="TXT", rdata="test")
 
 = DNSRRR(), check parameters
 t = DNSRR(b'\x04test\x00\x00\x10\x00\x01\x00\x00\x00\x00\x018\xffScapy is an interactive packet manipulation program that enables you to sniff, mangle, send network packets ; test equipments ; probe and discover networks ; quickly develop new protocols. It can easily handle most classical tasks like scanning, tracerout7ing, probing, unit tests, attacks or network discovery.')
-t.type == 16 and t.rdlen == 312 and t.rdata[:5] == "Scapy" and t.rdata[-10:] == "discovery."
+t.type == 16 and t.rdlen == 312 and t.rdata[:5] == b"Scapy" and t.rdata[-10:] == b"discovery."
 
 + Test DNSRRTSIG RR
 
 = DNSRRTSIG basic instanciation
 t = DNSRRTSIG()
-str(t) == b"\x00\x00\xfa\x00\x01\x00\x00\x00\x00\x00\x1b\thmac-sha1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00"
+raw(t) == b"\x00\x00\xfa\x00\x01\x00\x00\x00\x00\x00\x1b\thmac-sha1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00"
 
 = DNSRRTSIG(), check parameters
 t = DNSRRTSIG(rrname="SAMPLE-ALG.EXAMPLE.", time_signed=853804800, fudge=300)
-str(t) == b"\nSAMPLE-ALG\x07EXAMPLE\x00\x00\xfa\x00\x01\x00\x00\x00\x00\x00\x1b\thmac-sha1\x00\x00\x002\xe4\x07\x00\x01,\x00\x14\x00\x00\x00\x00\x00\x00"
+raw(t) == b"\nSAMPLE-ALG\x07EXAMPLE\x00\x00\xfa\x00\x01\x00\x00\x00\x00\x00\x1b\thmac-sha1\x00\x00\x002\xe4\x07\x00\x01,\x00\x14\x00\x00\x00\x00\x00\x00"
 
 = TimeField methods
 
diff --git a/test/edns0.uts b/test/edns0.uts
index 927ccd6e59c931acb007cfb0985b3ca404c19d47..1490418a2de5aa024192eb63f5d4623c0934b05e 100644
--- a/test/edns0.uts
+++ b/test/edns0.uts
@@ -7,15 +7,15 @@
 
 = EDNS0TLV(), basic instanciation
 tlv = EDNS0TLV()
-str(tlv) == b'\x00\x00\x00\x00'
+raw(tlv) == b'\x00\x00\x00\x00'
 
 = EDNS0TLV(), check parameters
 tlv = EDNS0TLV(optcode=42, optlen=12, optdata="edns0tlv")
-str(tlv) == b'\x00*\x00\x0cedns0tlv'
+raw(tlv) == b'\x00*\x00\x0cedns0tlv'
 
 = EDNS0TLV(), check computed optlen
 tlv = EDNS0TLV(optdata="edns0tlv")
-str(tlv) == b'\x00\x00\x00\x08edns0tlv'
+raw(tlv) == b'\x00\x00\x00\x08edns0tlv'
 
 = EDNS0TLV(), dissection
 tlv = EDNS0TLV(b'\x00*\x00\x08edns0tlv')
@@ -25,15 +25,15 @@ tlv.optcode == 42 and tlv.optlen == 8 and tlv.optdata == "edns0tlv"
 
 = DNSRROPT(), basic instanciation
 opt = DNSRROPT()
-str(opt) == b'\x00\x00)\x10\x00\x00\x00\x80\x00\x00\x00'
+raw(opt) == b'\x00\x00)\x10\x00\x00\x00\x80\x00\x00\x00'
 
 = DNSRROPT(), check parameters
 opt = DNSRROPT(rrname="rropt", type=42, rclass=123, extrcode=1, version=2, z=3, rdlen=4, rdata=[EDNS0TLV()])
-str(opt) == b'\x05rropt\x00\x00*\x00{\x01\x02\x00\x03\x00\x04\x00\x00\x00\x00'
+raw(opt) == b'\x05rropt\x00\x00*\x00{\x01\x02\x00\x03\x00\x04\x00\x00\x00\x00'
 
 = DNSRROPT() & EDN0TLV(), check parameters
 opt = DNSRROPT(rrname="rropt", type=42, rclass=123, extrcode=1, version=2, z=3, rdlen=4, rdata=[EDNS0TLV(optcode=42, optlen=12, optdata="edns0tlv")])
-str(opt) == b'\x05rropt\x00\x00*\x00{\x01\x02\x00\x03\x00\x04\x00*\x00\x0cedns0tlv'
+raw(opt) == b'\x05rropt\x00\x00*\x00{\x01\x02\x00\x03\x00\x04\x00*\x00\x0cedns0tlv'
 
 = DNSRROP(), dissection
 opt = DNSRROPT(b'\x05rropt\x00\x00*\x00{\x01\x02\x00\x03\x00\x0c\x00*\x00\x0cedns0tlv')
@@ -43,7 +43,7 @@ opt.rrname == "rropt." and opt.rdlen == 12 and opt.rdata[0].optcode == 42 and op
 
 = EDNS-PING - basic instanciation
 tlv = EDNS0TLV(optcode=5, optdata=b"\x00\x11\x22\x33")
-str(tlv) == b'\x00\x05\x00\x04\x00\x11"3'
+raw(tlv) == b'\x00\x05\x00\x04\x00\x11"3'
 
 #= EDNS-PING - Live test
 #~ netaccess
@@ -58,7 +58,7 @@ str(tlv) == b'\x00\x05\x00\x04\x00\x11"3'
 
 = NSID- basic instanciation
 tlv = EDNS0TLV(optcode=2, optdata="")
-str(tlv) == b'\x00\x02\x00\x00'
+raw(tlv) == b'\x00\x02\x00\x00'
 
 = NSID - Live test
 ~ netaccess
diff --git a/test/fields.uts b/test/fields.uts
index 80bc459512001874282f13826d4690a1fdf4a6c5..bcc4cbb266c3c814d5dc830d919f666f274d2354 100644
--- a/test/fields.uts
+++ b/test/fields.uts
@@ -25,8 +25,8 @@ m = MACField("foo", None)
 m.i2m(None, None)
 assert( _ == b"\x00\x00\x00\x00\x00\x00" )
 m.getfield(None, b"\xc0\x01\xbe\xef\xba\xbeABCD")
-assert( _ == ("ABCD","c0:01:be:ef:ba:be") )
-m.addfield(None, "FOO", "c0:01:be:ef:ba:be")
+assert( _ == (b"ABCD","c0:01:be:ef:ba:be") )
+m.addfield(None, b"FOO", "c0:01:be:ef:ba:be")
 assert( _ == b"FOO\xc0\x01\xbe\xef\xba\xbe" )
 
 = SourceMACField, ARPSourceMACField
@@ -45,8 +45,8 @@ assert( _ == b"\xff\xff\xff\xff" )
 i.m2i(None, b"\x01\x02\x03\x04")
 assert( _ == "1.2.3.4" )
 i.getfield(None, b"\x01\x02\x03\x04ABCD")
-assert( _ == ("ABCD","1.2.3.4") )
-i.addfield(None, "FOO", "1.2.3.4")
+assert( _ == (b"ABCD","1.2.3.4") )
+i.addfield(None, b"FOO", "1.2.3.4")
 assert( _ == b"FOO\x01\x02\x03\x04" )
 
 = SourceIPField
@@ -55,12 +55,12 @@ defaddr = conf.route.route('0.0.0.0')[1]
 class Test(Packet): fields_desc = [SourceIPField("sourceip", None)]
 
 assert Test().sourceip == defaddr
-assert Test(str(Test())).sourceip == defaddr
+assert Test(raw(Test())).sourceip == defaddr
 
 assert IP(dst="0.0.0.0").src == defaddr
-assert IP(str(IP(dst="0.0.0.0"))).src == defaddr
+assert IP(raw(IP(dst="0.0.0.0"))).src == defaddr
 assert IP(dst="0.0.0.0/31").src == defaddr
-assert IP(str(IP(dst="0.0.0.0/31"))).src == defaddr
+assert IP(raw(IP(dst="0.0.0.0/31"))).src == defaddr
 
 
 #= ByteField
@@ -77,6 +77,8 @@ assert IP(str(IP(dst="0.0.0.0/31"))).src == defaddr
 = Creation of a layer with ActionField
 ~ field actionfield
 
+from __future__ import print_function
+
 class TestAction(Packet):
     __slots__ = ["_val", "_fld", "_priv1", "_priv2"]
     name = "TestAction"
@@ -85,7 +87,7 @@ class TestAction(Packet):
         self._val, self._fld, self._priv1, self._priv2 = None, None, None, None
         super(TestAction, self).__init__(*args, **kargs)
     def my_action(self, val, fld, priv1, priv2):
-        print "Action (%i)!" %val
+        print("Action (%i)!" % val)
         self._val, self._fld, self._priv1, self._priv2 = val, fld, priv1, priv2
 
 = Triggering action
@@ -112,20 +114,20 @@ class TestFLenF(Packet):
 = Assembly of an empty packet
 ~ field
 TestFLenF()
-str(_)
+raw(_)
 _ == b"\x08default"
 
 = Assembly of non empty packet
 ~ field
 TestFLenF(str="123")
-str(_)
+raw(_)
 _ == b"\x04123"
 
 = Disassembly
 ~ field
 TestFLenF(b"\x04ABCDEFGHIJKL")
 _
-_.len == 4 and _.str == "ABC" and Raw in _
+_.len == 4 and _.str == b"ABC" and Raw in _
 
 
 = BitFieldLenField test
@@ -136,18 +138,18 @@ class TestBFLenF(Packet):
                     StrLenField("str", "default", length_from=lambda pkt:pkt.len-1, ) ]
 
 a=TestBFLenF()
-str(a)
+raw(a)
 assert( _ == b"\x8f\xffdefault" )
 
 a.str=""
-str(a)
+raw(a)
 assert( _ == b"\x1f\xff" )
 
 TestBFLenF(b"\x1f\xff@@")
-assert( _.len == 1 and _.str == "" and Raw in _ and _[Raw].load == "@@" )
+assert( _.len == 1 and _.str == b"" and Raw in _ and _[Raw].load == b"@@" )
 
 TestBFLenF(b"\x6f\xffabcdeFGH")
-assert( _.len == 6 and _.str == "abcde" and Raw in _ and _[Raw].load == "FGH" )
+assert( _.len == 6 and _.str == b"abcde" and Raw in _ and _[Raw].load == b"FGH" )
 
 
 
@@ -166,14 +168,14 @@ class TestFLF(Packet):
 = Assembly of an empty packet
 ~ field
 a = TestFLF()
-str(a)
+raw(a)
 
 = Assembly of a non-empty packet
 ~ field
 a = TestFLF()
 a.lst = [7,65539]
 ls(a)
-str(a)
+raw(a)
 import struct
 _ == struct.pack("!BII", 2,7,65539)
 
@@ -188,17 +190,17 @@ assert(_.len == 3 and _.lst == [1234,2345,12345678])
 = Manipulate
 ~ field
 a = TestFLF(lst=[4])
-str(a)
+raw(a)
 assert(_ == b"\x01\x00\x00\x00\x04")
 a.lst.append(1234)
-TestFLF(str(a))
+TestFLF(raw(a))
 a.show2()
 a.len=7
-str(a)
+raw(a)
 assert(_ == b"\x07\x00\x00\x00\x04\x00\x00\x04\xd2")
 a.len=2
 a.lst=[1,2,3,4,5]
-TestFLF(str(a))
+TestFLF(raw(a))
 assert(Raw in _ and _[Raw].load == b'\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x05') 
 
 
@@ -216,20 +218,20 @@ class TestPLF(Packet):
 = Test the PacketListField assembly
 ~ field lengthfield
 x=TestPLF()
-str(x)
+raw(x)
 _ == b"\x00\x00"
 
 = Test the PacketListField assembly 2
 ~ field lengthfield
 x=TestPLF()
 x.plist=[IP()/TCP(), IP()/UDP()]
-str(x)
+raw(x)
 _.startswith(b'\x00\x02E')
 
 = Test disassembly
 ~ field lengthfield
 x=TestPLF(plist=[IP()/TCP(seq=1234567), IP()/UDP()])
-TestPLF(str(x))
+TestPLF(raw(x))
 _.show()
 IP in _ and TCP in _ and UDP in _ and _[TCP].seq == 1234567
 
@@ -254,20 +256,20 @@ class TestPLF(Packet):
 = Test the PacketListField assembly
 ~ field lengthfield
 x=TestPLF()
-str(x)
+raw(x)
 _ == b"\x00\x00"
 
 = Test the PacketListField assembly 2
 ~ field lengthfield
 x=TestPLF()
 x.plist=[IP()/TCP(), IP()/UDP()]
-str(x)
+raw(x)
 _.startswith(b'\x00\x02E')
 
 = Test disassembly
 ~ field lengthfield
 x=TestPLF(plist=[IP()/TCP(seq=1234567), IP()/UDP()])
-TestPLF(str(x))
+TestPLF(raw(x))
 _.show()
 IP in _ and TCP in _ and UDP in _ and _[TCP].seq == 1234567
 
@@ -287,37 +289,40 @@ class TestPkt(Packet):
         return "", p
 
 class TestPLF2(Packet):
-    fields_desc = [ FieldLenField("len1", None, count_of="plist",fmt="H", adjust=lambda pkt,x:x+2),
-                    FieldLenField("len2", None, length_of="plist",fmt="I", adjust=lambda pkt,x:(x+1)/2),
-                    PacketListField("plist", None, TestPkt, length_from=lambda x:(x.len2*2)/3*3) ]
+    fields_desc = [ FieldLenField("len1", None, count_of="plist", fmt="H",
+                                  adjust=lambda pkt, x: x + 2),
+                    FieldLenField("len2", None, length_of="plist", fmt="I",
+                                  adjust=lambda pkt, x: (x + 1) // 2),
+                    PacketListField("plist", None, TestPkt,
+                                    length_from=lambda x: (x.len2 * 2) // 3 * 3) ]
 
 a=TestPLF2()
-str(a)
+raw(a)
 assert( _ == b"\x00\x02\x00\x00\x00\x00" )
 
 a.plist=[TestPkt(),TestPkt(f1=100)] 
-str(a)
+raw(a)
 assert(_ == b'\x00\x04\x00\x00\x00\x03ABDdBD')
 
 a /= "123456"
-b = TestPLF2(str(a))
+b = TestPLF2(raw(a))
 b.show()
 assert(b.len1 == 4 and b.len2 == 3)
 assert(b[TestPkt].f1 == 65 and b[TestPkt].f2 == 0x4244)
 assert(b[TestPkt:2].f1 == 100)
-assert(Raw in b and b[Raw].load == "123456")
+assert(Raw in b and b[Raw].load == b"123456")
 
 a.plist.append(TestPkt(f1=200))
-b = TestPLF2(str(a))
+b = TestPLF2(raw(a))
 b.show()
 assert(b.len1 == 5 and b.len2 == 5)
 assert(b[TestPkt].f1 == 65 and b[TestPkt].f2 == 0x4244)
 assert(b[TestPkt:2].f1 == 100)
 assert(b[TestPkt:3].f1 == 200)
 assert(b.getlayer(TestPkt,4) is None)
-assert(Raw in b and b[Raw].load == "123456")
+assert(Raw in b and b[Raw].load == b"123456")
 hexdiff(a,b)
-assert( str(a) == str(b) )
+assert( raw(a) == raw(b) )
 
 ############
 ############
@@ -342,20 +347,20 @@ class TestPLF(Packet):
 = Test the PacketListField assembly
 ~ field lengthfield
 x=TestPLF()
-str(x)
-_ == "\x00\x00"
+raw(x)
+_ == b"\x00\x00"
 
 = Test the PacketListField assembly 2
 ~ field lengthfield
 x=TestPLF()
 x.plist=[IP()/TCP(), IP()/UDP()]
-str(x)
-_.startswith('\x00\x02E')
+raw(x)
+_.startswith(b'\x00\x02E')
 
 = Test disassembly
 ~ field lengthfield
 x=TestPLF(plist=[IP()/TCP(seq=1234567), IP()/UDP()])
-TestPLF(str(x))
+TestPLF(raw(x))
 _.show()
 IP in _ and TCP in _ and UDP in _ and _[TCP].seq == 1234567
 
@@ -375,37 +380,40 @@ class TestPkt(Packet):
         return "", p
 
 class TestPLF2(Packet):
-    fields_desc = [ FieldLenField("len1", None, count_of="plist",fmt="H", adjust=lambda pkt,x:x+2),
-                    FieldLenField("len2", None, length_of="plist",fmt="I", adjust=lambda pkt,x:(x+1)/2),
-                    PacketListField("plist", None, TestPkt, length_from=lambda x:(x.len2*2)/3*3) ]
+    fields_desc = [ FieldLenField("len1", None, count_of="plist",fmt="H",
+                                  adjust=lambda pkt,x: x + 2),
+                    FieldLenField("len2", None, length_of="plist", fmt="I",
+                                  adjust=lambda pkt, x: (x + 1) // 2),
+                    PacketListField("plist", None, TestPkt,
+                                    length_from=lambda x: (x.len2 * 2) // 3 *3) ]
 
 a=TestPLF2()
-str(a)
-assert( _ == "\x00\x02\x00\x00\x00\x00" )
+raw(a)
+assert( _ == b"\x00\x02\x00\x00\x00\x00" )
 
 a.plist=[TestPkt(),TestPkt(f1=100)] 
-str(a)
-assert(_ == '\x00\x04\x00\x00\x00\x03ABDdBD')
+raw(a)
+assert(_ == b'\x00\x04\x00\x00\x00\x03ABDdBD')
 
 a /= "123456"
-b = TestPLF2(str(a))
+b = TestPLF2(raw(a))
 b.show()
 assert(b.len1 == 4 and b.len2 == 3)
 assert(b[TestPkt].f1 == 65 and b[TestPkt].f2 == 0x4244)
 assert(b[TestPkt:2].f1 == 100)
-assert(Raw in b and b[Raw].load == "123456")
+assert(Raw in b and b[Raw].load == b"123456")
 
 a.plist.append(TestPkt(f1=200))
-b = TestPLF2(str(a))
+b = TestPLF2(raw(a))
 b.show()
 assert(b.len1 == 5 and b.len2 == 5)
 assert(b[TestPkt].f1 == 65 and b[TestPkt].f2 == 0x4244)
 assert(b[TestPkt:2].f1 == 100)
 assert(b[TestPkt:3].f1 == 200)
 assert(b.getlayer(TestPkt,4) is None)
-assert(Raw in b and b[Raw].load == "123456")
+assert(Raw in b and b[Raw].load == b"123456")
 hexdiff(a,b)
-assert( str(a) == str(b) )
+assert( raw(a) == raw(b) )
 
 = Create layers for heterogeneous PacketListField
 ~ field lengthfield
@@ -443,7 +451,7 @@ class TestPLFH3(Packet):
 = Test heterogeneous PacketListField
 ~ field lengthfield
 
-p = TestPLFH3('\x02\x01\x01\xc1\x02\x80\x04toto')
+p = TestPLFH3(b'\x02\x01\x01\xc1\x02\x80\x04toto')
 assert(isinstance(p.data[0], TestPLFH1))
 assert(p.data[0].data == 0x2)
 assert(isinstance(p.data[1], TestPLFH2))
@@ -455,9 +463,9 @@ assert(p.data[3].data == 0x2)
 assert(isinstance(p.data[4], TestPLFH2))
 assert(p.data[4].data == 0x8004)
 assert(isinstance(p.payload, conf.raw_layer))
-assert(p.payload.load == 'toto')
+assert(p.payload.load == b'toto')
 
-p = TestPLFH3('\x02\x01\x01\xc1\x02\x80\x02to')
+p = TestPLFH3(b'\x02\x01\x01\xc1\x02\x80\x02to')
 assert(isinstance(p.data[0], TestPLFH1))
 assert(p.data[0].data == 0x2)
 assert(isinstance(p.data[1], TestPLFH2))
@@ -469,7 +477,7 @@ assert(p.data[3].data == 0x2)
 assert(isinstance(p.data[4], TestPLFH2))
 assert(p.data[4].data == 0x8002)
 assert(isinstance(p.payload, conf.raw_layer))
-assert(p.payload.load == 'to')
+assert(p.payload.load == b'to')
 
 = Create layers for heterogeneous PacketListField with memory
 ~ field lengthfield
@@ -505,7 +513,7 @@ class TestPLFH6(Packet):
 = Test heterogeneous PacketListField with memory
 ~ field lengthfield
 
-p = TestPLFH6('\x01\x02\x03\xc1\x02toto')
+p = TestPLFH6(b'\x01\x02\x03\xc1\x02toto')
 assert(isinstance(p.data[0], TestPLFH4))
 assert(p.data[0].data == 0x1)
 assert(isinstance(p.data[1], TestPLFH4))
@@ -515,7 +523,7 @@ assert(p.data[2].data == 0x3)
 assert(isinstance(p.data[3], TestPLFH5))
 assert(p.data[3].data == 0xc102)
 assert(isinstance(p.payload, conf.raw_layer))
-assert(p.payload.load == 'toto')
+assert(p.payload.load == b'toto')
 
 
 ############
@@ -613,16 +621,16 @@ f = MultiFlagsField('flags', set(), 3, {
 
 mp = MockPacket(0)
 x = f.i2m(mp, set())
-assert(isinstance(x, (int, long)))
+assert(isinstance(x, six.integer_types))
 assert(x == 0)
 x = f.i2m(mp, {'A'})
-assert(isinstance(x, (int, long)))
+assert(isinstance(x, six.integer_types))
 assert(x == 1)
 x = f.i2m(mp, {'A', 'B'})
-assert(isinstance(x, (int, long)))
+assert(isinstance(x, six.integer_types))
 assert(x == 3)
 x = f.i2m(mp, {'A', 'B', 'bit 2'})
-assert(isinstance(x, (int, long)))
+assert(isinstance(x, six.integer_types))
 assert(x == 7)
 try:
     x = f.i2m(mp, {'+'})
@@ -975,7 +983,7 @@ True
 = Raise exception - test data
 
 dnsf = DNSStrField("test", "")
-assert(dnsf.getfield("", b"\x01\x02\x00") == ("", b"\x02."))
+assert(dnsf.getfield("", b"\x01x\x00") == (b"", "x."))
 
 try:
     dnsf.getfield("", b"\xff")
diff --git a/test/ipsec.uts b/test/ipsec.uts
index d30ce4a354e0380ae081b44f52e018895c04159c..39e758ee2015b168892e77ede58b8cdb9c2611d1 100644
--- a/test/ipsec.uts
+++ b/test/ipsec.uts
@@ -16,7 +16,7 @@ import socket
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
@@ -33,7 +33,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -47,11 +47,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='DES', crypt_key='8bytekey',
+                         crypt_algo='DES', crypt_key=b'8bytekey',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -66,7 +66,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -79,12 +79,12 @@ assert(d[TCP] == p[TCP])
 #    mode tunnel enc 'cbc(des)' '0x38627974656b6579' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x0f\x6d\x2f\x3d\x1e\xc1\x0b\xc2\xb6\x8f\xfd\x67\x39\xc0\x96\x2c'
-               '\x17\x79\x88\xf6\xbc\x4d\xf7\x45\xd8\x36\x63\x86\xcd\x08\x7c\x08'
-               '\x2b\xf8\xa2\x91\x18\x21\x88\xd9\x26\x00\xc5\x21\x24\xbf\x8f\xf5'
-               '\x6c\x47\xb0\x3a\x8e\xdb\x75\x21\xd9\x33\x85\x5a\x15\xc6\x31\x00'
-               '\x1c\xef\x3e\x12\xce\x70\xec\x8f\x48\xc7\x81\x9b\x66\xcb\xf5\x39'
-               '\x91\xb3\x8e\x72\xfb\x7f\x64\x65\x6c\xf4\xa9\xf2\x5e\x63\x2f\x60',
+          data=b'\x0f\x6d\x2f\x3d\x1e\xc1\x0b\xc2\xb6\x8f\xfd\x67\x39\xc0\x96\x2c'
+               b'\x17\x79\x88\xf6\xbc\x4d\xf7\x45\xd8\x36\x63\x86\xcd\x08\x7c\x08'
+               b'\x2b\xf8\xa2\x91\x18\x21\x88\xd9\x26\x00\xc5\x21\x24\xbf\x8f\xf5'
+               b'\x6c\x47\xb0\x3a\x8e\xdb\x75\x21\xd9\x33\x85\x5a\x15\xc6\x31\x00'
+               b'\x1c\xef\x3e\x12\xce\x70\xec\x8f\x48\xc7\x81\x9b\x66\xcb\xf5\x39'
+               b'\x91\xb3\x8e\x72\xfb\x7f\x64\x65\x6c\xf4\xa9\xf2\x5e\x63\x2f\x60',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -99,11 +99,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='3DES', crypt_key='threedifferent8byteskeys',
+                         crypt_algo='3DES', crypt_key=b'threedifferent8byteskeys',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -118,7 +118,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -131,12 +131,12 @@ assert(d[TCP] == p[TCP])
 #   mode tunnel enc 'cbc(des3_ede)' '0x7468726565646966666572656e743862797465736b657973' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x36\x5c\x9b\x41\x37\xc8\x59\x1e\x39\x63\xe8\x6b\xf7\x0d\x97\x54'
-               '\x13\x84\xf6\x81\x66\x19\xe7\xcb\x75\x94\xf1\x0b\x8e\xa3\xf1\xa0'
-               '\x3e\x88\x51\xc4\x50\xd0\xa9\x1f\x16\x25\xc6\xbd\xe9\x0b\xdc\xae'
-               '\xf8\x13\x00\xa3\x8c\x53\xee\x1c\x96\xc0\xfe\x99\x70\xab\x94\x77'
-               '\xd7\xc4\xe8\xfd\x9f\x96\x28\xb8\x95\x20\x86\x7b\x19\xbc\x8f\xf5'
-               '\x96\xb0\x7e\xcc\x04\x83\xae\x4d\xa3\xba\x1d\x44\xf0\xba\x2e\xcd',
+          data=b'\x36\x5c\x9b\x41\x37\xc8\x59\x1e\x39\x63\xe8\x6b\xf7\x0d\x97\x54'
+               b'\x13\x84\xf6\x81\x66\x19\xe7\xcb\x75\x94\xf1\x0b\x8e\xa3\xf1\xa0'
+               b'\x3e\x88\x51\xc4\x50\xd0\xa9\x1f\x16\x25\xc6\xbd\xe9\x0b\xdc\xae'
+               b'\xf8\x13\x00\xa3\x8c\x53\xee\x1c\x96\xc0\xfe\x99\x70\xab\x94\x77'
+               b'\xd7\xc4\xe8\xfd\x9f\x96\x28\xb8\x95\x20\x86\x7b\x19\xbc\x8f\xf5'
+               b'\x96\xb0\x7e\xcc\x04\x83\xae\x4d\xa3\xba\x1d\x44\xf0\xba\x2e\xcd',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -151,11 +151,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -169,7 +169,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -182,13 +182,13 @@ assert(d[TCP] == p[TCP])
 #   mode tunnel enc 'cbc(aes)' '0x7369787465656e6279746573206b6579' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x08\x2f\x94\xe6\x53\xd8\x8e\x13\x70\xe8\xff\x61\x52\x90\x27\x3c'
-               '\xf2\xb4\x1f\x75\xd2\xa0\xac\xae\x1c\xa8\x5e\x1c\x78\x21\x4c\x7f'
-               '\xc3\x30\x17\x6a\x8d\xf3\xb1\xa7\xd1\xa8\x42\x01\xd6\x8d\x2d\x7e'
-               '\x5d\x06\xdf\xaa\x05\x27\x42\xb1\x00\x12\xcf\xff\x64\x02\x5a\x40'
-               '\xcd\xca\x1b\x91\xba\xf8\xc8\x59\xe7\xbd\x4d\x19\xb4\x8d\x39\x25'
-               '\x6c\x73\xf1\x2d\xaa\xee\xe1\x0b\x71\xcd\xfc\x11\x1d\x56\xce\x60'
-               '\xed\xd2\x32\x87\xd4\x90\xc3\xf5\x31\x47\x97\x69\x83\x82\x6d\x38',
+          data=b'\x08\x2f\x94\xe6\x53\xd8\x8e\x13\x70\xe8\xff\x61\x52\x90\x27\x3c'
+               b'\xf2\xb4\x1f\x75\xd2\xa0\xac\xae\x1c\xa8\x5e\x1c\x78\x21\x4c\x7f'
+               b'\xc3\x30\x17\x6a\x8d\xf3\xb1\xa7\xd1\xa8\x42\x01\xd6\x8d\x2d\x7e'
+               b'\x5d\x06\xdf\xaa\x05\x27\x42\xb1\x00\x12\xcf\xff\x64\x02\x5a\x40'
+               b'\xcd\xca\x1b\x91\xba\xf8\xc8\x59\xe7\xbd\x4d\x19\xb4\x8d\x39\x25'
+               b'\x6c\x73\xf1\x2d\xaa\xee\xe1\x0b\x71\xcd\xfc\x11\x1d\x56\xce\x60'
+               b'\xed\xd2\x32\x87\xd4\x90\xc3\xf5\x31\x47\x97\x69\x83\x82\x6d\x38',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -203,11 +203,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CTR', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-CTR', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -221,7 +221,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -234,12 +234,12 @@ assert(d[TCP] == p[TCP])
 #    mode tunnel enc 'rfc3686(ctr(aes))' '0x3136627974656b65792b34627974656e6f6e6365' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\xc4\xca\x09\x0f\x8b\xd3\x05\x3d\xac\x5a\x2f\x87\xca\x71\x10\x01'
-               '\xa7\x95\xc9\x07\xcc\xd4\x05\x58\x65\x23\x22\x4b\x63\x9b\x1f\xef'
-               '\x55\xb9\x1a\x91\x52\x76\x00\xf7\x94\x7b\x1d\xe1\x8e\x03\x2e\x85'
-               '\xad\xdd\x83\x22\x8a\xc3\x88\x6e\x85\xf5\x9b\xed\xa9\x6e\xb1\xc3'
-               '\x78\x00\x2f\xcd\x77\xe8\x3e\xec\x0e\x77\x94\xb2\x9b\x0f\x64\x5e'
-               '\x09\x83\x03\x7d\x83\x22\x39\xbb\x94\x66\xae\x9f\xbf\x01\xda\xfb',
+          data=b'\xc4\xca\x09\x0f\x8b\xd3\x05\x3d\xac\x5a\x2f\x87\xca\x71\x10\x01'
+               b'\xa7\x95\xc9\x07\xcc\xd4\x05\x58\x65\x23\x22\x4b\x63\x9b\x1f\xef'
+               b'\x55\xb9\x1a\x91\x52\x76\x00\xf7\x94\x7b\x1d\xe1\x8e\x03\x2e\x85'
+               b'\xad\xdd\x83\x22\x8a\xc3\x88\x6e\x85\xf5\x9b\xed\xa9\x6e\xb1\xc3'
+               b'\x78\x00\x2f\xcd\x77\xe8\x3e\xec\x0e\x77\x94\xb2\x9b\x0f\x64\x5e'
+               b'\x09\x83\x03\x7d\x83\x22\x39\xbb\x94\x66\xae\x9f\xbf\x01\xda\xfb',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -254,11 +254,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='Blowfish', crypt_key='sixteenbytes key',
+                         crypt_algo='Blowfish', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -272,7 +272,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -285,12 +285,12 @@ assert(d[TCP] == p[TCP])
 #    mode tunnel enc 'cbc(blowfish)' '0x7369787465656e6279746573206b6579' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x93\x9f\x5a\x10\x55\x57\x30\xa0\xb4\x00\x72\x1e\x46\x42\x46\x20'
-               '\xbc\x01\xef\xc3\x79\xcc\x3e\x55\x64\xba\x09\xc2\x6a\x5a\x5c\xb3'
-               '\xcc\xb5\xd5\x87\x82\xb0\x0a\x94\x58\xfc\x50\x37\x40\xe1\x03\xd3'
-               '\x4a\x09\xb2\x23\x53\x56\xa4\x45\x4c\xbb\x81\x1c\xdb\x31\xa7\x67'
-               '\xbd\x38\x8e\xba\x55\xd9\x1f\xf1\x3c\xeb\x07\x4c\x02\xb0\x3e\xc5'
-               '\xf6\x60\xdd\x68\xe1\xd4\xec\xee\x27\xc0\x6d\x1a\x80\xe2\xcc\x7d',
+          data=b'\x93\x9f\x5a\x10\x55\x57\x30\xa0\xb4\x00\x72\x1e\x46\x42\x46\x20'
+               b'\xbc\x01\xef\xc3\x79\xcc\x3e\x55\x64\xba\x09\xc2\x6a\x5a\x5c\xb3'
+               b'\xcc\xb5\xd5\x87\x82\xb0\x0a\x94\x58\xfc\x50\x37\x40\xe1\x03\xd3'
+               b'\x4a\x09\xb2\x23\x53\x56\xa4\x45\x4c\xbb\x81\x1c\xdb\x31\xa7\x67'
+               b'\xbd\x38\x8e\xba\x55\xd9\x1f\xf1\x3c\xeb\x07\x4c\x02\xb0\x3e\xc5'
+               b'\xf6\x60\xdd\x68\xe1\xd4\xec\xee\x27\xc0\x6d\x1a\x80\xe2\xcc\x7d',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -305,11 +305,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='CAST', crypt_key='sixteenbytes key',
+                         crypt_algo='CAST', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -323,7 +323,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -336,12 +336,12 @@ assert(d[TCP] == p[TCP])
 #    mode tunnel enc 'cbc(cast5)' '0x7369787465656e6279746573206b6579' auth digest_null '' flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\xcd\x4a\x46\x05\x51\x54\x73\x35\x1d\xad\x4b\x10\xc1\x15\xe2\x70'
-               '\xbc\x9c\x53\x8f\x4d\x1c\x87\x1a\xc1\xb0\xdf\x80\xd1\x0c\xa4\x59'
-               '\xe6\x50\xde\x46\xdb\x3f\x28\xc2\xda\x6c\x2b\x81\x5e\x7c\x7b\x4f'
-               '\xbc\x8d\xc1\x6d\x4a\x2b\x04\x91\x9e\xc4\x0b\xba\x05\xba\x3b\x71'
-               '\xac\xe3\x16\xcf\x7f\x00\xc5\x87\x7d\x72\x48\xe6\x5b\x43\x19\x24'
-               '\xae\xa6\x2c\xcc\xad\xbf\x37\x6c\x6e\xea\x71\x67\x73\xd6\x11\x9f',
+          data=b'\xcd\x4a\x46\x05\x51\x54\x73\x35\x1d\xad\x4b\x10\xc1\x15\xe2\x70'
+               b'\xbc\x9c\x53\x8f\x4d\x1c\x87\x1a\xc1\xb0\xdf\x80\xd1\x0c\xa4\x59'
+               b'\xe6\x50\xde\x46\xdb\x3f\x28\xc2\xda\x6c\x2b\x81\x5e\x7c\x7b\x4f'
+               b'\xbc\x8d\xc1\x6d\x4a\x2b\x04\x91\x9e\xc4\x0b\xba\x05\xba\x3b\x71'
+               b'\xac\xe3\x16\xcf\x7f\x00\xc5\x87\x7d\x72\x48\xe6\x5b\x43\x19\x24'
+               b'\xae\xa6\x2c\xcc\xad\xbf\x37\x6c\x6e\xea\x71\x67\x73\xd6\x11\x9f',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -360,7 +360,7 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
@@ -379,7 +379,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -393,11 +393,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='DES', crypt_key='8bytekey',
+                         crypt_algo='DES', crypt_key=b'8bytekey',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -414,7 +414,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -428,11 +428,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='3DES', crypt_key='threedifferent8byteskeys',
+                         crypt_algo='3DES', crypt_key=b'threedifferent8byteskeys',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -449,7 +449,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -463,11 +463,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -483,7 +483,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -497,11 +497,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CTR', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-CTR', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -517,7 +517,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -531,11 +531,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='Blowfish', crypt_key='sixteenbytes key',
+                         crypt_algo='Blowfish', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -551,7 +551,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -565,11 +565,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='CAST', crypt_key='sixteenbytes key',
+                         crypt_algo='CAST', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -585,7 +585,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -602,12 +602,12 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -619,7 +619,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -633,12 +633,12 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -650,7 +650,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -659,7 +659,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -668,12 +668,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -686,7 +686,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -700,12 +700,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -718,7 +718,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -727,7 +727,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -736,12 +736,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-384-192', auth_key='secret key')
+                         auth_algo='SHA2-384-192', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -754,7 +754,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -768,12 +768,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-384-192', auth_key='secret key')
+                         auth_algo='SHA2-384-192', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -786,7 +786,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -795,7 +795,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -804,12 +804,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-512-256', auth_key='secret key')
+                         auth_algo='SHA2-512-256', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -822,7 +822,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -836,12 +836,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-512-256', auth_key='secret key')
+                         auth_algo='SHA2-512-256', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -854,7 +854,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -863,7 +863,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -872,12 +872,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key')
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -890,7 +890,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -904,12 +904,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key')
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -922,7 +922,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -931,7 +931,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -940,12 +940,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key')
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -958,7 +958,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -972,12 +972,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key')
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -990,7 +990,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -999,7 +999,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -1011,12 +1011,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1030,7 +1030,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1044,12 +1044,12 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1063,7 +1063,7 @@ assert(e.proto == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1072,7 +1072,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1081,12 +1081,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1101,7 +1101,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1115,12 +1115,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1135,7 +1135,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1144,7 +1144,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1153,12 +1153,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-384-192', auth_key='secret key',
+                         auth_algo='SHA2-384-192', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1173,7 +1173,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1187,12 +1187,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-384-192', auth_key='secret key',
+                         auth_algo='SHA2-384-192', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1207,7 +1207,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1216,7 +1216,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1225,12 +1225,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-512-256', auth_key='secret key',
+                         auth_algo='SHA2-512-256', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1245,7 +1245,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1259,12 +1259,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='SHA2-512-256', auth_key='secret key',
+                         auth_algo='SHA2-512-256', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1279,7 +1279,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1288,7 +1288,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1297,12 +1297,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key',
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1317,7 +1317,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1331,12 +1331,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key',
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1351,7 +1351,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1360,7 +1360,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1369,12 +1369,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key',
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1389,7 +1389,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -1403,12 +1403,12 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key',
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1423,7 +1423,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should be readable
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -1432,7 +1432,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -1444,12 +1444,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -1462,7 +1462,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1476,12 +1476,12 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -1494,7 +1494,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1503,7 +1503,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1512,11 +1512,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -1530,7 +1530,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1543,13 +1543,13 @@ assert(d[TCP] == p[TCP])
 #    mode tunnel aead 'rfc4106(gcm(aes))' '0x3136627974656b65792b34627974656e6f6e6365' 128 flag align4
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x66\x00\x28\x86\xe9\xdf\xc5\x24\xb0\xbd\xfd\x62\x61\x7e\xd3\x76'
-               '\x7b\x48\x28\x8e\x76\xaa\xea\x48\xb8\x40\x30\x8a\xce\x50\x71\xbb'
-               '\xc0\xb2\x47\x71\xd7\xa4\xa0\xcb\x03\x68\xd3\x16\x5a\x7c\x37\x84'
-               '\x87\xc7\x19\x59\xb4\x7c\x76\xe3\x48\xc0\x90\x4b\xd2\x36\x95\xc1'
-               '\xb7\xa4\xb6\x7b\x89\xe6\x4f\x10\xae\xdb\x84\x47\x46\x00\xb4\x44'
-               '\xe6\x6d\x16\x55\x5f\x82\x36\xa5\x49\xf7\x52\x81\x65\x90\x4d\x28'
-               '\x92\xb2\xe3\xf1\xa4\x02\xd2\x37\xac\x0b\x7a\x10\xcf\x64\x46\xb9',
+          data=b'\x66\x00\x28\x86\xe9\xdf\xc5\x24\xb0\xbd\xfd\x62\x61\x7e\xd3\x76'
+               b'\x7b\x48\x28\x8e\x76\xaa\xea\x48\xb8\x40\x30\x8a\xce\x50\x71\xbb'
+               b'\xc0\xb2\x47\x71\xd7\xa4\xa0\xcb\x03\x68\xd3\x16\x5a\x7c\x37\x84'
+               b'\x87\xc7\x19\x59\xb4\x7c\x76\xe3\x48\xc0\x90\x4b\xd2\x36\x95\xc1'
+               b'\xb7\xa4\xb6\x7b\x89\xe6\x4f\x10\xae\xdb\x84\x47\x46\x00\xb4\x44'
+               b'\xe6\x6d\x16\x55\x5f\x82\x36\xa5\x49\xf7\x52\x81\x65\x90\x4d\x28'
+               b'\x92\xb2\xe3\xf1\xa4\x02\xd2\x37\xac\x0b\x7a\x10\xcf\x64\x46\xb9',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -1564,11 +1564,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -1582,7 +1582,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1591,7 +1591,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1601,11 +1601,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -1620,7 +1620,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1633,13 +1633,13 @@ assert(d == p)
 #    mode tunnel aead 'rfc4309(ccm(aes))' '0x3136627974656b657933627974656e6f6e6365' 64
 ref = IP() \
     / ESP(spi=0x222,
-          data='\x2e\x02\x9f\x1f\xad\x76\x80\x58\x8f\xeb\x45\xf1\x66\xe3\xad\xa6'
-               '\x90\x1b\x2b\x7d\xd3\x3d\xa4\x53\x35\xc8\xfa\x92\xfd\xd7\x42\x2f'
-               '\x87\x60\x9b\x46\xb0\x21\x5e\x82\xfb\x2f\x59\xba\xf0\x6c\xe5\x51'
-               '\xb8\x36\x20\x88\xfe\x49\x86\x60\xe8\x0a\x3d\x36\xb5\x8a\x08\xa9'
-               '\x5e\xe3\x87\xfa\x93\x3f\xe8\xc2\xc5\xbf\xb1\x2e\x6f\x7d\xc5\xa5'
-               '\xd8\xe5\xf3\x25\x21\x81\x43\x16\x48\x10\x7c\x04\x31\x20\x07\x7c'
-               '\x7b\xda\x5d\x1a\x72\x45\xc4\x79',
+          data=b'\x2e\x02\x9f\x1f\xad\x76\x80\x58\x8f\xeb\x45\xf1\x66\xe3\xad\xa6'
+               b'\x90\x1b\x2b\x7d\xd3\x3d\xa4\x53\x35\xc8\xfa\x92\xfd\xd7\x42\x2f'
+               b'\x87\x60\x9b\x46\xb0\x21\x5e\x82\xfb\x2f\x59\xba\xf0\x6c\xe5\x51'
+               b'\xb8\x36\x20\x88\xfe\x49\x86\x60\xe8\x0a\x3d\x36\xb5\x8a\x08\xa9'
+               b'\x5e\xe3\x87\xfa\x93\x3f\xe8\xc2\xc5\xbf\xb1\x2e\x6f\x7d\xc5\xa5'
+               b'\xd8\xe5\xf3\x25\x21\x81\x43\x16\x48\x10\x7c\x04\x31\x20\x07\x7c'
+               b'\x7b\xda\x5d\x1a\x72\x45\xc4\x79',
           seq=1)
 
 d_ref = sa.decrypt(ref)
@@ -1655,11 +1655,11 @@ assert(d_ref.haslayer(ICMP))
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -1674,7 +1674,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1683,7 +1683,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1692,12 +1692,12 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1712,7 +1712,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1726,12 +1726,12 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -1746,7 +1746,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1755,7 +1755,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1764,11 +1764,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -1784,7 +1784,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1798,11 +1798,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -1818,7 +1818,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1827,7 +1827,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1837,11 +1837,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -1857,7 +1857,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -1872,11 +1872,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
@@ -1892,7 +1892,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -1901,7 +1901,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -1913,11 +1913,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='sixteenbytes key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -1947,11 +1947,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='sixteenbytes key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -1972,7 +1972,7 @@ e[TCP].sport = 5
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -1981,11 +1981,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2015,11 +2015,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2040,7 +2040,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2049,11 +2049,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-384-192', auth_key='secret key')
+                         auth_algo='SHA2-384-192', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2083,11 +2083,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-384-192', auth_key='secret key')
+                         auth_algo='SHA2-384-192', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2108,7 +2108,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2117,11 +2117,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-512-256', auth_key='secret key')
+                         auth_algo='SHA2-512-256', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2151,11 +2151,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-512-256', auth_key='secret key')
+                         auth_algo='SHA2-512-256', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2176,7 +2176,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2185,11 +2185,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key')
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2219,11 +2219,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key')
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2244,7 +2244,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2253,11 +2253,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key')
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -2287,11 +2287,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key')
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key')
 
 e = sa.encrypt(p)
 e
@@ -2312,7 +2312,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -2324,11 +2324,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2358,11 +2358,11 @@ assert(d[TCP] == p[TCP])
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2383,7 +2383,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2392,11 +2392,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2426,11 +2426,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2451,7 +2451,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2460,11 +2460,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-384-192', auth_key='secret key',
+                         auth_algo='SHA2-384-192', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2494,11 +2494,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-384-192', auth_key='secret key',
+                         auth_algo='SHA2-384-192', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2519,7 +2519,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2528,11 +2528,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-512-256', auth_key='secret key',
+                         auth_algo='SHA2-512-256', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2562,11 +2562,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-512-256', auth_key='secret key',
+                         auth_algo='SHA2-512-256', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2587,7 +2587,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2596,11 +2596,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key',
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2630,11 +2630,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-MD5-96', auth_key='secret key',
+                         auth_algo='HMAC-MD5-96', auth_key=b'secret key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2655,7 +2655,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2664,11 +2664,11 @@ except IPSecIntegrityError, err:
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key',
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2698,11 +2698,11 @@ assert(d == p)
 p = IP(src='1.1.1.1', dst='2.2.2.2')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IP(str(p))
+p = IP(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='AES-CMAC-96', auth_key='sixteenbytes key',
+                         auth_algo='AES-CMAC-96', auth_key=b'sixteenbytes key',
                          tunnel_header=IP(src='11.11.11.11', dst='22.22.22.22'))
 
 e = sa.encrypt(p)
@@ -2723,7 +2723,7 @@ e.dst = '4.4.4.4'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -2736,7 +2736,7 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
@@ -2752,7 +2752,7 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -2766,11 +2766,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -2783,7 +2783,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -2797,12 +2797,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2813,7 +2813,7 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -2827,12 +2827,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2843,16 +2843,16 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
-e[ESP].data = e[ESP].data.replace('\x01', '\x21')
+e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 
 * integrity verification should fail
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2861,12 +2861,12 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2878,7 +2878,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -2892,12 +2892,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -2909,7 +2909,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -2918,7 +2918,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2927,11 +2927,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -2944,7 +2944,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -2958,11 +2958,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -2975,7 +2975,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -2984,7 +2984,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -2994,11 +2994,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -3011,7 +3011,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3026,11 +3026,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None)
 
 e = sa.encrypt(p)
@@ -3043,7 +3043,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -3052,7 +3052,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3062,7 +3062,7 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
@@ -3080,7 +3080,7 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3094,11 +3094,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
@@ -3113,7 +3113,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3127,12 +3127,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3145,7 +3145,7 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * integrity verification should pass
 d = sa.decrypt(e)
@@ -3159,12 +3159,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
                          crypt_algo='NULL', crypt_key=None,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3177,7 +3177,7 @@ assert(e.nh == socket.IPPROTO_ESP)
 assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
-assert('testdata' in e[ESP].data)
+assert(b'testdata' in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
@@ -3186,7 +3186,7 @@ e[ESP].data = e[ESP].data.replace(b'\x01', b'\x21')
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3195,12 +3195,12 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3214,7 +3214,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3228,12 +3228,12 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CBC', crypt_key='sixteenbytes key',
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         crypt_algo='AES-CBC', crypt_key=b'sixteenbytes key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3247,7 +3247,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -3256,7 +3256,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3265,11 +3265,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
@@ -3284,7 +3284,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3298,11 +3298,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-GCM', crypt_key='16bytekey+4bytenonce',
+                         crypt_algo='AES-GCM', crypt_key=b'16bytekey+4bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
@@ -3317,7 +3317,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -3326,7 +3326,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3336,11 +3336,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
@@ -3354,7 +3354,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 d = sa.decrypt(e)
 d
@@ -3369,11 +3369,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(ESP, spi=0x222,
-                         crypt_algo='AES-CCM', crypt_key='16bytekey3bytenonce',
+                         crypt_algo='AES-CCM', crypt_key=b'16bytekey3bytenonce',
                          auth_algo='NULL', auth_key=None,
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
@@ -3387,7 +3387,7 @@ assert(e.haslayer(ESP))
 assert(not e.haslayer(TCP))
 assert(e[ESP].spi == sa.spi)
 * after encryption the original packet payload should NOT be readable
-assert('testdata' not in e[ESP].data)
+assert(b'testdata' not in e[ESP].data)
 
 * simulate the alteration of the packet before decryption
 e[ESP].seq += 1
@@ -3396,7 +3396,7 @@ e[ESP].seq += 1
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3409,11 +3409,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -3442,11 +3442,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -3466,7 +3466,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3475,11 +3475,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -3508,11 +3508,11 @@ assert(d[TCP] == p[TCP])
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key')
+                         auth_algo='SHA2-256-128', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -3532,7 +3532,7 @@ e[TCP].dport = 46
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3541,11 +3541,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3575,11 +3575,11 @@ assert(d == p)
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key',
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3600,7 +3600,7 @@ e.src = 'cc::ee'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 #######################################
@@ -3609,11 +3609,11 @@ except IPSecIntegrityError, err:
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3643,11 +3643,11 @@ assert(d == p)
 p = IPv6(src='11::22', dst='22::11')
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='SHA2-256-128', auth_key='secret key',
+                         auth_algo='SHA2-256-128', auth_key=b'secret key',
                          tunnel_header=IPv6(src='aa::bb', dst='bb::aa'))
 
 e = sa.encrypt(p)
@@ -3668,7 +3668,7 @@ e.src = 'cc::ee'
 try:
     d = sa.decrypt(e)
     assert(False)
-except IPSecIntegrityError, err:
+except IPSecIntegrityError as err:
     err
 
 ###############################################################################
@@ -3685,11 +3685,11 @@ p /= IPv6ExtHdrDestOpt()
 p /= IPv6ExtHdrFragment()
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
@@ -3707,11 +3707,11 @@ p /= IPv6ExtHdrHopByHop()
 p /= IPv6ExtHdrRouting(addresses=['aa::bb', 'cc::dd', 'ee::ff'])
 p /= TCP(sport=45012, dport=80)
 p /= Raw('testdata')
-p = IPv6(str(p))
+p = IPv6(raw(p))
 p
 
 sa = SecurityAssociation(AH, spi=0x222,
-                         auth_algo='HMAC-SHA1-96', auth_key='secret key')
+                         auth_algo='HMAC-SHA1-96', auth_key=b'secret key')
 
 e = sa.encrypt(p)
 e
diff --git a/test/linux.uts b/test/linux.uts
index 22414465d56aa43b3b33d0979fb0a1eacfc12e78..2706f35f4c93f835c92888f850f1ddd1f529ef2b 100644
--- a/test/linux.uts
+++ b/test/linux.uts
@@ -12,10 +12,13 @@
 ~ automaton netaccess linux needs_root
 * This test retries on failure because it often fails
 
+from __future__ import print_function
 import os
 import time
 import signal
 
+from scapy.modules.six.moves import range
+
 def handler(signum, stack_frame):
     raise Exception("Timer expired !")
 
@@ -28,12 +31,12 @@ IPTABLE_RULE = "iptables -%c INPUT -s %s -p tcp --sport 80 -j DROP"
 assert(os.system(IPTABLE_RULE % ('A', SECDEV_IP4)) == 0)
 
 success = False
-for i in xrange(10):
+for i in range(10):
     tmp = signal.alarm(5)
     try:
         r, w = os.pipe()
         t = TCP_client(SECDEV_IP4, 80, external_fd={ "tcp": (r,w) })
-        tmp = os.write(w, "HEAD / HTTP/1.0\r\n\r\n")
+        tmp = os.write(w, b"HEAD / HTTP/1.0\r\n\r\n")
         t.runbg()
         time.sleep(0.5)
         response = os.read(r, 4096)
@@ -41,13 +44,13 @@ for i in xrange(10):
         t.stop()
         os.close(r)
         os.close(w)
-        if response.startswith("HTTP/1.1 200 OK"):
+        if response.startswith(b"HTTP/1.1 200 OK"):
             success = True
             break
         else:
             time.sleep(0.5)
     except Exception as e:
-        print e
+        print(e)
 
 # Remove the iptables rule
 assert(os.system(IPTABLE_RULE % ('D', SECDEV_IP4)) == 0)
diff --git a/test/nmap.uts b/test/nmap.uts
index d25228851e3a3e9df503f98050cf5679702ae52a..20003f7e86e7d9988edf957518b3d51aa378168a 100644
--- a/test/nmap.uts
+++ b/test/nmap.uts
@@ -10,8 +10,13 @@
 load_module('nmap')
 
 = Fetch database
-import urllib
-open('nmap-os-fingerprints', 'wb').write(urllib.urlopen('https://raw.githubusercontent.com/nmap/nmap/9efe1892/nmap-os-fingerprints').read())
+from __future__ import print_function
+try:
+    from urllib.request import urlopen
+except ImportError:
+    from urllib2 import urlopen
+
+open('nmap-os-fingerprints', 'wb').write(urlopen('https://raw.githubusercontent.com/nmap/nmap/9efe1892/nmap-os-fingerprints').read())
 conf.nmap_base = 'nmap-os-fingerprints'
 
 = Database loading
@@ -20,14 +25,14 @@ assert len(nmap_kdb.get_base()) > 100
 = fingerprint test: www.secdev.org
 ~ netaccess
 score, fprint = nmap_fp('www.secdev.org')
-print score, fprint
+print(score, fprint)
 assert score > 0.5
 assert fprint
 
 = fingerprint test: gateway
 ~ netaccess
 score, fprint = nmap_fp(conf.route.route('0.0.0.0')[2])
-print score, fprint
+print(score, fprint)
 assert score > 0.5
 assert fprint